API tools faq
paste
whickey

2020-11-23 CobaltStrike Beacon Config Grab

whickey
Nov 24th, 2020 (edited)
7,613
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 885.17 KB | None | 0 0
raw download clone embed print report
  1. 2020-11-23
  2. IP's taken from: https://community.riskiq.com/search/components/Command%20and%20Control%20Server/Cobalt%20Strike/
  3. NSE Script: https://github.com/whickey-r7/grab_beacon_config
  4.  
  5. <?xml version="1.0" encoding="UTF-8"?>
  6. <!DOCTYPE nmaprun>
  7. <?xml-stylesheet href="file:///usr/bin/../share/nmap/nmap.xsl" type="text/xsl"?>
  8. <!-- Nmap 7.80 scan initiated Mon Nov 23 14:09:35 2020 as: nmap -iL 2020-11-23.txt -oX 2020-11-23.xml -&#45;script=grab_beacon_config.nse -->
  9. <nmaprun scanner="nmap" args="nmap -iL 2020-11-23.txt -oX 2020-11-23.xml -&#45;script=grab_beacon_config.nse" start="1606158575" startstr="Mon Nov 23 14:09:35 2020" version="7.80" xmloutputversion="1.04">
  10. <scaninfo type="connect" protocol="tcp" numservices="1000" services="1,3-4,6-7,9,13,17,19-26,30,32-33,37,42-43,49,53,70,79-85,88-90,99-100,106,109-111,113,119,125,135,139,143-144,146,161,163,179,199,211-212,222,254-256,259,264,280,301,306,311,340,366,389,406-407,416-417,425,427,443-445,458,464-465,481,497,500,512-515,524,541,543-545,548,554-555,563,587,593,616-617,625,631,636,646,648,666-668,683,687,691,700,705,711,714,720,722,726,749,765,777,783,787,800-801,808,843,873,880,888,898,900-903,911-912,981,987,990,992-993,995,999-1002,1007,1009-1011,1021-1100,1102,1104-1108,1110-1114,1117,1119,1121-1124,1126,1130-1132,1137-1138,1141,1145,1147-1149,1151-1152,1154,1163-1166,1169,1174-1175,1183,1185-1187,1192,1198-1199,1201,1213,1216-1218,1233-1234,1236,1244,1247-1248,1259,1271-1272,1277,1287,1296,1300-1301,1309-1311,1322,1328,1334,1352,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1521,1524,1533,1556,1580,1583,1594,1600,1641,1658,1666,1687-1688,1700,1717-1721,1723,1755,1761,1782-1783,1801,1805,1812,1839-1840,1862-1864,1875,1900,1914,1935,1947,1971-1972,1974,1984,1998-2010,2013,2020-2022,2030,2033-2035,2038,2040-2043,2045-2049,2065,2068,2099-2100,2103,2105-2107,2111,2119,2121,2126,2135,2144,2160-2161,2170,2179,2190-2191,2196,2200,2222,2251,2260,2288,2301,2323,2366,2381-2383,2393-2394,2399,2401,2492,2500,2522,2525,2557,2601-2602,2604-2605,2607-2608,2638,2701-2702,2710,2717-2718,2725,2800,2809,2811,2869,2875,2909-2910,2920,2967-2968,2998,3000-3001,3003,3005-3007,3011,3013,3017,3030-3031,3052,3071,3077,3128,3168,3211,3221,3260-3261,3268-3269,3283,3300-3301,3306,3322-3325,3333,3351,3367,3369-3372,3389-3390,3404,3476,3493,3517,3527,3546,3551,3580,3659,3689-3690,3703,3737,3766,3784,3800-3801,3809,3814,3826-3828,3851,3869,3871,3878,3880,3889,3905,3914,3918,3920,3945,3971,3986,3995,3998,4000-4006,4045,4111,4125-4126,4129,4224,4242,4279,4321,4343,4443-4446,4449,4550,4567,4662,4848,4899-4900,4998,5000-5004,5009,5030,5033,5050-5051,5054,5060-5061,5080,5087,5100-5102,5120,5190,5200,5214,5221-5222,5225-5226,5269,5280,5298,5357,5405,5414,5431-5432,5440,5500,5510,5544,5550,5555,5560,5566,5631,5633,5666,5678-5679,5718,5730,5800-5802,5810-5811,5815,5822,5825,5850,5859,5862,5877,5900-5904,5906-5907,5910-5911,5915,5922,5925,5950,5952,5959-5963,5987-5989,5998-6007,6009,6025,6059,6100-6101,6106,6112,6123,6129,6156,6346,6389,6502,6510,6543,6547,6565-6567,6580,6646,6666-6669,6689,6692,6699,6779,6788-6789,6792,6839,6881,6901,6969,7000-7002,7004,7007,7019,7025,7070,7100,7103,7106,7200-7201,7402,7435,7443,7496,7512,7625,7627,7676,7741,7777-7778,7800,7911,7920-7921,7937-7938,7999-8002,8007-8011,8021-8022,8031,8042,8045,8080-8090,8093,8099-8100,8180-8181,8192-8194,8200,8222,8254,8290-8292,8300,8333,8383,8400,8402,8443,8500,8600,8649,8651-8652,8654,8701,8800,8873,8888,8899,8994,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9099-9103,9110-9111,9200,9207,9220,9290,9415,9418,9485,9500,9502-9503,9535,9575,9593-9595,9618,9666,9876-9878,9898,9900,9917,9929,9943-9944,9968,9998-10004,10009-10010,10012,10024-10025,10082,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,11110-11111,11967,12000,12174,12265,12345,13456,13722,13782-13783,14000,14238,14441-14442,15000,15002-15004,15660,15742,16000-16001,16012,16016,16018,16080,16113,16992-16993,17877,17988,18040,18101,18988,19101,19283,19315,19350,19780,19801,19842,20000,20005,20031,20221-20222,20828,21571,22939,23502,24444,24800,25734-25735,26214,27000,27352-27353,27355-27356,27715,28201,30000,30718,30951,31038,31337,32768-32785,33354,33899,34571-34573,35500,38292,40193,40911,41511,42510,44176,44442-44443,44501,45100,48080,49152-49161,49163,49165,49167,49175-49176,49400,49999-50003,50006,50300,50389,50500,50636,50800,51103,51493,52673,52822,52848,52869,54045,54328,55055-55056,55555,55600,56737-56738,57294,57797,58080,60020,60443,61532,61900,62078,63331,64623,64680,65000,65129,65389"/>
  11. <verbose level="0"/>
  12. <debugging level="0"/>
  13. <host starttime="1606158578" endtime="1606161861"><status state="up" reason="syn-ack" reason_ttl="0"/>
  14. <address addr="85.143.223.144" addrtype="ipv4"/>
  15. <hostnames>
  16. <hostname name="254285.simplecloud.ru" type="PTR"/>
  17. </hostnames>
  18. <ports><extraports state="closed" count="994">
  19. <extrareasons reason="conn-refused" count="994"/>
  20. </extraports>
  21. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  22. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  23. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  24. <port protocol="tcp" portid="21571"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  25. <port protocol="tcp" portid="50003"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  26. <port protocol="tcp" portid="65129"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  27. </ports>
  28. <times srtt="256504" rttvar="4533" to="274636"/>
  29. </host>
  30. <host starttime="1606158577" endtime="1606161839"><status state="up" reason="conn-refused" reason_ttl="0"/>
  31. <address addr="154.220.3.196" addrtype="ipv4"/>
  32. <hostnames>
  33. </hostnames>
  34. <ports><extraports state="closed" count="991">
