Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 10, 2023, 4:17 p.m.	March 10, 2023, 4:23 p.m.

Size	150.3KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`3e7a4148f1133cb4b8a097fd74590f44`
SHA256	`6618359d4d19997728359453b0598be7562c293ef9d6ac51f2635586096a52bd`
CRC32	`181C9D6D`
ssdeep	`1536:nHcXFmx32TcZ8BCNDoeRHRQEQcUgaZutJ3gZNGxFh+Lx5s+5DFB+Er/qObMg8:H7gcNDnxQEdUStJ3gyxX+LU6iEr/qOK`
Yara	UPX_Zero - UPX packed file Malicious_Packer_Zero - Malicious Packer IsPE32 - (no description) PE_Header_Zero - PE File Signature

svchost.exe C:\Windows\system32\svchost.exe
2636
- svchost.exe C:\Windows\system32\svchost.exe
  2780
- svchost.exe C:\Windows\system32\svchost.exe
  2848
- svchost.exe C:\Windows\system32\svchost.exe
  3008
- svchost.exe C:\Windows\system32\svchost.exe
  1228

Name	Response	Post-Analysis Lookup
hbfuels.com	A 85.233.160.148	85.233.160.148
pro-fa.com
rtcasey.com	A 69.195.90.46	69.195.90.46
jabian.com	A 104.26.7.17 A 172.67.71.13 A 104.26.6.17	104.26.7.17
wolffkran.de
envogen.com	A 172.67.163.101 A 104.21.73.149	104.21.73.149
muhr-soehne.de	A 5.189.171.125	5.189.171.125
noblesse.be	A 5.134.4.115	5.134.4.115
anduran.com	CNAME traff-5.hugedomains.com A 34.205.242.146 A 54.161.222.85 CNAME hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com	3.18.7.81
pleszew.policja.gov.pl	A 91.229.22.126	91.229.22.126
ossir.org	A 51.159.3.117	51.159.3.117
dspears.com	CNAME traff-1.hugedomains.com CNAME hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com A 52.71.57.184 A 54.209.32.212	3.130.253.23
nt-hat.com
michiana.org
atbauk.org	A 104.21.92.170 A 172.67.196.145	172.67.196.145
www.kernsafe.com	A 104.26.3.124 A 104.26.2.124 A 172.67.72.98	104.26.3.124
s5w.com	A 192.99.226.184	192.99.226.184
zugseil.com	A 92.42.191.38	92.42.191.38
amerifor.com	A 64.18.191.61	64.18.191.61
camamat.com	A 104.21.235.31 A 104.21.235.32	104.21.235.32
shteeble.com	A 185.106.129.180	185.106.129.180
angework.com	A 219.94.128.87	219.94.128.87
ludomemo.com	A 27.0.174.59	27.0.174.59
www.mobilnic.net	A 154.203.14.100	154.203.14.100
www.udesign.biz
workplus.hu	A 172.67.197.24 A 104.21.92.183	172.67.197.24
www.netcr.com	CNAME traff-5.hugedomains.com A 34.205.242.146 A 54.161.222.85 CNAME hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com	52.86.6.113
hes.pt	A 52.19.230.145	52.19.230.145
roewer.de	A 45.142.176.225	45.142.176.225
aoinko.net	A 157.7.107.38	157.7.107.38
dzm.cz	A 83.167.255.150	83.167.255.150
www.pwd.org	CNAME pwd.org A 208.109.214.162	208.109.214.162
strazynski.pl	A 85.128.196.22	85.128.196.22
www.iamdirt.com	CNAME td-balancer-199-15-163-148.wixdns.net A 199.15.163.148 CNAME gcdn0.wixdns.net CNAME balancer-ccm.wixdns.net	199.15.163.138
www.fnsds.org	CNAME comingsoon.namebright.com CNAME cdl-lb-1356093980.us-east-1.elb.amazonaws.com A 34.237.200.184 A 52.200.100.0	52.200.100.0
redgiga.com	A 172.67.186.153 A 104.21.76.38	172.67.186.153
www.pupi.cz	A 103.224.182.241	103.224.182.241
peminet.net	A 198.54.117.242	198.54.117.242
valselit.com	A 193.70.68.254	193.70.68.254
kewlmail.com	A 63.251.106.25	63.251.106.25
araax.com	A 18.119.154.66 CNAME hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com A 3.140.13.188 CNAME traff-6.hugedomains.com	34.205.242.146
siongann.com	A 104.21.8.75 A 172.67.156.237	172.67.156.237
www.muhr-soehne.de	A 5.189.171.125	5.189.171.125
www.crcsi.org	A 165.227.252.190 CNAME crcsi.org	165.227.252.190
mail.airmail.net	A 66.226.70.66	66.226.70.66
webways.com	A 172.67.128.139 A 104.21.1.51	172.67.128.139
mail7.digitalwaves.co.nz
www.spanesi.com	A 5.196.166.214	5.196.166.214
wvs-net.de	A 172.67.181.113 A 104.21.43.163	172.67.181.113
mackusick.de	A 217.160.0.131	217.160.0.131
adeesa.net	A 172.67.209.11 A 104.21.77.146	104.21.77.146
mikihan.com	A 153.126.211.112	153.126.211.112
canasil.com	A 172.67.68.180 A 104.26.3.14 A 104.26.2.14	104.26.3.14
nrsi.com	A 76.223.35.103	76.223.35.103
www.otena.com	A 99.83.154.118	99.83.154.118
sanfotek.net	A 97.74.42.79	97.74.42.79
www.pohlfood.com	CNAME pohlfood.com A 104.218.10.254	104.218.10.254
78san.com	A 133.242.15.119	133.242.15.119
xult.org	A 65.52.128.33	65.52.128.33
htsmx.net	A 63.251.106.25	63.251.106.25
onzcda.com	A 35.186.238.101	35.186.238.101
vivastay.com	CNAME hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com CNAME traff-2.hugedomains.com A 3.130.253.23 A 3.130.204.160 CNAME traff-1.hugedomains.com A 52.71.57.184 A 54.209.32.212 CNAME hdr-nlb9-41371129e8304c29.elb.us-east-1.amazonaws.com	52.71.57.184
shenhgts.net	A 199.59.243.220	199.59.243.220
okashimo.com	A 203.137.75.45	203.137.75.45
www.dayvo.com	A 172.67.184.30 A 104.21.68.7	104.21.68.7
agitz.com.br
www.olras.com	A 80.93.82.33	80.93.82.33
madjek.com
www.vexcom.com	A 104.21.55.224 A 172.67.173.200	104.21.55.224
ascc.org.au	A 203.210.102.34	203.210.102.34
www.findbc.com	A 76.223.65.111 A 13.248.216.40	13.248.216.40
duiops.net	A 135.125.108.170	135.125.108.170
softizer.com	A 185.163.45.187	185.163.45.187
cbaben.com	A 173.205.126.33	173.205.126.33
at-shun.com	A 210.140.73.39	210.140.73.39
missnue.com	A 104.21.234.120 A 104.21.234.121	104.21.234.120
bigzz.by	A 178.249.70.75	178.249.70.75
unicus.jp	A 49.212.232.113	49.212.232.113
beafin.com	A 133.125.38.187	133.125.38.187
clysma.com
geecl.com	A 213.175.217.57	213.175.217.57
assideum.com	A 52.219.88.115	52.219.178.56
nlcv.bas.bg	A 195.96.252.188	195.96.252.188
sokuwan.net	A 185.230.63.186 A 185.230.63.107 A 185.230.63.171	185.230.63.171
x1.i.lencr.org	CNAME crl.root-x1.letsencrypt.org.edgekey.net CNAME e8652.dscx.akamaiedge.net A 23.61.75.162	104.74.211.103
hchc.org	A 52.11.37.152 A 34.224.10.110	34.224.10.110
www.dgmna.com	CNAME dgmna.com A 192.124.249.20	192.124.249.20
haigh-me.com
yoruksut.com	A 93.187.206.66	93.187.206.66
ymlp15.net
kevyt.net	A 172.67.129.18 A 104.21.2.101	104.21.2.101
amele.com
nettle.pl	A 195.128.140.29	195.128.140.29
from30ty.com	A 157.7.231.224	157.7.231.224
snf.it	A 95.174.22.233	95.174.22.233
someikan.com
hamaker.net	A 34.102.136.180	34.102.136.180
oaith.ca	A 192.124.249.12	192.124.249.12
bd-style.com	A 107.165.223.27	107.165.223.27
skgm.ru	A 91.201.52.102	91.201.52.102
de
www.medius.si	A 18.64.8.48 A 18.64.8.44 A 18.64.8.59 A 18.64.8.111 CNAME d2r2uj0bnofxxz.cloudfront.net	18.64.8.59
cjcagent.com	A 157.112.187.75	157.112.187.75
umcor.am	A 172.67.135.11 A 104.21.6.168	104.21.6.168
burstner.ru	A 52.50.65.32	52.50.65.32
clinicasanluis.com.co	A 104.21.66.220 A 172.67.164.178	172.67.164.178
tcpoa.com	A 159.89.244.183 A 164.90.244.158	164.90.244.158
hyab.se	A 172.67.199.57 A 104.21.52.126	172.67.199.57
mkm-gr.com	A 79.124.76.247	79.124.76.247
magicomm.co.uk	A 83.223.113.46	83.223.113.46
host.do	A 217.79.248.38	217.79.248.38
samtv.ro
www.photo4b.com	A 195.78.66.50	195.78.66.50
kustnara.com	A 99.83.190.102 A 13.248.155.104 A 76.223.27.102 A 75.2.70.75	13.248.155.104
averwin.com
fortknox.bm	A 216.177.137.32	216.177.137.32
www.xaicom.es	CNAME xaicom.es A 188.165.133.163	188.165.133.163
sinwal.com	A 172.67.206.199 A 104.21.50.138	172.67.206.199
icd-host.com	A 192.252.159.165 A 192.252.159.116	192.252.159.116
daytonir.com	A 172.64.147.213 A 104.18.40.43	104.18.40.43
cpwpb.com
www.c9dd.com	A 188.166.152.188	188.166.152.188
nels.co.uk	A 5.134.13.210	5.134.13.210
cutchie.com	A 199.59.243.222	199.59.243.222
epc.com.au	A 103.4.16.43	103.4.16.43
wantapc.net	A 157.7.107.49	157.7.107.49
www.koz1.net
alexpope.biz	A 76.74.184.61	76.74.184.61
kamptal.at	A 128.204.134.138	128.204.134.138
c-drop.net
pers.com	A 192.124.249.3	192.124.249.3
isom.org	A 192.124.249.14	192.124.249.14
sidepath.com	A 34.193.204.92 A 34.193.69.252 A 99.83.190.102 A 75.2.70.75	75.2.70.75
fifa-ews.com	A 172.67.189.227 A 104.21.10.34	172.67.189.227
www.11tochi.net	A 157.112.176.4	157.112.176.4
wnit.org	A 38.111.255.201	38.111.255.201
www.quadlock.com	A 70.39.251.249 CNAME quadlock.com	70.39.251.249
www.usadig.com	A 198.100.146.220	198.100.146.220
arowines.com	A 104.164.117.233	104.164.117.233
ktenergo.ru
www.pr-park.com	A 118.27.125.181	118.27.125.181
www.com-sit.com	A 104.26.10.81 A 104.26.11.81 A 172.67.70.223	104.26.11.81
www.synetik.net	CNAME synetik.net A 193.166.255.171	193.166.255.171
www.jroy.net
orlyhotel.com	A 104.21.48.207 A 172.67.156.49	172.67.156.49
gydrozo.ru	A 91.220.211.163	91.220.211.163
canmore.com
metaforacom.com	A 185.42.105.162	185.42.105.162
hubbikes.com	A 75.2.70.75 A 99.83.190.102	75.2.70.75
ssm.ch	A 93.189.66.202	93.189.66.202
banvari.com	A 23.227.38.32	23.227.38.32
sigtoa.com	A 104.21.49.75 A 172.67.160.168	172.67.160.168
aiolos-sa.gr	A 104.21.26.121 A 172.67.168.72	172.67.168.72
www.jenco.co.uk	A 104.21.23.9 A 172.67.208.67	172.67.208.67
karila.fr	A 89.107.169.125	89.107.169.125
dayvo.com	A 104.21.68.7 A 172.67.184.30	104.21.68.7
webband.com
cqdgroup.com	A 221.132.33.88	221.132.33.88
univi.it	A 18.197.121.220	18.197.121.220
a-domani.com	A 183.90.232.24	183.90.232.24
techtrans.de	A 185.237.66.112	185.237.66.112
msl-lock.com	A 165.160.15.20 A 165.160.13.20	165.160.13.20
iranytu.net	A 103.224.212.222	103.224.212.222
kavram.com	A 104.21.89.126 A 172.67.189.68	172.67.189.68
amba-tc.si
smtp.sbcglobal.yahoo.com	CNAME smtp-sbc.mail.yahoo.com A 67.195.12.38 A 66.163.170.48 A 66.218.88.163 CNAME smtp1.sbc.mail.am0.yahoodns.net	66.163.170.48
x96.com	A 172.67.167.96 A 104.21.73.229	172.67.167.96
chzko.ru
pccj.net	A 104.21.29.72 A 172.67.148.147	172.67.148.147
touchfam.ca	A 15.197.142.173 A 3.33.152.147	15.197.142.173
www.tyrns.com	A 62.75.216.137	62.75.216.137
keio-web.com	A 219.94.128.216	219.94.128.216
ludea.cz
www.railbook.net	A 108.59.12.98	108.59.12.98
nts-web.net	A 49.212.235.175	49.212.235.175
thiessen.net	A 62.75.251.116	62.75.251.116
linac.co.uk	A 23.236.62.147	23.236.62.147
notis.ru	A 185.178.208.141	185.178.208.141
shesfit.com	A 104.21.74.141 A 172.67.158.251	104.21.74.141
www.yumgiskor.kz
cpmteam.com	A 172.67.188.75 A 104.21.32.240	172.67.188.75
ifesnet.com	A 172.67.137.15 A 104.21.26.154	172.67.137.15
www.holleman.us	A 51.79.51.72	51.79.51.72
flamingorecordings.com	A 35.214.171.193	35.214.171.193
www.maktraxx.com	CNAME maktraxx.com A 72.44.93.236	72.44.93.236
themark.org	A 35.172.94.1 A 100.24.208.97	35.172.94.1
www.nelipak.nl	A 82.201.61.230	82.201.61.230
www.valdal.com	A 104.26.6.221 A 172.67.73.176 A 104.26.7.221	104.26.6.221
ciicsc.com
shanks.co.uk	A 217.19.254.22	217.19.254.22
insia.com	A 82.208.6.9	82.208.6.9
pcoyuncu.com	A 213.142.131.159	213.142.131.159
vonparis.com	A 23.185.0.4	23.185.0.4
www.pb-games.com	CNAME pb-games.com A 173.254.28.29	173.254.28.29
skypearl.com	A 153.122.170.15	153.122.170.15
www.pcgrate.com	A 172.67.201.26 A 104.21.66.46	104.21.66.46