  35. <extrareasons reason="conn-refused" count="991"/>
  36. </extraports>
  37. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  38. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  39. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  40. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  41. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  42. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  43. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  44. <port protocol="tcp" portid="465"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  45. <port protocol="tcp" portid="1026"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="LSA-or-nterm" method="table" conf="3"/></port>
  46. </ports>
  47. <times srtt="356282" rttvar="3201" to="369086"/>
  48. </host>
  49. <host starttime="1606158578" endtime="1606161915"><status state="up" reason="syn-ack" reason_ttl="0"/>
  50. <address addr="154.220.3.226" addrtype="ipv4"/>
  51. <hostnames>
  52. </hostnames>
  53. <ports><extraports state="closed" count="990">
  54. <extrareasons reason="conn-refused" count="990"/>
  55. </extraports>
  56. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  57. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  58. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  59. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 154.220.3.226,/dot.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 154.220.3.226,/g.pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts; IE0006_ver1;EN_GB)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  60. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  61. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  62. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  63. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  64. <port protocol="tcp" portid="465"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  65. <port protocol="tcp" portid="5120"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="barracuda-bbs" method="table" conf="3"/></port>
  66. </ports>
  67. <times srtt="363691" rttvar="7070" to="391971"/>
  68. </host>
  69. <host starttime="1606158577" endtime="1606161902"><status state="up" reason="conn-refused" reason_ttl="0"/>
  70. <address addr="154.208.76.60" addrtype="ipv4"/>
  71. <hostnames>
  72. </hostnames>
  73. <ports><extraports state="closed" count="991">
  74. <extrareasons reason="conn-refused" count="991"/>
  75. </extraports>
  76. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  77. <port protocol="tcp" portid="111"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  78. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  79. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  80. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  81. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  82. <port protocol="tcp" portid="888"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  83. <port protocol="tcp" portid="1043"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="boinc" method="table" conf="3"/></port>
  84. <port protocol="tcp" portid="2522"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="windb" method="table" conf="3"/></port>
  85. </ports>
  86. <times srtt="356373" rttvar="5319" to="377649"/>
  87. </host>
  88. <host starttime="1606158576" endtime="1606161833"><status state="up" reason="syn-ack" reason_ttl="0"/>
  89. <address addr="23.83.134.16" addrtype="ipv4"/>
  90. <hostnames>
  91. </hostnames>
  92. <ports><extraports state="closed" count="992">
  93. <extrareasons reason="conn-refused" count="992"/>
  94. </extraports>
  95. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  96. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  97. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  98. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  99. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  100. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: black.lockboxlink.com,/ga.js,pics.lockboxlink.com,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MAAU; NP08)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  101. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  102. <port protocol="tcp" portid="18988"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  103. </ports>
  104. <times srtt="188099" rttvar="6872" to="215587"/>
  105. </host>
  106. <host starttime="1606158577" endtime="1606161874"><status state="up" reason="syn-ack" reason_ttl="0"/>
  107. <address addr="34.217.55.137" addrtype="ipv4"/>
  108. <hostnames>
  109. <hostname name="ec2-34-217-55-137.us-west-2.compute.amazonaws.com" type="PTR"/>
  110. </hostnames>
  111. <ports><extraports state="filtered" count="998">
  112. <extrareasons reason="no-responses" count="998"/>
  113. </extraports>
  114. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 34.217.55.137,/en_US/all.js&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 34.217.55.137,/ga.js&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  115. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 54.212.192.157,/ca&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  116. </ports>
  117. <times srtt="225992" rttvar="3893" to="241564"/>
  118. </host>
  119. <host starttime="1606158578" endtime="1606161833"><status state="up" reason="syn-ack" reason_ttl="0"/>
  120. <address addr="156.255.3.224" addrtype="ipv4"/>
  121. <hostnames>
  122. </hostnames>
  123. <ports><extraports state="filtered" count="997">
  124. <extrareasons reason="no-responses" count="997"/>
  125. </extraports>
  126. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  127. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  128. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  129. </ports>
  130. <times srtt="367241" rttvar="5110" to="387681"/>
  131. </host>
  132. <host starttime="1606158577" endtime="1606161856"><status state="up" reason="conn-refused" reason_ttl="0"/>
  133. <address addr="35.203.173.196" addrtype="ipv4"/>
  134. <hostnames>
  135. <hostname name="196.173.203.35.bc.googleusercontent.com" type="PTR"/>
  136. </hostnames>
  137. <ports><extraports state="filtered" count="998">
  138. <extrareasons reason="no-responses" count="998"/>
  139. </extraports>
  140. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  141. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  142. </ports>
  143. <times srtt="201716" rttvar="4083" to="218048"/>
  144. </host>
  145. <host starttime="1606158577" endtime="1606161878"><status state="up" reason="syn-ack" reason_ttl="0"/>
  146. <address addr="154.86.30.241" addrtype="ipv4"/>
  147. <hostnames>
  148. </hostnames>
  149. <ports><extraports state="closed" count="988">
  150. <extrareasons reason="conn-refused" count="988"/>
  151. </extraports>
  152. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  153. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  154. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  155. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  156. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  157. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  158. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  159. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  160. <port protocol="tcp" portid="1073"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="bridgecontrol" method="table" conf="3"/></port>
  161. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  162. <port protocol="tcp" portid="4446"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="n1-fwp" method="table" conf="3"/></port>
  163. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  164. </ports>
  165. <times srtt="335814" rttvar="6249" to="360810"/>
  166. </host>
  167. <host starttime="1606158576" endtime="1606161910"><status state="up" reason="syn-ack" reason_ttl="0"/>
  168. <address addr="35.221.158.178" addrtype="ipv4"/>
  169. <hostnames>
  170. <hostname name="178.158.221.35.bc.googleusercontent.com" type="PTR"/>
  171. </hostnames>
  172. <ports><extraports state="closed" count="995">
  173. <extrareasons reason="conn-refused" count="995"/>
  174. </extraports>
  175. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  176. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  177. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 34.92.118.176,/dpixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 34.92.118.176,/ca&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  178. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 34.92.118.176,/push&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ESES)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  179. <port protocol="tcp" portid="50500"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  180. </ports>
  181. <times srtt="339275" rttvar="2861" to="350719"/>
  182. </host>
  183. <host starttime="1606158576" endtime="1606161793"><status state="up" reason="conn-refused" reason_ttl="0"/>
  184. <address addr="101.36.102.73" addrtype="ipv4"/>
  185. <hostnames>
  186. </hostnames>
  187. <ports><extraports state="closed" count="994">
  188. <extrareasons reason="conn-refused" count="994"/>
  189. </extraports>
  190. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  191. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  192. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  193. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  194. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  195. <port protocol="tcp" portid="1080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="socks" method="table" conf="3"/></port>
  196. </ports>
  197. <times srtt="394710" rttvar="13274" to="447806"/>
  198. </host>
  199. <host starttime="1606158577" endtime="1606161920"><status state="up" reason="syn-ack" reason_ttl="0"/>
  200. <address addr="162.254.204.222" addrtype="ipv4"/>
  201. <hostnames>
  202. <hostname name="hosted-by.eurohoster.online" type="PTR"/>
  203. </hostnames>
  204. <ports><extraports state="filtered" count="996">
  205. <extrareasons reason="no-responses" count="996"/>
  206. </extraports>
  207. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  208. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 13500&#xa;Jitter: 27&#xa;Maxdns: 255&#xa;C2 Server: mstronestia.me,/maps/overlaybfpr&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36&#xa;HTTP Method Path 2: /fd/ls/lsp.aspx&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  209. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 13500&#xa;Jitter: 27&#xa;Maxdns: 255&#xa;C2 Server: microstamplet.me,/api&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36&#xa;HTTP Method Path 2: /media/api_wma.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  210. <port protocol="tcp" portid="45100"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  211. </ports>
  212. <times srtt="177998" rttvar="35865" to="321458"/>
  213. </host>
  214. <host starttime="1606158577" endtime="1606161858"><status state="up" reason="syn-ack" reason_ttl="0"/>
  215. <address addr="134.209.92.85" addrtype="ipv4"/>
  216. <hostnames>
  217. </hostnames>
  218. <ports><extraports state="closed" count="994">
  219. <extrareasons reason="conn-refused" count="994"/>
  220. </extraports>
  221. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  222. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  223. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  224. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 134.209.92.85,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  225. <port protocol="tcp" portid="4848"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="appserv-http" method="table" conf="3"/></port>
  226. <port protocol="tcp" portid="6667"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="irc" method="table" conf="3"/></port>
  227. </ports>
  228. <times srtt="227979" rttvar="4472" to="245867"/>
  229. </host>
  230. <host starttime="1606158577" endtime="1606161910"><status state="up" reason="syn-ack" reason_ttl="0"/>