www.hyabmagneter.se	A 104.21.69.146 A 172.67.209.90	104.21.69.146
avse.hu	A 185.129.138.60	185.129.138.60
www.ora.ecnet.jp	CNAME ora.ecnet.jp A 60.43.154.138	60.43.154.138
cvswl.org
biosolve.com	A 151.101.130.159	151.101.130.159
infotech.pl	A 79.96.32.254	79.96.32.254
deckoviny.cz	A 88.86.118.82	88.86.118.82
bossinst.com	A 205.178.189.131	205.178.189.131
sledsport.ru	A 185.22.232.175	185.22.232.175
anteph.org
actmin.com
org
www.yocinc.org	A 66.94.119.160	66.94.119.160
likangds.com	A 23.225.40.19	23.225.40.19
doggybag.org	A 213.186.33.16	213.186.33.16
fogra.com.pl	A 85.128.55.51	85.128.55.51
ccssinc.com	A 104.21.19.68 A 172.67.185.152	104.21.19.68
t-trust.jp	A 183.181.82.14	183.181.82.14
www.fink.com	A 69.163.218.51	69.163.218.51
cubodown.com	A 104.21.30.14 A 172.67.150.50	104.21.30.14
oh28ya.com	A 18.182.136.195 A 54.250.32.94	18.182.136.195
www.speelhal.net	A 217.19.237.54	217.19.237.54
in1.smtp.messagingengine.com	A 66.111.4.74 A 66.111.4.75 A 66.111.4.72 A 66.111.4.73 A 66.111.4.70 A 66.111.4.71	66.111.4.74
www.stnic.co.uk	A 77.68.50.105	77.68.50.105
calvinly.com	A 216.239.34.21 A 216.239.36.21 A 216.239.38.21 A 216.239.32.21	216.239.34.21
tozzhin.com	A 202.94.166.30	202.94.166.30
apps.identrust.com	CNAME identrust.edgesuite.net CNAME a1952.dscq.akamai.net A 96.16.99.73 A 96.16.99.43	96.16.99.43
akdeniz.nl	A 109.71.54.22	109.71.54.22
www.jacomfg.com	A 96.127.180.42	96.127.180.42
mjrcpas.com	A 154.81.136.239	154.81.136.239
koz1.net
hazmatt.com	A 205.178.189.131	205.178.189.131
absblast.com	A 141.193.213.20	141.193.213.20
invictus.pl
eos-i.com	CNAME macx1980.qy56.supcname.com CNAME mfddos.datacname.com CNAME 15.204.18.132.datacname.com A 15.204.18.132	15.204.18.132
orbitgas.com	A 107.180.58.31	107.180.58.31
revoldia.net	A 45.200.235.135 A 185.244.106.2	45.200.235.135
willsub.com	A 69.89.107.122	69.89.107.122
portoccd.org	A 51.89.6.56	51.89.6.56
webavant.com	A 148.72.176.26	148.72.176.26
603888.com	CNAME num6.17986.net A 67.21.93.229	67.21.93.229
www.aevga.com	CNAME aevga.com A 108.167.164.216	108.167.164.216
www.naoi-a.com	A 202.254.236.40	202.254.236.40
multip.hu
www.t-tre.com	A 135.181.73.98	135.181.73.98
lyto.net	A 172.67.138.3 A 104.21.62.182	172.67.138.3
www.lrsuk.com	CNAME language-recruitment.eu-2.volcanic.cloud A 18.64.8.108 CNAME d2kt7vovxa5e81.cloudfront.net A 18.64.8.69 A 18.64.8.103 A 18.64.8.80	18.64.8.80
cbras.com	A 54.39.198.18	54.39.198.18
awfraser.com
dog-jog.net	A 153.122.24.177	153.122.24.177
t-mould.com	A 81.169.145.175	81.169.145.175
www.edimart.hu	A 81.2.194.241	81.2.194.241
ftmobile.com	A 199.34.228.78	199.34.228.78
ccrsi.org	A 198.209.253.30	198.209.253.30
scintel.com	A 23.239.201.14	23.239.201.14
dbnet.at	A 188.94.254.88	188.94.254.88
www.medisa.info
listel.co.jp	A 49.212.243.77	49.212.243.77
www.credo.edu.pl	A 62.122.190.121	62.122.190.121
nekono.net	A 202.172.28.187	202.172.28.187
yasuma.com	A 61.200.81.23	61.200.81.23
vfcindia.com	A 68.71.135.170	68.71.135.170
www.fe-bauer.de	A 3.65.101.129	3.65.101.129
www.ottospm.com	A 104.21.63.28 A 172.67.142.169 CNAME www.ottospm.com.cdn.cloudflare.net	104.21.63.28
akr.co.id	A 104.20.122.68 A 104.20.123.68 A 172.67.33.252	104.20.122.68
www.tvtools.fi	A 172.67.152.159 A 104.21.88.198	104.21.88.198
piacton.com
www.tc17.com	A 104.21.79.244 A 172.67.150.80	104.21.79.244
plaske.ua	A 52.211.245.146	52.211.245.146
com-edit.fr	A 63.251.106.25	63.251.106.25
www.sjbs.org	CNAME sjbs.org A 69.163.239.62	69.163.239.62
atb-lit.com	A 208.100.26.245	208.100.26.245
simetar.com	A 104.21.79.166 A 172.67.146.154	172.67.146.154
www.sclover3.com	A 157.112.182.239	157.112.182.239
dhh.la.gov	A 52.200.51.73	52.200.51.73
esmoke.net	A 204.15.134.44	204.15.134.44
rokoron.com	A 211.13.204.3	211.13.204.3
bible.org	A 172.67.33.95 A 104.20.54.214 A 104.20.55.214	172.67.33.95
impexnc.com	A 204.11.56.48	204.11.56.48
www.elpro.si	A 172.67.70.22 A 104.26.14.53 A 104.26.15.53	104.26.14.53
midap.com	A 198.49.23.145 A 198.185.159.144 A 198.49.23.144 A 198.185.159.145	198.49.23.145
mxs.mail.ru	A 94.100.180.31 A 217.69.139.150	217.69.139.150
shittas.com	A 43.246.117.171	43.246.117.171
bount.com.tw	A 104.21.76.140 A 172.67.196.25	104.21.76.140
top1oil.com	A 104.26.0.82 A 172.67.71.55 A 104.26.1.82	104.26.1.82
shztm.ru	A 52.50.65.32	52.50.65.32
popbook.com	A 47.91.167.60	47.91.167.60
gmail-smtp-in.l.google.com	A 64.233.188.27	142.251.8.26
kursavto.ru	A 31.177.80.70 A 31.177.76.70	31.177.76.70
www.snugpak.com	A 104.21.73.182 A 172.67.165.62	104.21.73.182
vdoherty.com	A 91.216.241.100	91.216.241.100
www.cel-cpa.com	A 104.196.26.65	104.196.26.65
ftchat.com
www.gpthink.com	A 39.99.233.155	39.99.233.155
ikulani.com	A 157.7.107.88	157.7.107.88
rappich.de	A 89.31.143.1	89.31.143.1
gcss.com	A 35.186.238.101	35.186.238.101
www.waldi.pl	A 46.242.238.60 CNAME waldi.pl	46.242.238.60
pellys.co.uk	A 77.72.4.226	77.72.4.226
rkengg.com	CNAME traff-5.hugedomains.com A 34.205.242.146 A 54.161.222.85 CNAME hdr-nlb7-aebd5d615260636b.elb.us-east-1.amazonaws.com CNAME hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com CNAME traff-2.hugedomains.com A 3.130.253.23 A 3.130.204.160	18.119.154.66
www.pdqhomes.com	CNAME hdr-nlb5-4e815dd67a14bf7f.elb.us-east-2.amazonaws.com CNAME traff-2.hugedomains.com A 3.130.253.23 A 3.130.204.160	3.140.13.188
www.vazir.se	A 206.191.152.37	206.191.152.37
www.abdg.com	A 192.252.154.18	192.252.154.18
tbvlugus.nl	A 174.129.25.170	174.129.25.170
n23china.com
www.yoruksut.com	A 93.187.206.66	93.187.206.66
sjbmw.com	A 198.199.101.195	198.199.101.195
www.ka-mo-me.com	A 211.1.226.67	211.1.226.67
any-s.net	A 185.104.28.238	185.104.28.238
stopllc.com	A 162.241.233.114	162.241.233.114
www.stajum.com	A 103.3.1.161	103.3.1.161
www.ora-ito.com	A 213.186.33.40	213.186.33.40
www.ex-olive.com	A 210.140.73.39	210.140.73.39
shiner.com	A 104.21.27.205 A 172.67.143.148	104.21.27.205
refintl.org	A 198.49.23.145 A 198.185.159.144 A 198.185.159.145 A 198.49.23.144	198.185.159.144
jnf.at	A 136.243.147.81	136.243.147.81
leapc.com	A 35.231.13.148	35.231.13.148
reproar.com	A 194.143.194.23	194.143.194.23
www.baijaku.com	CNAME baijaku.com A 59.106.19.204	59.106.19.204
www.wkhk.net
scip.org.uk	A 104.26.12.244 A 172.67.72.150 A 104.26.13.244	104.26.13.244
pertex.com	A 185.151.30.147	185.151.30.147
www.fnw.us	A 137.118.26.67 CNAME fnw.us	137.118.26.67
rast.se	A 89.221.250.3	89.221.250.3
e-kami.net	A 202.172.28.89	202.172.28.89
www.vitaindu.com	A 122.128.109.107	122.128.109.107
www.item-pr.com	CNAME item-pr.com A 185.15.129.58 A 213.186.33.17	213.186.33.17
com
web-york.com	A 219.94.129.97	219.94.129.97
www.mqs.com.br	A 170.82.173.30 A 170.82.174.30 CNAME www.mqs.com.br.cdn.gocache.net	170.82.173.30
amic.at	A 78.46.224.133	78.46.224.133
www.valselit.com	A 193.70.68.254	193.70.68.254
gbp-jp.com	A 208.80.123.104 A 208.80.123.195 A 208.80.122.2 A 208.80.122.205	208.80.123.104
ncn.de	A 46.30.60.158	46.30.60.158
acraloc.com	A 192.64.150.164	192.64.150.164
h-et-l.com
www.alteor.cl	CNAME balancer-ccm.wixdns.net CNAME gcdn0.wixdns.net CNAME td-balancer-199-15-163-128.wixdns.net A 199.15.163.128	199.15.163.148
bosado.com	A 5.39.75.157	5.39.75.157
websy.com
www.cokocoko.com	A 18.119.154.66 CNAME hdr-nlb10-d66bbad0736f8259.elb.us-east-2.amazonaws.com A 3.140.13.188 CNAME traff-6.hugedomains.com	52.86.6.113
www.domon.com	CNAME shops.myshopify.com CNAME meubles-domon.myshopify.com A 23.227.38.74	23.227.38.74
k-nikko.com	A 18.177.67.59	18.177.67.59
4locals.net	A 80.82.115.227	80.82.115.227
nme.co.jp	A 203.0.113.0	203.0.113.0
floopis.com	A 3.64.163.50	3.64.163.50
diamir.de	A 138.201.65.187	138.201.65.187
komie.com	A 59.106.13.181	59.106.13.181
fr-dat.com	A 127.0.0.1	127.0.0.1
mijash3.com	A 198.185.159.144 A 198.49.23.144 A 198.185.159.145 A 198.49.23.145	198.185.159.144
www.nunomira.com	CNAME nunomira.com A 192.241.158.94	192.241.158.94
coxkitchensandbaths.com	A 205.149.134.32	205.149.134.32
apcotex.com	A 35.154.163.204	35.154.163.204
www.hummer.hu	CNAME hummer.hu A 185.80.51.179	185.80.51.179
www.jchysk.com	A 208.97.178.138	208.97.178.138
dyag-eng.com	A 3.64.163.50	3.64.163.50
kumaden.com	A 49.212.180.178	49.212.180.178
www.wifi4all.nl	A 104.21.42.10 A 172.67.198.26	104.21.42.10
www.transsib.com	CNAME studyrussian.com CNAME www.studyrussian.com A 80.74.154.6	80.74.154.6
ntc.edu.au	A 192.124.249.15	192.124.249.15
hyab.com	A 104.21.65.224 A 172.67.193.133	104.21.65.224
www.ftchat.com
cyclad.pl	A 87.98.236.253	87.98.236.253
oozkranj.com	A 212.44.102.57	212.44.102.57
ruzee.com	A 207.180.198.201	207.180.198.201
mackusick.com	A 217.160.0.179	217.160.0.179
www.rs-ag.com	A 172.67.152.88 A 104.21.1.213	172.67.152.88
www.fcwcvt.org	A 172.67.134.134 A 104.21.25.200	104.21.25.200
www.nqks.com	A 147.154.0.23 CNAME zemonitor-websites-hibu-com.c.inregion.waas.oci.oraclecloud.net CNAME hibu34.inregion.waas.oci.oraclecloud.net CNAME hibu-4.zenedge.net CNAME live.websites.hibu.com	147.154.3.56
www.abart.pl	CNAME abart.pl A 89.161.163.246	89.161.163.246
indonesiamedia.com	A 74.208.215.145	74.208.215.145
smitko.net	A 31.15.12.103	31.15.12.103
www.2print.com	CNAME 2print.com A 107.180.98.101	107.180.98.101
vvsteknik.dk	A 185.31.76.90	185.31.76.90
www.owsports.ca
hyabmagneter.se	A 104.21.69.146 A 172.67.209.90	104.21.69.146
polprime.com	A 154.214.189.76	154.214.189.76
ramkome.com	A 62.75.216.107	62.75.216.107
mcseurope.nl	A 46.19.218.80	46.19.218.80
adventist.ro	A 104.21.48.92 A 172.67.183.62	104.21.48.92
www.myropcb.com	A 74.208.215.199	74.208.215.199
www.evcpa.com	A 192.124.249.10 CNAME evcpa.com	192.124.249.10
www.x0c.com	A 185.53.177.50	185.53.177.50
wahw.com.au	A 54.194.190.151	54.194.190.151
www.wnsavoy.com	A 96.91.204.114	96.91.204.114
bidroll.com	A 13.56.33.8	13.56.33.8
captlfix.com	A 198.185.159.144 A 198.49.23.145 A 198.49.23.144 A 198.185.159.145	198.185.159.144
gphpedit.org	A 127.0.0.1	127.0.0.1
ldh.la.gov	A 75.2.95.235	75.2.95.235
www.reglera.com	A 64.125.133.18 CNAME reglera.com	64.125.133.18
www.petsfan.com	CNAME traff-4.hugedomains.com A 52.86.6.113 A 3.94.41.167 CNAME hdr-nlb8-39c51fa8696874ee.elb.us-east-1.amazonaws.com	18.119.154.66
karmy.com.pl	A 185.253.212.22	185.253.212.22
dataform.co.uk	A 83.223.113.46	83.223.113.46
zupraha.cz	A 77.78.104.3	77.78.104.3
nettlinx.org	A 202.53.77.146	202.53.77.146
aluminox.es	A 37.59.243.164	37.59.243.164
www.depalo.com	A 172.217.31.19 CNAME ghs.googlehosted.com	142.250.206.243
mondopp.net	A 173.231.184.124	173.231.184.124
alt4.gmail-smtp-in.l.google.com	A 142.250.152.26	142.250.152.26
106west.com	A 148.130.4.196	148.130.4.196
toundo.net
paraski.org	A 94.130.164.242	94.130.164.242
xsui.com	A 127.0.0.1	127.0.0.1