  231. <address addr="212.64.32.215" addrtype="ipv4"/>
  232. <hostnames>
  233. </hostnames>
  234. <ports><extraports state="closed" count="986">
  235. <extrareasons reason="conn-refused" count="986"/>
  236. </extraports>
  237. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  238. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  239. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  240. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  241. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  242. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  243. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 212.64.32.215,/dpixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  244. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  245. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  246. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  247. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  248. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  249. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  250. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  251. </ports>
  252. <times srtt="336467" rttvar="2981" to="348391"/>
  253. </host>
  254. <host starttime="1606158576" endtime="1606161678"><status state="up" reason="conn-refused" reason_ttl="0"/>
  255. <address addr="47.103.150.221" addrtype="ipv4"/>
  256. <hostnames>
  257. </hostnames>
  258. <ports><extraports state="closed" count="982">
  259. <extrareasons reason="conn-refused" count="982"/>
  260. </extraports>
  261. <port protocol="tcp" portid="1"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="tcpmux" method="table" conf="3"/></port>
  262. <port protocol="tcp" portid="3"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="compressnet" method="table" conf="3"/></port>
  263. <port protocol="tcp" portid="4"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  264. <port protocol="tcp" portid="6"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  265. <port protocol="tcp" portid="7"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="echo" method="table" conf="3"/></port>
  266. <port protocol="tcp" portid="9"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="discard" method="table" conf="3"/></port>
  267. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  268. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  269. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  270. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  271. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  272. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  273. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  274. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  275. <port protocol="tcp" portid="1080"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="socks" method="table" conf="3"/></port>
  276. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  277. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  278. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  279. </ports>
  280. <times srtt="338360" rttvar="3734" to="353296"/>
  281. </host>
  282. <host starttime="1606158576" endtime="1606161881"><status state="up" reason="syn-ack" reason_ttl="0"/>
  283. <address addr="47.75.249.112" addrtype="ipv4"/>
  284. <hostnames>
  285. </hostnames>
  286. <ports><extraports state="closed" count="991">
  287. <extrareasons reason="conn-refused" count="991"/>
  288. </extraports>
  289. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  290. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  291. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  292. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  293. <port protocol="tcp" portid="888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  294. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  295. <port protocol="tcp" portid="3905"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="mupdate" method="table" conf="3"/></port>
  296. <port protocol="tcp" portid="5679"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="activesync" method="table" conf="3"/></port>
  297. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  298. </ports>
  299. <times srtt="363788" rttvar="4105" to="380208"/>
  300. </host>
  301. <host starttime="1606158577" endtime="1606161844"><status state="up" reason="syn-ack" reason_ttl="0"/>
  302. <address addr="173.234.25.77" addrtype="ipv4"/>
  303. <hostnames>
  304. </hostnames>
  305. <ports><extraports state="closed" count="996">
  306. <extrareasons reason="conn-refused" count="996"/>
  307. </extraports>
  308. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  309. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 173.234.25.74,/fwlink,lousingloo.com,/g.pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 173.234.25.74,/match,lousingloo.com,/pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  310. <port protocol="tcp" portid="88"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="kerberos-sec" method="table" conf="3"/></port>
  311. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  312. </ports>
  313. <times srtt="222701" rttvar="30685" to="345441"/>
  314. </host>
  315. <host starttime="1606158577" endtime="1606161910"><status state="up" reason="syn-ack" reason_ttl="0"/>
  316. <address addr="54.242.70.107" addrtype="ipv4"/>
  317. <hostnames>
  318. <hostname name="ec2-54-242-70-107.compute-1.amazonaws.com" type="PTR"/>
  319. </hostnames>
  320. <ports><extraports state="filtered" count="999">
  321. <extrareasons reason="no-responses" count="999"/>
  322. </extraports>
  323. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  324. </ports>
  325. <times srtt="138129" rttvar="3800" to="153329"/>
  326. </host>
  327. <host starttime="1606158577" endtime="1606161862"><status state="up" reason="conn-refused" reason_ttl="0"/>
  328. <address addr="199.217.117.184" addrtype="ipv4"/>
  329. <hostnames>
  330. <hostname name="falcon709.startdedicated.com" type="PTR"/>
  331. </hostnames>
  332. <ports><extraports state="closed" count="994">
  333. <extrareasons reason="conn-refused" count="994"/>
  334. </extraports>
  335. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  336. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 199.217.117.184,/__utm.gif&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  337. <port protocol="tcp" portid="444"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="snpp" method="table" conf="3"/></port>
  338. <port protocol="tcp" portid="18040"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  339. <port protocol="tcp" portid="19283"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="keysrvr" method="table" conf="3"/></port>
  340. <port protocol="tcp" portid="32768"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="filenet-tms" method="table" conf="3"/></port>
  341. </ports>
  342. <times srtt="163619" rttvar="1975" to="171519"/>
  343. </host>
  344. <host starttime="1606158577" endtime="1606161881"><status state="up" reason="syn-ack" reason_ttl="0"/>
  345. <address addr="35.220.144.193" addrtype="ipv4"/>
  346. <hostnames>
  347. <hostname name="193.144.220.35.bc.googleusercontent.com" type="PTR"/>
  348. </hostnames>
  349. <ports><extraports state="closed" count="948">
  350. <extrareasons reason="conn-refused" count="948"/>
  351. </extraports>
  352. <extraports state="filtered" count="47">
  353. <extrareasons reason="no-responses" count="47"/>
  354. </extraports>
  355. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  356. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 35.220.144.193,/cx&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 35.220.144.193,/push&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  357. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 35.220.144.193,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; LBBROWSER)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  358. <port protocol="tcp" portid="445"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  359. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  360. </ports>
  361. <times srtt="342948" rttvar="5715" to="365808"/>
  362. </host>
  363. <host starttime="1606158576" endtime="1606161917"><status state="up" reason="syn-ack" reason_ttl="0"/>
  364. <address addr="173.234.25.74" addrtype="ipv4"/>
  365. <hostnames>
  366. </hostnames>
  367. <ports><extraports state="closed" count="994">
  368. <extrareasons reason="conn-refused" count="994"/>
  369. </extraports>
  370. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  371. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 173.234.25.74,/fwlink,lousingloo.com,/g.pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 173.234.25.74,/match,lousingloo.com,/pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  372. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  373. <port protocol="tcp" portid="1311"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rxmon" method="table" conf="3"/></port>
  374. <port protocol="tcp" portid="2043"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="isis-bcast" method="table" conf="3"/></port>
  375. <port protocol="tcp" portid="6566"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sane-port" method="table" conf="3"/></port>
  376. </ports>
  377. <times srtt="191942" rttvar="2256" to="200966"/>
  378. </host>
  379. <host starttime="1606158576" endtime="1606161567"><status state="up" reason="conn-refused" reason_ttl="0"/>
  380. <address addr="185.153.196.130" addrtype="ipv4"/>
  381. <hostnames>
  382. <hostname name="server-185-153-196-130.cloudedic.net" type="PTR"/>
  383. </hostnames>
  384. <ports><extraports state="closed" count="999">
  385. <extrareasons reason="conn-refused" count="999"/>
  386. </extraports>
  387. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  388. </ports>
  389. <times srtt="266563" rttvar="4410" to="284203"/>
  390. </host>
  391. <host starttime="1606158576" endtime="1606161809"><status state="up" reason="conn-refused" reason_ttl="0"/>
  392. <address addr="185.150.117.142" addrtype="ipv4"/>
  393. <hostnames>
  394. </hostnames>
  395. <ports><extraports state="closed" count="988">
  396. <extrareasons reason="conn-refused" count="988"/>
  397. </extraports>
  398. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  399. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  400. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  401. <port protocol="tcp" portid="465"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  402. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  403. <port protocol="tcp" portid="1149"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="bvtsonar" method="table" conf="3"/></port>
  404. <port protocol="tcp" portid="1521"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="oracle" method="table" conf="3"/></port>
  405. <port protocol="tcp" portid="2030"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="device2" method="table" conf="3"/></port>
  406. <port protocol="tcp" portid="2607"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="connection" method="table" conf="3"/></port>
  407. <port protocol="tcp" portid="3869"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ovsam-mgmt" method="table" conf="3"/></port>
  408. <port protocol="tcp" portid="7627"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="soap-http" method="table" conf="3"/></port>
  409. <port protocol="tcp" portid="20000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="dnp" method="table" conf="3"/></port>
  410. </ports>
  411. <times srtt="242844" rttvar="1709" to="249680"/>
  412. </host>
  413. <host starttime="1606158576" endtime="1606161825"><status state="up" reason="conn-refused" reason_ttl="0"/>
  414. <address addr="51.83.180.153" addrtype="ipv4"/>
  415. <hostnames>
  416. <hostname name="ip153.ip-51-83-180.eu" type="PTR"/>
  417. </hostnames>
  418. <ports><extraports state="closed" count="995">
  419. <extrareasons reason="conn-refused" count="995"/>