IP Address	Status	Action
103.224.182.241	Active	Moloch
103.224.212.222	Active	Moloch
103.3.1.161	Active	Moloch
103.4.16.43	Active	Moloch
104.164.117.233	Active	Moloch
104.196.26.65	Active	Moloch
104.20.122.68	Active	Moloch
104.21.2.101	Active	Moloch
104.21.234.120	Active	Moloch
104.21.235.31	Active	Moloch
104.21.25.200	Active	Moloch
104.21.26.154	Active	Moloch
104.21.27.205	Active	Moloch
104.21.29.72	Active	Moloch
104.21.30.14	Active	Moloch
104.21.32.240	Active	Moloch
104.21.42.10	Active	Moloch
104.21.55.224	Active	Moloch
104.21.6.168	Active	Moloch
104.21.62.182	Active	Moloch
104.21.63.28	Active	Moloch
104.21.65.224	Active	Moloch
104.21.68.7	Active	Moloch
104.21.69.146	Active	Moloch
104.21.74.141	Active	Moloch
104.21.76.140	Active	Moloch
104.21.76.38	Active	Moloch
104.21.79.166	Active	Moloch
104.21.8.75	Active	Moloch
104.21.88.198	Active	Moloch
104.21.92.170	Active	Moloch
104.218.10.254	Active	Moloch
104.26.0.82	Active	Moloch
104.26.2.124	Active	Moloch
104.26.2.14	Active	Moloch
104.26.3.14	Active	Moloch
104.26.6.17	Active	Moloch
104.26.7.221	Active	Moloch
107.165.223.27	Active	Moloch
107.180.58.31	Active	Moloch
107.180.98.101	Active	Moloch
108.167.164.216	Active	Moloch
108.59.12.98	Active	Moloch
109.71.54.22	Active	Moloch
118.27.125.181	Active	Moloch
122.128.109.107	Active	Moloch
128.204.134.138	Active	Moloch
13.248.216.40	Active	Moloch
13.56.33.8	Active	Moloch
133.125.38.187	Active	Moloch
133.242.15.119	Active	Moloch
135.125.108.170	Active	Moloch
135.181.73.98	Active	Moloch
136.243.147.81	Active	Moloch
137.118.26.67	Active	Moloch
138.201.65.187	Active	Moloch
141.193.213.20	Active	Moloch
142.250.152.26	Active	Moloch
147.154.0.23	Active	Moloch
148.130.4.196	Active	Moloch
148.72.176.26	Active	Moloch
15.204.18.132	Active	Moloch
151.101.130.159	Active	Moloch
153.120.34.73	Active	Moloch
153.122.170.15	Active	Moloch
153.122.24.177	Active	Moloch
153.126.211.112	Active	Moloch
154.203.14.100	Active	Moloch
154.214.189.76	Active	Moloch
154.81.136.239	Active	Moloch
157.112.176.4	Active	Moloch
157.112.182.239	Active	Moloch
157.112.187.75	Active	Moloch
157.7.107.38	Active	Moloch
157.7.107.49	Active	Moloch
157.7.107.88	Active	Moloch
157.7.231.224	Active	Moloch
159.89.244.183	Active	Moloch
162.241.233.114	Active	Moloch
164.124.101.2	Active	Moloch
165.160.13.20	Active	Moloch
165.227.252.190	Active	Moloch
170.82.173.30	Active	Moloch
172.217.31.19	Active	Moloch
172.64.147.213	Active	Moloch
172.67.128.139	Active	Moloch
172.67.129.18	Active	Moloch
172.67.135.11	Active	Moloch
172.67.137.15	Active	Moloch
172.67.138.3	Active	Moloch
172.67.148.147	Active	Moloch
172.67.150.80	Active	Moloch
172.67.152.88	Active	Moloch
172.67.156.49	Active	Moloch
172.67.160.168	Active	Moloch
172.67.163.101	Active	Moloch
172.67.164.178	Active	Moloch
172.67.165.62	Active	Moloch
172.67.167.96	Active	Moloch
172.67.168.72	Active	Moloch
172.67.181.113	Active	Moloch
172.67.183.62	Active	Moloch
172.67.184.30	Active	Moloch
172.67.185.152	Active	Moloch
172.67.186.153	Active	Moloch
172.67.189.227	Active	Moloch
172.67.189.68	Active	Moloch
172.67.197.24	Active	Moloch
172.67.199.57	Active	Moloch
172.67.201.26	Active	Moloch
172.67.206.199	Active	Moloch
172.67.208.67	Active	Moloch
172.67.209.11	Active	Moloch
172.67.33.95	Active	Moloch
172.67.70.22	Active	Moloch
172.67.70.223	Active	Moloch
172.67.72.150	Active	Moloch
173.205.126.33	Active	Moloch
173.231.184.124	Active	Moloch
173.254.28.29	Active	Moloch
174.129.25.170	Active	Moloch
178.249.70.75	Active	Moloch
18.119.154.66	Active	Moloch
18.177.67.59	Active	Moloch
18.197.121.220	Active	Moloch
18.64.8.103	Active	Moloch
18.64.8.59	Active	Moloch
183.181.82.14	Active	Moloch
183.90.232.24	Active	Moloch
185.104.28.238	Active	Moloch
185.106.129.180	Active	Moloch
185.129.138.60	Active	Moloch
185.15.129.58	Active	Moloch
185.151.30.147	Active	Moloch
185.163.45.187	Active	Moloch
185.178.208.141	Active	Moloch
185.22.232.175	Active	Moloch
185.230.63.186	Active	Moloch
185.237.66.112	Active	Moloch
185.244.106.2	Active	Moloch
185.253.212.22	Active	Moloch
185.31.76.90	Active	Moloch
185.42.105.162	Active	Moloch
185.53.177.50	Active	Moloch
185.80.51.179	Active	Moloch
188.165.133.163	Active	Moloch
188.166.152.188	Active	Moloch
188.94.254.88	Active	Moloch
192.124.249.10	Active	Moloch
192.124.249.12	Active	Moloch
192.124.249.14	Active	Moloch
192.124.249.15	Active	Moloch
192.124.249.20	Active	Moloch
192.124.249.3	Active	Moloch
192.228.79.201	Active	Moloch
192.241.158.94	Active	Moloch
192.252.154.18	Active	Moloch
192.252.159.165	Active	Moloch
192.33.4.12	Active	Moloch
192.36.148.17	Active	Moloch
192.5.5.241	Active	Moloch
192.58.128.30	Active	Moloch
192.64.150.164	Active	Moloch
192.99.226.184	Active	Moloch
193.0.14.129	Active	Moloch
193.166.255.171	Active	Moloch
193.70.68.254	Active	Moloch
194.143.194.23	Active	Moloch
195.128.140.29	Active	Moloch
195.78.66.50	Active	Moloch
195.96.252.188	Active	Moloch
198.1.81.28	Active	Moloch
198.100.146.220	Active	Moloch
198.185.159.144	Active	Moloch
198.185.159.145	Active	Moloch
198.199.101.195	Active	Moloch
198.209.253.30	Active	Moloch
198.49.23.145	Active	Moloch
198.54.117.242	Active	Moloch
199.15.163.128	Active	Moloch
199.15.163.148	Active	Moloch
199.34.228.78	Active	Moloch
199.59.243.220	Active	Moloch
199.59.243.222	Active	Moloch
202.12.27.33	Active	Moloch
202.172.28.187	Active	Moloch
202.172.28.89	Active	Moloch
202.254.236.40	Active	Moloch
202.53.77.146	Active	Moloch
202.94.166.30	Active	Moloch
203.137.75.45	Active	Moloch
203.210.102.34	Active	Moloch
204.11.56.48	Active	Moloch
204.15.134.44	Active	Moloch
205.149.134.32	Active	Moloch
205.178.189.131	Active	Moloch
206.191.152.37	Active	Moloch
207.180.198.201	Active	Moloch
208.100.26.245	Active	Moloch
208.109.214.162	Active	Moloch
208.80.123.104	Active	Moloch
208.97.178.138	Active	Moloch
210.140.73.39	Active	Moloch
211.1.226.67	Active	Moloch
211.13.196.162	Active	Moloch
211.13.204.3	Active	Moloch
212.44.102.57	Active	Moloch
213.142.131.159	Active	Moloch
213.175.217.57	Active	Moloch
213.186.33.16	Active	Moloch
213.186.33.17	Active	Moloch
213.186.33.40	Active	Moloch
216.177.137.32	Active	Moloch
216.239.32.21	Active	Moloch
216.239.34.21	Active	Moloch
217.160.0.131	Active	Moloch
217.160.0.179	Active	Moloch
217.19.237.54	Active	Moloch
217.19.254.22	Active	Moloch
217.79.248.38	Active	Moloch
219.94.128.216	Active	Moloch
219.94.128.87	Active	Moloch
219.94.129.97	Active	Moloch
221.132.33.88	Active	Moloch
23.185.0.4	Active	Moloch
23.225.40.19	Active	Moloch
23.227.38.32	Active	Moloch
23.227.38.74	Active	Moloch
23.236.62.147	Active	Moloch
23.239.201.14	Active	Moloch
23.61.75.162	Active	Moloch
27.0.174.59	Active	Moloch
3.130.204.160	Active	Moloch
3.130.253.23	Active	Moloch
3.33.152.147	Active	Moloch
3.64.163.50	Active	Moloch
3.65.101.129	Active	Moloch
31.15.12.103	Active	Moloch
31.177.76.70	Active	Moloch
31.177.80.70	Active	Moloch
34.102.136.180	Active	Moloch
34.193.204.92	Active	Moloch
34.205.242.146	Active	Moloch
34.237.200.184	Active	Moloch
35.154.163.204	Active	Moloch
35.172.94.1	Active	Moloch
35.186.238.101	Active	Moloch
35.214.171.193	Active	Moloch
35.231.13.148	Active	Moloch
37.59.243.164	Active	Moloch
38.111.255.201	Active	Moloch
39.99.233.155	Active	Moloch
43.246.117.171	Active	Moloch
45.142.176.225	Active	Moloch
46.19.218.80	Active	Moloch
46.242.238.60	Active	Moloch
46.30.60.158	Active	Moloch
47.91.167.60	Active	Moloch
49.212.180.178	Active	Moloch
49.212.232.113	Active	Moloch
49.212.235.175	Active	Moloch
49.212.243.77	Active	Moloch
5.134.13.210	Active	Moloch
5.134.4.115	Active	Moloch
5.189.171.125	Active	Moloch
5.196.166.214	Active	Moloch
5.39.75.157	Active	Moloch
51.159.3.117	Active	Moloch
51.79.51.72	Active	Moloch
51.89.6.56	Active	Moloch
52.11.37.152	Active	Moloch
52.19.230.145	Active	Moloch
52.200.51.73	Active	Moloch
52.211.245.146	Active	Moloch
52.219.88.115	Active	Moloch
52.50.65.32	Active	Moloch
52.71.57.184	Active	Moloch
52.86.6.113	Active	Moloch
54.161.222.85	Active	Moloch
54.194.190.151	Active	Moloch
54.250.32.94	Active	Moloch
54.39.198.18	Active	Moloch
59.106.13.181	Active	Moloch
59.106.19.204	Active	Moloch
60.43.154.138	Active	Moloch
61.200.81.23	Active	Moloch
62.122.190.121	Active	Moloch
62.75.216.107	Active	Moloch
62.75.216.137	Active	Moloch
62.75.251.116	Active	Moloch
63.251.106.25	Active	Moloch
64.125.133.18	Active	Moloch
64.18.191.61	Active	Moloch
64.233.188.27	Active	Moloch
65.52.128.33	Active	Moloch
66.111.4.71	Active	Moloch
66.218.88.163	Active	Moloch
66.226.70.66	Active	Moloch
66.94.119.160	Active	Moloch
67.21.93.229	Active	Moloch
68.71.135.170	Active	Moloch
69.163.218.51	Active	Moloch
69.163.239.62	Active	Moloch
69.195.90.46	Active	Moloch
69.89.107.122	Active	Moloch
70.39.251.249	Active	Moloch
72.44.93.236	Active	Moloch
74.208.215.145	Active	Moloch
74.208.215.199	Active	Moloch
75.2.70.75	Active	Moloch
75.2.95.235	Active	Moloch
76.223.35.103	Active	Moloch
76.74.184.61	Active	Moloch
77.68.50.105	Active	Moloch
77.72.4.226	Active	Moloch
77.78.104.3	Active	Moloch
78.46.224.133	Active	Moloch
79.124.76.247	Active	Moloch
79.96.32.254	Active	Moloch
80.74.154.6	Active	Moloch
80.82.115.227	Active	Moloch
80.93.82.33	Active	Moloch
81.169.145.175	Active	Moloch
81.2.194.241	Active	Moloch
82.201.61.230	Active	Moloch
82.208.6.9	Active	Moloch
83.167.255.150	Active	Moloch
83.223.113.46	Active	Moloch
85.128.196.22	Active	Moloch
85.128.55.51	Active	Moloch
85.233.160.148	Active	Moloch
87.98.236.253	Active	Moloch
88.86.118.82	Active	Moloch
89.107.169.125	Active	Moloch
89.161.163.246	Active	Moloch
89.221.250.3	Active	Moloch
89.31.143.1	Active	Moloch
91.201.52.102	Active	Moloch
91.216.241.100	Active	Moloch
91.220.211.163	Active	Moloch
91.229.22.126	Active	Moloch
92.42.191.38	Active	Moloch
93.187.206.66	Active	Moloch
93.189.66.202	Active	Moloch
94.100.180.31	Active	Moloch
94.130.164.242	Active	Moloch
95.174.22.233	Active	Moloch
96.127.180.42	Active	Moloch
96.16.99.73	Active	Moloch
96.91.204.114	Active	Moloch
97.74.42.79	Active	Moloch
99.83.154.118	Active	Moloch
99.83.190.102	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49162 -> 118.27.125.181:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 192.124.249.20:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 199.15.163.128:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 52.86.6.113:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49166 -> 3.130.204.160:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49172 -> 3.130.204.160:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49164 -> 59.106.19.204:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 62.122.190.121:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 104.26.7.221:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49163 -> 172.67.208.67:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49175 -> 172.217.31.19:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 62.122.190.121:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 104.21.42.10:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 70.39.251.249:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49184 -> 104.21.25.200:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 52.86.6.113:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49187 -> 172.67.165.62:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49197 -> 165.227.252.190:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49184 -> 104.21.25.200:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49194 -> 80.74.154.6:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 192.252.154.18:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49204 -> 82.201.61.230:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49169 -> 192.124.249.20:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49194 -> 80.74.154.6:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49191 -> 206.191.152.37:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49204 -> 82.201.61.230:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49205 -> 46.242.238.60:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49207 -> 18.119.154.66:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49193 -> 89.161.163.246:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49211 -> 51.79.51.72:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49210 -> 107.180.98.101:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49195 -> 185.80.51.179:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 80.93.82.33:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49167 -> 104.21.88.198:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49216 -> 54.161.222.85:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49214 -> 62.75.216.137:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49195 -> 185.80.51.179:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49215 -> 217.19.237.54:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 172.67.70.22:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49218 -> 54.161.222.85:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 206.191.152.37:80 -> 192.168.56.103:49191	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	A Network Trojan was detected
TCP 192.168.56.103:49188 -> 172.67.152.88:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49219 -> 96.127.180.42:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49198 -> 135.181.73.98:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49221 -> 188.166.152.188:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49198 -> 135.181.73.98:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49190 -> 195.78.66.50:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49219 -> 96.127.180.42:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49224 -> 208.97.178.138:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49202 -> 39.99.233.155:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49208 -> 18.119.154.66:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49209 -> 210.140.73.39:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49229 -> 172.67.184.30:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49217 -> 13.248.216.40:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49234 -> 147.154.0.23:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49257 -> 104.196.26.65:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49212 -> 185.53.177.50:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49217 -> 13.248.216.40:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49245 -> 192.124.249.10:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49165 -> 70.39.251.249:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49257 -> 104.196.26.65:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49245 -> 192.124.249.10:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49222 -> 18.64.8.103:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 172.67.70.22:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49258 -> 154.203.14.100:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49222 -> 18.64.8.103:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49168 -> 80.93.82.33:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49230 -> 69.163.218.51:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49246 -> 213.186.33.17:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49225 -> 23.227.38.74:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49230 -> 69.163.218.51:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49203 -> 213.186.33.40:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49233 -> 172.67.150.80:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49231 -> 103.3.1.161:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49203 -> 213.186.33.40:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49233 -> 172.67.150.80:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49228 -> 5.196.166.214:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49263 -> 35.154.163.204:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49239 -> 93.187.206.66:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49243 -> 211.1.226.67:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49231 -> 103.3.1.161:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 199.15.163.148:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49232 -> 69.163.218.51:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49243 -> 211.1.226.67:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49273 -> 219.94.129.97:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49189 -> 66.94.119.160:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49254 -> 69.163.239.62:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49235 -> 74.208.215.199:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49276 -> 172.67.72.150:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49254 -> 69.163.239.62:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49294 -> 172.67.156.49:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49287 -> 172.67.160.168:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49256 -> 104.21.63.28:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49189 -> 66.94.119.160:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49268 -> 75.2.70.75:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49192 -> 170.82.173.30:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49242 -> 18.64.8.59:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49264 -> 172.67.33.95:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49242 -> 18.64.8.59:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49196 -> 122.128.109.107:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49284 -> 192.64.150.164:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49244 -> 172.67.70.223:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49192 -> 170.82.173.30:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49291 -> 3.33.152.147:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49293 -> 108.59.12.98:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49318 -> 172.67.164.178:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49340 -> 185.253.212.22:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49201 -> 60.43.154.138:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49355 -> 75.2.95.235:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49200 -> 202.254.236.40:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