  420. </extraports>
  421. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  422. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  423. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  424. <port protocol="tcp" portid="3325"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="active-net" method="table" conf="3"/></port>
  425. <port protocol="tcp" portid="4848"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="appserv-http" method="table" conf="3"/></port>
  426. </ports>
  427. <times srtt="243831" rttvar="1483" to="249763"/>
  428. </host>
  429. <host starttime="1606158577" endtime="1606161888"><status state="up" reason="syn-ack" reason_ttl="0"/>
  430. <address addr="185.158.114.133" addrtype="ipv4"/>
  431. <hostnames>
  432. <hostname name="114-133.static.spheral.ru" type="PTR"/>
  433. </hostnames>
  434. <ports><extraports state="closed" count="991">
  435. <extrareasons reason="conn-refused" count="991"/>
  436. </extraports>
  437. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  438. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  439. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  440. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  441. <port protocol="tcp" portid="500"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="isakmp" method="table" conf="3"/></port>
  442. <port protocol="tcp" portid="1073"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="bridgecontrol" method="table" conf="3"/></port>
  443. <port protocol="tcp" portid="10000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="snet-sensor-mgmt" method="table" conf="3"/></port>
  444. <port protocol="tcp" portid="12000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cce4x" method="table" conf="3"/></port>
  445. <port protocol="tcp" portid="21571"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  446. </ports>
  447. <times srtt="255811" rttvar="1942" to="263579"/>
  448. </host>
  449. <host starttime="1606158576" endtime="1606161812"><status state="up" reason="syn-ack" reason_ttl="0"/>
  450. <address addr="173.234.25.75" addrtype="ipv4"/>
  451. <hostnames>
  452. </hostnames>
  453. <ports><extraports state="closed" count="997">
  454. <extrareasons reason="conn-refused" count="997"/>
  455. </extraports>
  456. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  457. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 173.234.25.74,/fwlink,lousingloo.com,/g.pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 173.234.25.74,/match,lousingloo.com,/pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  458. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  459. </ports>
  460. <times srtt="192689" rttvar="2337" to="202037"/>
  461. </host>
  462. <host starttime="1606158577" endtime="1606161854"><status state="up" reason="syn-ack" reason_ttl="0"/>
  463. <address addr="185.118.166.66" addrtype="ipv4"/>
  464. <hostnames>
  465. <hostname name="horsema1.pserver.ru" type="PTR"/>
  466. </hostnames>
  467. <ports><extraports state="filtered" count="998">
  468. <extrareasons reason="no-responses" count="998"/>
  469. </extraports>
  470. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  471. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  472. </ports>
  473. <times srtt="285825" rttvar="4651" to="304429"/>
  474. </host>
  475. <host starttime="1606158577" endtime="1606161903"><status state="up" reason="syn-ack" reason_ttl="0"/>
  476. <address addr="185.207.154.21" addrtype="ipv4"/>
  477. <hostnames>
  478. </hostnames>
  479. <ports><extraports state="closed" count="990">
  480. <extrareasons reason="conn-refused" count="990"/>
  481. </extraports>
  482. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  483. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  484. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  485. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  486. <port protocol="tcp" portid="1084"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ansoft-lm-2" method="table" conf="3"/></port>
  487. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  488. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  489. <port protocol="tcp" portid="8088"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="radan-http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  490. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  491. <port protocol="tcp" portid="50001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  492. </ports>
  493. <times srtt="325730" rttvar="3575" to="340030"/>
  494. </host>
  495. <host starttime="1606158578" endtime="1606161922"><status state="up" reason="syn-ack" reason_ttl="0"/>
  496. <address addr="185.150.117.50" addrtype="ipv4"/>
  497. <hostnames>
  498. </hostnames>
  499. <ports><extraports state="closed" count="985">
  500. <extrareasons reason="conn-refused" count="985"/>
  501. </extraports>
  502. <port protocol="tcp" portid="19"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="chargen" method="table" conf="3"/></port>
  503. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  504. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  505. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.150.117.50,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.150.117.50,/j.ad&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  506. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.150.117.50,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENXA)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  507. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  508. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  509. <port protocol="tcp" portid="1084"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ansoft-lm-2" method="table" conf="3"/></port>
  510. <port protocol="tcp" portid="1217"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="hpss-ndapi" method="table" conf="3"/></port>
  511. <port protocol="tcp" portid="1761"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="landesk-rc" method="table" conf="3"/></port>