UDP 192.168.56.103:57934 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
TCP 192.168.56.103:49252 -> 77.68.50.105:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49319 -> 108.59.12.98:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49252 -> 77.68.50.105:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49290 -> 95.174.22.233:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49201 -> 60.43.154.138:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49253 -> 104.21.55.224:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49200 -> 202.254.236.40:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49305 -> 193.70.68.254:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49332 -> 104.21.76.38:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49261 -> 3.65.101.129:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49249 -> 192.241.158.94:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49334 -> 208.80.123.104:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49349 -> 157.7.231.224:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49249 -> 192.241.158.94:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49251 -> 108.167.164.216:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49343 -> 199.59.243.220:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49381 -> 34.102.136.180:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49251 -> 108.167.164.216:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49382 -> 107.180.58.31:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49277 -> 49.212.232.113:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49347 -> 174.129.25.170:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49386 -> 34.205.242.146:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49360 -> 185.151.30.147:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49261 -> 3.65.101.129:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49282 -> 103.224.182.241:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49411 -> 107.180.58.31:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49353 -> 91.201.52.102:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49393 -> 136.243.147.81:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49199 -> 193.70.68.254:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49306 -> 23.239.201.14:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49363 -> 157.112.187.75:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49289 -> 78.46.224.133:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49426 -> 172.67.33.95:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49288 -> 165.160.13.20:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49414 -> 79.96.32.254:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49438 -> 35.214.171.193:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49261 -> 3.65.101.129:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49280 -> 52.11.37.152:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49455 -> 104.21.74.141:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49330 -> 52.11.37.152:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49339 -> 217.19.254.22:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49206 -> 104.26.2.124:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49345 -> 192.99.226.184:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49261 -> 3.65.101.129:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49372 -> 49.212.235.175:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49471 -> 5.189.171.125:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49395 -> 49.212.235.175:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 138.201.65.187:443 -> 192.168.56.103:49483	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49367 -> 54.250.32.94:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49341 -> 104.21.62.182:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49364 -> 107.180.58.31:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49377 -> 138.201.65.187:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49497 -> 104.21.76.140:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49497 -> 104.21.76.140:80	2032987	ET INFO HTTP Request to a *.tw domain	Potentially Bad Traffic
TCP 192.168.56.103:49387 -> 49.212.235.175:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49494 -> 35.214.171.193:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49495 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49396 -> 104.21.65.224:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49491 -> 165.160.13.20:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49390 -> 185.178.208.141:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49357 -> 172.67.199.57:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49261 -> 3.65.101.129:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49516 -> 192.124.249.3:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49416 -> 172.67.72.150:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49206 -> 104.26.2.124:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49399 -> 208.100.26.245:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49421 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49406 -> 138.201.65.187:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49524 -> 5.134.13.210:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49392 -> 135.125.108.170:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49213 -> 81.2.194.241:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49433 -> 185.244.106.2:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49431 -> 104.21.69.146:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49404 -> 217.79.248.38:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49427 -> 75.2.95.235:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49393 -> 136.243.147.81:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49419 -> 35.214.171.193:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49213 -> 81.2.194.241:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49435 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49558 -> 192.124.249.14:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49445 -> 157.7.107.49:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49371 -> 75.2.95.235:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49220 -> 172.67.201.26:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 35.214.171.193:443 -> 192.168.56.103:49556	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49559 -> 104.26.2.14:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49442 -> 5.189.171.125:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49359 -> 185.129.138.60:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49439 -> 97.74.42.79:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49337 -> 91.229.22.126:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49436 -> 18.197.121.220:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49553 -> 31.15.12.103:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49376 -> 83.223.113.46:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49454 -> 104.21.30.14:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49321 -> 203.210.102.34:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49409 -> 49.212.235.175:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49457 -> 104.21.27.205:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49441 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49451 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49358 -> 198.185.159.144:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49590 -> 213.186.33.16:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49412 -> 75.2.95.235:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49449 -> 91.216.241.100:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49475 -> 104.21.69.146:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49604 -> 172.67.167.96:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 185.237.66.112:443 -> 192.168.56.103:49466	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49474 -> 178.249.70.75:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49609 -> 198.185.159.144:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49465 -> 52.19.230.145:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49450 -> 138.201.65.187:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49611 -> 153.126.211.112:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49439 -> 97.74.42.79:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49227 -> 208.109.214.162:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49480 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49467 -> 104.21.8.75:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49227 -> 208.109.214.162:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49501 -> 138.201.65.187:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49472 -> 151.101.130.159:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49477 -> 104.164.117.233:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49617 -> 91.216.241.100:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49454 -> 104.21.30.14:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49248 -> 188.165.133.163:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49504 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49552 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49248 -> 188.165.133.163:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 185.237.66.112:443 -> 192.168.56.103:49555	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49490 -> 104.21.92.170:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49255 -> 72.44.93.236:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49683 -> 27.0.174.59:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49682 -> 46.30.60.158:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49276 -> 172.67.72.150:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
UDP 192.168.56.103:51071 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
TCP 192.168.56.103:49270 -> 35.172.94.1:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49705 -> 52.71.57.184:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49597 -> 54.39.198.18:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 138.201.65.187:443 -> 192.168.56.103:49522	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49297 -> 104.21.29.72:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49525 -> 23.225.40.19:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49537 -> 157.7.107.38:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49356 -> 23.236.62.147:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49527 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49720 -> 157.112.176.4:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49543 -> 157.112.187.75:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49348 -> 63.251.106.25:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49545 -> 211.13.204.3:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49726 -> 173.254.28.29:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49538 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49620 -> 192.124.249.12:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49547 -> 75.2.70.75:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 63.251.106.25:80 -> 192.168.56.103:49348	2018141	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz	A Network Trojan was detected
TCP 63.251.106.25:80 -> 192.168.56.103:49348	2037771	ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst	A Network Trojan was detected
TCP 192.168.56.103:49331 -> 172.67.183.62:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49525 -> 23.225.40.19:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49754 -> 202.172.28.89:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49316 -> 76.74.184.61:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49645 -> 47.91.167.60:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49338 -> 38.111.255.201:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49585 -> 172.67.197.24:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49580 -> 52.50.65.32:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49423 -> 83.223.113.46:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49346 -> 198.199.101.195:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49304 -> 5.39.75.157:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49687 -> 141.193.213.20:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 138.201.65.187:443 -> 192.168.56.103:49429	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49776 -> 202.172.28.89:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49701 -> 107.180.58.31:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49629 -> 52.19.230.145:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49430 -> 216.177.137.32:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49375 -> 49.212.235.175:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49448 -> 75.2.95.235:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49627 -> 67.21.93.229:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49331 -> 172.67.183.62:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49432 -> 93.189.66.202:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49735 -> 194.143.194.23:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49639 -> 219.94.128.87:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49452 -> 157.7.107.88:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49563 -> 107.165.223.27:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49759 -> 198.185.159.144:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 185.237.66.112:443 -> 192.168.56.103:49564	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49461 -> 104.21.29.72:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49415 -> 49.212.235.175:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49665 -> 35.154.163.204:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49572 -> 203.210.102.34:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49789 -> 52.71.57.184:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49805 -> 157.7.107.88:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 35.214.171.193:443 -> 192.168.56.103:49453	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49605 -> 172.67.183.62:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49304 -> 5.39.75.157:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49460 -> 35.186.238.101:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49446 -> 172.67.128.139:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49734 -> 157.112.182.239:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49463 -> 89.31.143.1:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49605 -> 172.67.183.62:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49744 -> 94.130.164.242:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49832 -> 99.83.190.102:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49444 -> 5.134.4.115:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49462 -> 138.201.65.187:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49459 -> 75.2.95.235:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49649 -> 49.212.180.178:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49824 -> 157.7.107.38:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 185.237.66.112:443 -> 192.168.56.103:49456	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49753 -> 172.67.189.68:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49835 -> 93.187.206.66:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49662 -> 104.21.76.38:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49847 -> 107.180.58.31:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49864 -> 35.154.163.204:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49655 -> 67.21.93.229:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49473 -> 49.212.243.77:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49852 -> 107.180.58.31:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49478 -> 35.214.171.193:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49670 -> 133.242.15.119:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49609 -> 198.185.159.144:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49488 -> 46.19.218.80:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49291 -> 3.33.152.147:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 185.237.66.112:443 -> 192.168.56.103:49517	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49770 -> 51.159.3.117:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49492 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49510 -> 67.21.93.229:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49512 -> 45.142.176.225:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49499 -> 80.82.115.227:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 185.237.66.112:443 -> 192.168.56.103:49507	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49686 -> 172.67.167.96:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 35.214.171.193:443 -> 192.168.56.103:49506	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.103:49511 -> 138.201.65.187:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49528 -> 35.214.171.193:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49541 -> 185.237.66.112:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49368 -> 154.214.189.76:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49542 -> 35.214.171.193:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.103:49540 -> 148.72.176.26:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49380 -> 199.34.228.78:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49550 -> 103.224.212.222:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49702 -> 104.218.10.254:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49549 -> 52.219.88.115:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49277 -> 49.212.232.113:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49950 -> 185.31.76.90:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
ICMP 192.168.56.103:None -> 164.124.101.2:None	2200076	SURICATA ICMPv4 invalid checksum	Generic Protocol Command Decode
TCP 192.168.56.103:49958 -> 54.250.32.94:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49707 -> 107.180.58.31:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49795 -> 172.67.181.113:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50058 -> 213.175.217.57:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49574 -> 91.220.211.163:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49977 -> 195.96.252.188:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49583 -> 202.172.28.187:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49581 -> 104.21.26.154:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49594 -> 104.21.30.14:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50095 -> 83.167.255.150:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49591 -> 159.89.244.183:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50019 -> 49.212.232.113:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49601 -> 87.98.236.253:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49836 -> 34.193.204.92:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50107 -> 133.125.38.187:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49615 -> 69.195.90.46:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49846 -> 172.67.163.101:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49381 -> 34.102.136.180:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50121 -> 92.42.191.38:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49607 -> 198.49.23.145:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50049 -> 91.216.241.100:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49724 -> 195.128.140.29:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50126 -> 216.239.34.21:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49884 -> 185.129.138.60:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50127 -> 59.106.13.181:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49675 -> 199.59.243.222:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50069 -> 174.129.25.170:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49525 -> 23.225.40.19:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49635 -> 63.251.106.25:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49756 -> 135.125.108.170:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50134 -> 76.74.184.61:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49636 -> 198.185.159.144:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50133 -> 89.107.169.125:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49766 -> 136.243.147.81:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50057 -> 153.122.170.15:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49952 -> 202.53.77.146:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49793 -> 185.230.63.186:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50152 -> 35.186.238.101:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49809 -> 185.31.76.90:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49687 -> 141.193.213.20:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50004 -> 133.242.15.119:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50158 -> 104.21.68.7:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49839 -> 107.180.58.31:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50015 -> 185.129.138.60:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49576 -> 104.21.6.168:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49651 -> 104.21.234.120:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49714 -> 172.67.189.68:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49940 -> 199.34.228.78:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50092 -> 203.210.102.34:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50040 -> 23.225.40.19:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50175 -> 157.112.187.75:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49875 -> 87.98.236.253:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49659 -> 162.241.233.114:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49721 -> 95.174.22.233:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49902 -> 192.252.159.165:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50077 -> 213.142.131.159:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50081 -> 35.231.13.148:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49660 -> 89.221.250.3:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49730 -> 185.151.30.147:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50239 -> 213.142.131.159:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50205 -> 77.78.104.3:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49674 -> 63.251.106.25:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50096 -> 173.205.126.33:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49966 -> 178.249.70.75:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50098 -> 69.195.90.46:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50288 -> 97.74.42.79:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
UDP 192.168.56.103:58381 -> 8.8.8.8:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
TCP 192.168.56.103:50104 -> 202.94.166.30:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50113 -> 52.71.57.184:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50112 -> 195.96.252.188:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50123 -> 202.94.166.30:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49994 -> 153.122.24.177:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50118 -> 35.172.94.1:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49685 -> 104.20.122.68:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50007 -> 23.239.201.14:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50029 -> 104.21.6.168:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49692 -> 34.237.200.184:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50026 -> 172.67.209.11:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50149 -> 172.67.128.139:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49695 -> 107.180.58.31:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50159 -> 18.177.67.59:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50044 -> 91.201.52.102:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49280 -> 52.11.37.152:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49935 -> 154.214.189.76:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49927 -> 35.186.238.101:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50046 -> 151.101.130.159:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50135 -> 78.46.224.133:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49563 -> 107.165.223.27:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50040 -> 23.225.40.19:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50149 -> 172.67.128.139:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50078 -> 173.205.126.33:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49973 -> 213.142.131.159:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50146 -> 185.106.129.180:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50150 -> 89.31.143.1:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49983 -> 109.71.54.22:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50106 -> 174.129.25.170:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49571 -> 77.78.104.3:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49356 -> 23.236.62.147:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50114 -> 219.94.128.216:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49983 -> 109.71.54.22:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49308 -> 153.122.170.15:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49804 -> 208.80.123.104:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50035 -> 52.71.57.184:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50124 -> 219.94.129.97:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50037 -> 135.125.108.170:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50257 -> 87.98.236.253:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50211 -> 52.50.65.32:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50143 -> 103.4.16.43:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49863 -> 107.165.223.27:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50217 -> 185.31.76.90:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50090 -> 185.104.28.238:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50007 -> 23.239.201.14:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50234 -> 85.128.55.51:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49430 -> 216.177.137.32:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50101 -> 185.244.106.2:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50161 -> 199.59.243.220:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50235 -> 93.187.206.66:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50273 -> 94.130.164.242:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50169 -> 183.181.82.14:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50120 -> 172.67.72.150:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50280 -> 91.220.211.163:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50119 -> 213.175.217.57:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50193 -> 185.104.28.238:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49923 -> 104.21.8.75:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
UDP 192.168.56.103:50044 -> 164.124.101.2:53	2027863	ET INFO Observed DNS Query to .biz TLD	Potentially Bad Traffic
TCP 192.168.56.103:50203 -> 81.169.145.175:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50290 -> 198.185.159.144:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49941 -> 13.56.33.8:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50225 -> 198.199.101.195:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50141 -> 216.177.137.32:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50223 -> 195.128.140.29:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50155 -> 49.212.180.178:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50231 -> 198.49.23.145:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50002 -> 157.112.187.75:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50156 -> 216.177.137.32:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50028 -> 35.154.163.204:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50240 -> 91.201.52.102:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49802 -> 153.122.170.15:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50055 -> 172.67.33.95:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50254 -> 172.67.185.152:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50258 -> 3.64.163.50:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50223 -> 195.128.140.29:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49499 -> 80.82.115.227:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50263 -> 64.18.191.61:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50277 -> 219.94.128.87:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50275 -> 52.19.230.145:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50116 -> 104.21.68.7:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50284 -> 104.21.79.166:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50116 -> 104.21.68.7:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49887 -> 154.214.189.76:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50145 -> 104.21.2.101:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50151 -> 31.177.76.70:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49651 -> 104.21.234.120:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49277 -> 49.212.232.113:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49954 -> 43.246.117.171:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50176 -> 65.52.128.33:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50214 -> 23.239.201.14:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50216 -> 185.31.76.90:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50252 -> 83.167.255.150:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50267 -> 104.21.234.120:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50180 -> 199.34.228.78:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50171 -> 154.214.189.76:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:50147 -> 154.214.189.76:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 193.166.255.171:80	2016867	ET MALWARE Backdoor.Win32.Pushdo.s Checkin	Malware Command and Control Activity Detected