  512. <port protocol="tcp" portid="2008"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="conf" method="table" conf="3"/></port>
  513. <port protocol="tcp" portid="3367"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="satvid-datalnk" method="table" conf="3"/></port>
  514. <port protocol="tcp" portid="4111"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="xgrid" method="table" conf="3"/></port>
  515. <port protocol="tcp" portid="5200"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="targus-getdata" method="table" conf="3"/></port>
  516. <port protocol="tcp" portid="49163"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  517. </ports>
  518. <times srtt="245198" rttvar="3854" to="260614"/>
  519. </host>
  520. <host starttime="1606158578" endtime="1606161908"><status state="up" reason="syn-ack" reason_ttl="0"/>
  521. <address addr="185.162.235.111" addrtype="ipv4"/>
  522. <hostnames>
  523. </hostnames>
  524. <ports><extraports state="closed" count="992">
  525. <extrareasons reason="conn-refused" count="992"/>
  526. </extraports>
  527. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  528. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  529. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.162.235.111,/j.ad&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.162.235.111,/push&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  530. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  531. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.162.235.111,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  532. <port protocol="tcp" portid="445"><state state="filtered" reason="host-unreach" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  533. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  534. <port protocol="tcp" portid="8008"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  535. </ports>
  536. <times srtt="224053" rttvar="4577" to="242361"/>
  537. </host>
  538. <host starttime="1606158576" endtime="1606161825"><status state="up" reason="conn-refused" reason_ttl="0"/>
  539. <address addr="185.189.183.173" addrtype="ipv4"/>
  540. <hostnames>
  541. <hostname name="185-189-183-173.rdns.itconnectsyou.nl" type="PTR"/>
  542. </hostnames>
  543. <ports><extraports state="filtered" count="997">
  544. <extrareasons reason="no-responses" count="997"/>
  545. </extraports>
  546. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  547. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  548. <port protocol="tcp" portid="8082"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-alerts" method="table" conf="3"/></port>
  549. </ports>
  550. <times srtt="214098" rttvar="3400" to="227698"/>
  551. </host>
  552. <host starttime="1606158577" endtime="1606161832"><status state="up" reason="conn-refused" reason_ttl="0"/>
  553. <address addr="185.189.183.172" addrtype="ipv4"/>
  554. <hostnames>
  555. <hostname name="185-189-183-172.rdns.itconnectsyou.nl" type="PTR"/>
  556. </hostnames>
  557. <ports><extraports state="filtered" count="997">
  558. <extrareasons reason="no-responses" count="997"/>
  559. </extraports>
  560. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  561. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  562. <port protocol="tcp" portid="8083"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="us-srv" method="table" conf="3"/></port>
  563. </ports>
  564. <times srtt="215503" rttvar="4569" to="233779"/>
  565. </host>
  566. <host starttime="1606158577" endtime="1606161832"><status state="up" reason="syn-ack" reason_ttl="0"/>
  567. <address addr="172.105.237.117" addrtype="ipv4"/>
  568. <hostnames>
  569. <hostname name="li1891-117.members.linode.com" type="PTR"/>
  570. </hostnames>
  571. <ports><extraports state="filtered" count="997">
  572. <extrareasons reason="host-unreaches" count="883"/>
  573. <extrareasons reason="no-responses" count="114"/>
  574. </extraports>
  575. <port protocol="tcp" portid="22"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  576. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  577. <port protocol="tcp" portid="32779"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="sometimes-rpc21" method="table" conf="3"/></port>
  578. </ports>
  579. <times srtt="305490" rttvar="1404" to="311106"/>
  580. </host>
  581. <host starttime="1606158577" endtime="1606161902"><status state="up" reason="syn-ack" reason_ttl="0"/>
  582. <address addr="199.247.18.58" addrtype="ipv4"/>
  583. <hostnames>
  584. <hostname name="199.247.18.58.vultr.com" type="PTR"/>
  585. </hostnames>
  586. <ports><extraports state="closed" count="993">
  587. <extrareasons reason="conn-refused" count="993"/>
  588. </extraports>
  589. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  590. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  591. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  592. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 199.247.18.58,/pixel.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  593. <port protocol="tcp" portid="1033"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netinfo" method="table" conf="3"/></port>
  594. <port protocol="tcp" portid="3369"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="satvid-datalnk" method="table" conf="3"/></port>
  595. <port protocol="tcp" portid="49161"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  596. </ports>
  597. <times srtt="225239" rttvar="4169" to="241915"/>
  598. </host>
  599. <host starttime="1606158577" endtime="1606161878"><status state="up" reason="syn-ack" reason_ttl="0"/>
  600. <address addr="34.96.157.246" addrtype="ipv4"/>
  601. <hostnames>
  602. <hostname name="246.157.96.34.bc.googleusercontent.com" type="PTR"/>
  603. </hostnames>
  604. <ports><extraports state="closed" count="993">
  605. <extrareasons reason="conn-refused" count="993"/>
  606. </extraports>