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49294 172.67.156.49:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	8e:eb:ad:d2:6e:53:39:1d:ea:e0:21:c4:22:9a:ee:d0:93:3d:62:6a
TLSv1 192.168.56.103:49287 172.67.160.168:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	39:60:5f:8a:b0:63:95:b4:7b:c1:8a:c0:a2:87:dc:a4:4d:b7:94:a6
TLSv1 192.168.56.103:49318 172.67.164.178:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1P5	CN=*.clinicasanluis.com.co	29:ac:43:1a:71:82:7f:ec:3f:09:c7:81:24:9c:1e:24:f4:10:94:b6
TLSv1 192.168.56.103:49471 5.189.171.125:443	None	None	None
TLSv1 192.168.56.103:49396 104.21.65.224:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	28:54:2c:72:71:1b:3f:88:07:e2:1d:7b:6c:1b:7f:45:bc:7e:fe:1c
TLSv1 192.168.56.103:49357 172.67.199.57:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	04:c9:15:e0:a1:18:74:04:16:cb:98:fd:73:56:cf:7d:99:35:cb:75
TLSv1 192.168.56.103:49431 104.21.69.146:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	0f:0a:0c:90:f8:6d:9f:92:6a:fc:87:76:90:56:46:b5:a5:4e:41:70
TLSv1 192.168.56.103:49442 5.189.171.125:443	C=US, O=Let's Encrypt, CN=R3	CN=muhr-soehne.com	53:27:b3:3c:95:07:9d:ec:95:5c:07:b2:f1:75:0e:ea:5b:36:10:83
TLSv1 192.168.56.103:49337 91.229.22.126:443	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=GeoTrust RSA CA 2018	C=PL, ST=Mazowieckie, L=Warszawa, O=Komenda Glowna Policji, CN=*.policja.gov.pl	3d:fe:e4:18:9c:81:af:dd:a8:f5:e3:51:55:cb:6e:5e:89:7f:65:e2
TLSv1 192.168.56.103:49376 83.223.113.46:443	C=US, O=Let's Encrypt, CN=R3	CN=magicomm.co.uk	c7:bb:94:3f:a7:23:97:e0:93:f5:69:24:eb:a6:85:25:92:3b:d3:e1
TLSv1 192.168.56.103:49475 104.21.69.146:443	C=US, O=Cloudflare, Inc., CN=Cloudflare Inc ECC CA-3	C=US, ST=California, L=San Francisco, O=Cloudflare, Inc., CN=sni.cloudflaressl.com	0f:0a:0c:90:f8:6d:9f:92:6a:fc:87:76:90:56:46:b5:a5:4e:41:70
TLSv1 192.168.56.103:49423 83.223.113.46:443	C=US, O=Let's Encrypt, CN=R3	CN=magicomm.co.uk	c7:bb:94:3f:a7:23:97:e0:93:f5:69:24:eb:a6:85:25:92:3b:d3:e1

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameW March 10, 2023, 4:17 p.m.	computer_name: TEST22-PC	1	1	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptGenKey March 10, 2023, 4:17 p.m.	crypto_handle: 0x01459e58 algorithm_identifier: 0x00006801 (CALG_RC4) flags: 8388609 key: hì_ï÷G=KÎp provider_handle: 0x01490e78	1	1
CryptExportKey March 10, 2023, 4:17 p.m.	buffer: hì_ï÷G=KÎp crypto_handle: 0x01459e58 flags: 0 crypto_export_handle: 0x00000000 blob_type: 8	1	1
CryptExportKey March 10, 2023, 4:17 p.m.	buffer: h¤Íõ%Q¨¡,ðBý¢³¢û"¹ß½j£Í¹ ûgíAB©ÿBK3å±,·×¢wèßòö¸%ÓJB]çÏ¡ßÃE«ÖÞHsÐ\ØÆÅ»ÃÞ^å.E4cFaùQÿ6¿©XVtX×Óø*¾{t¶ä_4c¿ì¨ò8 crypto_handle: 0x01459e58 flags: 0 crypto_export_handle: 0x01459e98 blob_type: 1	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 10, 2023, 4:17 p.m.		1	1	0

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

BWONAD

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (50 out of 280 events)

suspicious_features	POST method with no referer header	suspicious_request	POST http://www.pr-park.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.jenco.co.uk/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.baijaku.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.quadlock.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.pdqhomes.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.tvtools.fi/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.olras.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.dgmna.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.alteor.cl/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.valdal.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.depalo.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.elpro.si/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.credo.edu.pl/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.iamdirt.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.petsfan.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.abdg.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.wifi4all.nl/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.fcwcvt.org/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.synetik.net/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.snugpak.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.rs-ag.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.yocinc.org/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.photo4b.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.vazir.se/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.mqs.com.br/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.abart.pl/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.transsib.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.hummer.hu/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.vitaindu.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.crcsi.org/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.t-tre.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.valselit.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.naoi-a.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.ora.ecnet.jp/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.gpthink.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.ora-ito.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.nelipak.nl/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.waldi.pl/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.kernsafe.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.cokocoko.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.ex-olive.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.2print.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.holleman.us/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.x0c.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.edimart.hu/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.tyrns.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.speelhal.net/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.netcr.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.findbc.com/
suspicious_features	POST method with no referer header	suspicious_request	POST http://www.jacomfg.com/

Performs some HTTP requests (50 out of 293 events)

request	POST http://www.pr-park.com/
request	POST http://www.jenco.co.uk/
request	POST http://www.baijaku.com/
request	POST http://www.quadlock.com/
request	POST http://www.pdqhomes.com/
request	POST http://www.tvtools.fi/
request	POST http://www.olras.com/
request	POST http://www.dgmna.com/
request	POST http://www.alteor.cl/
request	POST http://www.valdal.com/
request	POST http://www.depalo.com/
request	POST http://www.elpro.si/
request	POST http://www.credo.edu.pl/
request	POST http://www.iamdirt.com/
request	POST http://www.petsfan.com/
request	POST http://www.abdg.com/
request	POST http://www.wifi4all.nl/
request	POST http://www.fcwcvt.org/
request	POST http://www.synetik.net/
request	POST http://www.snugpak.com/
request	POST http://www.rs-ag.com/
request	POST http://www.yocinc.org/
request	POST http://www.photo4b.com/
request	POST http://www.vazir.se/
request	POST http://www.mqs.com.br/
request	POST http://www.abart.pl/
request	POST http://www.transsib.com/
request	POST http://www.hummer.hu/
request	POST http://www.vitaindu.com/
request	POST http://www.crcsi.org/
request	POST http://www.t-tre.com/
request	POST http://www.valselit.com/
request	POST http://www.naoi-a.com/
request	POST http://www.ora.ecnet.jp/
request	POST http://www.gpthink.com/
request	POST http://www.ora-ito.com/
request	POST http://www.nelipak.nl/
request	POST http://www.waldi.pl/
request	POST http://www.kernsafe.com/
request	POST http://www.cokocoko.com/
request	POST http://www.ex-olive.com/
request	POST http://www.2print.com/
request	POST http://www.holleman.us/
request	POST http://www.x0c.com/
request	POST http://www.edimart.hu/
request	POST http://www.tyrns.com/
request	POST http://www.speelhal.net/
request	POST http://www.netcr.com/
request	POST http://www.findbc.com/
request	POST http://www.jacomfg.com/

Sends data using the HTTP POST Method (50 out of 280 events)

request	POST http://www.pr-park.com/
request	POST http://www.jenco.co.uk/
request	POST http://www.baijaku.com/
request	POST http://www.quadlock.com/
request	POST http://www.pdqhomes.com/
request	POST http://www.tvtools.fi/
request	POST http://www.olras.com/
request	POST http://www.dgmna.com/
request	POST http://www.alteor.cl/
request	POST http://www.valdal.com/
request	POST http://www.depalo.com/
request	POST http://www.elpro.si/
request	POST http://www.credo.edu.pl/
request	POST http://www.iamdirt.com/
request	POST http://www.petsfan.com/
request	POST http://www.abdg.com/
request	POST http://www.wifi4all.nl/
request	POST http://www.fcwcvt.org/
request	POST http://www.synetik.net/
request	POST http://www.snugpak.com/
request	POST http://www.rs-ag.com/
request	POST http://www.yocinc.org/
request	POST http://www.photo4b.com/
request	POST http://www.vazir.se/
request	POST http://www.mqs.com.br/
request	POST http://www.abart.pl/
request	POST http://www.transsib.com/
request	POST http://www.hummer.hu/
request	POST http://www.vitaindu.com/
request	POST http://www.crcsi.org/
request	POST http://www.t-tre.com/
request	POST http://www.valselit.com/
request	POST http://www.naoi-a.com/
request	POST http://www.ora.ecnet.jp/
request	POST http://www.gpthink.com/
request	POST http://www.ora-ito.com/
request	POST http://www.nelipak.nl/
request	POST http://www.waldi.pl/
request	POST http://www.kernsafe.com/
request	POST http://www.cokocoko.com/
request	POST http://www.ex-olive.com/
request	POST http://www.2print.com/
request	POST http://www.holleman.us/
request	POST http://www.x0c.com/
request	POST http://www.edimart.hu/
request	POST http://www.tyrns.com/
request	POST http://www.speelhal.net/
request	POST http://www.netcr.com/
request	POST http://www.findbc.com/
request	POST http://www.jacomfg.com/

Resolves a suspicious Top Level Domain (TLD) (11 events)

domain	bigzz.by	description	Belarus domain TLD
domain	sledsport.ru	description	Russian Federation domain TLD
domain	kursavto.ru	description	Russian Federation domain TLD
domain	mxs.mail.ru	description	Russian Federation domain TLD
domain	gydrozo.ru	description	Russian Federation domain TLD
domain	chzko.ru	description	Russian Federation domain TLD
domain	burstner.ru	description	Russian Federation domain TLD
domain	notis.ru	description	Russian Federation domain TLD
domain	shztm.ru	description	Russian Federation domain TLD
domain	skgm.ru	description	Russian Federation domain TLD
domain	ktenergo.ru	description	Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (5 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2636 region_size: 581632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04000000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2636 region_size: 12259328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02620000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2636 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002d0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2636 region_size: 22347776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02620000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

svchost.exe tried to sleep 1044 seconds, actually delayed analysis time by 1044 seconds

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\svchost.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (37 events)

Time & API	Arguments	Status	Return
Process32FirstW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: [System Process] process_identifier: 0	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: System process_identifier: 4	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: smss.exe process_identifier: 232	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: csrss.exe process_identifier: 308	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: wininit.exe process_identifier: 344	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: csrss.exe process_identifier: 356	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: services.exe process_identifier: 436	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: lsass.exe process_identifier: 452	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: lsm.exe process_identifier: 460	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 560	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 636	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 716	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 780	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 824	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 984	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 340	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: pw.exe process_identifier: 1888	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: pw.exe process_identifier: 288	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: taskhost.exe process_identifier: 912	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: SearchProtocolHost.exe process_identifier: 1476	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: SearchFilterHost.exe process_identifier: 940	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: 80.exe process_identifier: 840	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 2236	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: mscorsvw.exe process_identifier: 2264	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: mscorsvw.exe process_identifier: 2304	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: sppsvc.exe process_identifier: 2356	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 2636	1	1
Process32NextW March 10, 2023, 4:17 p.m.	snapshot_handle: 0x00000184 process_name: svchost.exe process_identifier: 2780	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 10, 2023, 4:17 p.m.	flags: 15 family: 0		111	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00015400', u'virtual_address': u'0x00009000', u'entropy': 7.846081304046595, u'name': u'.rsrc', u'virtual_size': u'0x00015374'}

entropy

7.84608130405

description

A section with a high entropy has been found

entropy

0.69387755102

description

Overall entropy of this PE file is high

Yara rule detected in process memory (50 out of 67 events)

description	Take ScreenShot	rule	ScreenShot
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Communication using DGA	rule	Network_DGA
description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Communications smtp	rule	network_smtp_raw
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Communications over HTTP	rule	Network_HTTP
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Take ScreenShot	rule	ScreenShot
description	Communications use DNS	rule	Network_DNS
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	Code injection with CreateRemoteThread in a remote process	rule	Code_injection
description	Communications over HTTP	rule	Network_HTTP
description	Escalate priviledges	rule	Escalate_priviledges
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: f1c455dca309311ded988f2efe2952551ae7d86f
buffer	Buffer with sha1: 97751a713ab1c071fe2a95e95ba6d2bd53539433

Connects to an IRC server, possibly part of a botnet

Makes SMTP requests, possibly sending spam (50 out of 54 events)

receiver

[]

sender

[]

server

66.226.70.66

receiver

[]

sender

[]

server

64.233.188.27

receiver

[]

sender

[]

server

203.137.75.45

receiver

[]

sender

[]

server

219.94.128.216

receiver

[]

sender

[]

server

94.100.180.31

receiver

[]

sender

[]

server

94.100.180.31

receiver

[]

sender

[]

server

162.241.233.114

receiver

[]

sender

[]

server

203.137.75.45

receiver

[]

sender

[]

server

94.100.180.31

receiver

[]

sender

[]

server

207.180.198.201

receiver

[]

sender

[]

server

103.4.16.43

receiver

[]

sender

[]

server

142.250.152.26

receiver

[]

sender

[]

server

142.250.152.26

receiver

[]

sender

[]

server

142.250.152.26

receiver

[]

sender

[]

server

64.233.188.27

receiver

[]

sender

[]

server

64.233.188.27

receiver

[]

sender

[]

server

66.111.4.71

receiver

[]

sender

[]

server

66.111.4.71

receiver

[]

sender

[]

server

64.233.188.27

receiver

[]

sender

[]

server

52.19.230.145

receiver

[]

sender

[]

server

66.111.4.71

receiver

[]

sender

[]

server

37.59.243.164

receiver

[]

sender

[]

server

153.120.34.73

receiver

[]

sender

[]

server

157.112.187.75

receiver

[]

sender

[]

server

203.210.102.34

receiver

[]

sender

[]

server

203.137.75.45

receiver

[]

sender

[]

server

194.143.194.23

receiver

[]

sender

[]

server

203.210.102.34

receiver

[]

sender

[]

server

49.212.243.77

receiver

[]

sender

[]

server

37.59.243.164

receiver

[]

sender

[]

server

185.22.232.175

receiver

[]

sender

[]

server

202.53.77.146

receiver

[]

sender

[]

server

185.163.45.187

receiver

[]

sender

[]

server

109.71.54.22

receiver

[]

sender

[]

server

195.96.252.188

receiver

[]

sender

[]

server

207.180.198.201

receiver

[]

sender

[]

server

23.239.201.14

receiver

[]

sender

[]

server

192.252.159.165

receiver

[]

sender

[]

server

183.90.232.24

receiver

[]

sender

[]

server

27.0.174.59

receiver

[]

sender

[]

server

78.46.224.133

receiver

[]

sender

[]

server

217.79.248.38

receiver

[]

sender

[]

server

178.249.70.75

receiver

[]

sender

[]

server

192.99.226.184

receiver

[]

sender

[]

server

77.72.4.226

receiver

[]

sender

[]

server

192.64.150.164

receiver

[]

sender

[]

server

212.44.102.57

receiver

[]

sender

[]

server

95.174.22.233

receiver

[]

sender

[]

server

219.94.128.87

receiver

[]

sender

[]

server

45.142.176.225

Communicates with host for which no DNS query was performed (3 events)

host	153.120.34.73
host	198.1.81.28
host	211.13.196.162

Allocates execute permission to another process indicative of possible code injection (3 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2780 region_size: 12259328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000016c	1
NtAllocateVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2780 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000016c	1
NtAllocateVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2848 region_size: 22347776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13140000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000017c	1

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory March 10, 2023, 4:17 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2780 process_handle: 0x0000016c	1	1	0

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.3e7a4148f1133cb4
CrowdStrike	win/malicious_confidence_90% (W)
ESET-NOD32	a variant of Generik.KTBAMMZ
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan.Win32.Cutwail.gen
McAfee-GW-Edition	Artemis
Trapmine	suspicious.low.ml.score
Sophos	ML/PE-A
Gridinsoft	Trojan.Win32.Emotet.ka!s13
ZoneAlarm	UDS:Trojan.Win32.Cutwail.gen
McAfee	Artemis!3E7A4148F113
Cylance	unsafe
Rising	Trojan.Generic@AI.79 (RDMK:cmRtazr/tF6OTwxoHhmKBQv6peV3)
BitDefenderTheta	Gen:NN.ZexaF.36308.j8Y@a4aHr!ki

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Network activity contains more than one unique useragent (2 events)

process	svchost.exe				useragent
process	svchost.exe				useragent	Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2636 called NtSetContextThread to modify thread in remote process 2780
NtSetContextThread March 10, 2023, 4:17 p.m.	registers.eip: 2005598660 registers.esp: 2422984 registers.edi: 0 registers.eax: 4217456 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000168 process_identifier: 2780	1	0	0

Expresses interest in specific running processes (1 event)

process: potential process injection target

svchost.exe

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2636 resumed a thread in remote process 2780
NtResumeThread March 10, 2023, 4:17 p.m.	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 2780	1	0	0

Generates some ICMP traffic

Executed a process and injected code into it, probably while unpacking (13 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW March 10, 2023, 4:17 p.m.	thread_identifier: 2784 thread_handle: 0x00000168 process_identifier: 2780 current_directory: filepath: track: 1 command_line: C:\Windows\system32\svchost.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000016c	1	1
NtAllocateVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2780 region_size: 12259328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000016c	1	0
WriteProcessMemory March 10, 2023, 4:17 p.m.	buffer: base_address: 0x00400000 process_identifier: 2780 process_handle: 0x0000016c	1	1
NtGetContextThread March 10, 2023, 4:17 p.m.	thread_handle: 0x00000168	1	0
WriteProcessMemory March 10, 2023, 4:17 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2780 process_handle: 0x0000016c	1	1
NtSetContextThread March 10, 2023, 4:17 p.m.	registers.eip: 2005598660 registers.esp: 2422984 registers.edi: 0 registers.eax: 4217456 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000168 process_identifier: 2780	1	0
NtResumeThread March 10, 2023, 4:17 p.m.	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 2780	1	0
NtAllocateVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2780 region_size: 28672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000016c	1	0
WriteProcessMemory March 10, 2023, 4:17 p.m.	buffer: base_address: 0x04000000 process_identifier: 2780 process_handle: 0x0000016c	1	1
CreateProcessInternalW March 10, 2023, 4:17 p.m.	thread_identifier: 2852 thread_handle: 0x00000178 process_identifier: 2848 current_directory: filepath: track: 1 command_line: C:\Windows\system32\svchost.exe filepath_r: stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000017c	1	1
NtAllocateVirtualMemory March 10, 2023, 4:17 p.m.	process_identifier: 2848 region_size: 22347776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13140000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000017c	1	0
NtResumeThread March 10, 2023, 4:17 p.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 2848	1	0
NtResumeThread March 10, 2023, 4:17 p.m.	thread_handle: 0x000001d0 suspend_count: 1 process_identifier: 1228	1	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (50 out of 108 events)

dead_host	192.168.56.103:49981
dead_host	157.7.107.49:25
dead_host	137.118.26.67:80
dead_host	172.67.148.147:25
dead_host	76.223.35.103:25
dead_host	198.209.253.30:80
dead_host	157.7.231.224:25
dead_host	23.227.38.32:25
dead_host	63.251.106.25:25
dead_host	172.67.138.3:25
dead_host	204.15.134.44:80
dead_host	173.231.184.124:25
dead_host	172.67.137.15:25
dead_host	192.168.56.103:50064
dead_host	154.81.136.239:80
dead_host	198.209.253.30:25
dead_host	192.168.56.103:50059
dead_host	91.220.211.163:25
dead_host	23.236.62.147:25
dead_host	192.168.56.103:49998
dead_host	83.167.255.150:25
dead_host	192.168.56.103:50148
dead_host	99.83.154.118:80
dead_host	3.64.163.50:25
dead_host	51.89.6.56:25
dead_host	62.75.251.116:80
dead_host	216.239.32.21:25
dead_host	79.124.76.247:80
dead_host	192.168.56.103:49526
dead_host	104.21.79.166:25
dead_host	185.106.129.180:25
dead_host	172.67.186.153:25
dead_host	148.130.4.196:80
dead_host	23.185.0.4:25
dead_host	104.20.122.68:25
dead_host	99.83.190.102:25
dead_host	198.199.101.195:25
dead_host	15.204.18.132:25
dead_host	192.124.249.14:25
dead_host	104.26.0.82:25
dead_host	211.13.196.162:25
dead_host	192.168.56.103:49955
dead_host	198.185.159.144:25
dead_host	76.74.184.61:25
dead_host	192.168.56.103:49910
dead_host	172.67.189.227:25
dead_host	192.168.56.103:49747
dead_host	192.168.56.103:49980
dead_host	88.86.118.82:25
dead_host	192.168.56.103:50024

80.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All