  607. <port protocol="tcp" portid="25"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  608. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  609. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  610. <port protocol="tcp" portid="90"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="dnsix" method="table" conf="3"/></port>
  611. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  612. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  613. <port protocol="tcp" portid="8082"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-alerts" method="table" conf="3"/></port>
  614. </ports>
  615. <times srtt="344506" rttvar="2763" to="355558"/>
  616. </host>
  617. <host starttime="1606158577" endtime="1606161870"><status state="up" reason="syn-ack" reason_ttl="0"/>
  618. <address addr="185.232.52.143" addrtype="ipv4"/>
  619. <hostnames>
  620. <hostname name="jimbatton89890.prohoster.info" type="PTR"/>
  621. </hostnames>
  622. <ports><extraports state="closed" count="990">
  623. <extrareasons reason="conn-refused" count="990"/>
  624. </extraports>
  625. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  626. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  627. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.232.52.143,/en_US/all.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.232.52.143,/ca&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MANM)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  628. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  629. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.232.52.143,/ptj&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  630. <port protocol="tcp" portid="1090"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ff-fms" method="table" conf="3"/></port>
  631. <port protocol="tcp" portid="1500"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vlsi-lm" method="table" conf="3"/></port>
  632. <port protocol="tcp" portid="3826"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="wormux" method="table" conf="3"/></port>
  633. <port protocol="tcp" portid="5901"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vnc-1" method="table" conf="3"/></port>
  634. <port protocol="tcp" portid="6001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="X11:1" method="table" conf="3"/></port>
  635. </ports>
  636. <times srtt="227456" rttvar="4798" to="246648"/>
  637. </host>
  638. <host starttime="1606158578" endtime="1606161863"><status state="up" reason="syn-ack" reason_ttl="0"/>
  639. <address addr="193.34.166.89" addrtype="ipv4"/>
  640. <hostnames>
  641. <hostname name="neo.com.org" type="PTR"/>
  642. </hostnames>
  643. <ports><extraports state="filtered" count="998">
  644. <extrareasons reason="no-responses" count="998"/>
  645. </extraports>
  646. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  647. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 193.34.166.89,/en_US/all.js&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  648. </ports>
  649. <times srtt="213083" rttvar="2222" to="221971"/>
  650. </host>
  651. <host starttime="1606158578" endtime="1606161876"><status state="up" reason="syn-ack" reason_ttl="0"/>
  652. <address addr="198.44.97.179" addrtype="ipv4"/>
  653. <hostnames>
  654. <hostname name="hwsrv-803384.hostwindsdns.com" type="PTR"/>
  655. </hostnames>
  656. <ports><extraports state="closed" count="995">
  657. <extrareasons reason="conn-refused" count="995"/>
  658. </extraports>
  659. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  660. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  661. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 198.44.97.180,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 198.44.97.180,/pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  662. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  663. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 198.44.97.180,/ga.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  664. </ports>
  665. <times srtt="222557" rttvar="3580" to="236877"/>
  666. </host>
  667. <host starttime="1606158578" endtime="1606161902"><status state="up" reason="syn-ack" reason_ttl="0"/>
  668. <address addr="193.34.166.169" addrtype="ipv4"/>
  669. <hostnames>
  670. <hostname name="cob1.ad.to" type="PTR"/>
  671. </hostnames>
  672. <ports><extraports state="filtered" count="997">
  673. <extrareasons reason="no-responses" count="997"/>
  674. </extraports>
  675. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  676. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  677. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: ntwindowsupdate.com,/ca&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENAU)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  678. </ports>
  679. <times srtt="211560" rttvar="1627" to="218068"/>
  680. </host>
  681. <host starttime="1606158578" endtime="1606161881"><status state="up" reason="syn-ack" reason_ttl="0"/>
  682. <address addr="193.34.167.200" addrtype="ipv4"/>
  683. <hostnames>
  684. <hostname name="dns.inteldrivers.com" type="PTR"/>
  685. </hostnames>
  686. <ports><extraports state="filtered" count="997">
  687. <extrareasons reason="no-responses" count="997"/>
  688. </extraports>
  689. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  690. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: inteldrivers.com,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENAU)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: inteldrivers.com,/visit.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENAU)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  691. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: inteldrivers.com,/cm&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; XBLWP7; ZuneWP7)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  692. </ports>
  693. <times srtt="212961" rttvar="2607" to="223389"/>
  694. </host>
  695. <host starttime="1606158577" endtime="1606161888"><status state="up" reason="conn-refused" reason_ttl="0"/>
  696. <address addr="18.217.54.127" addrtype="ipv4"/>
  697. <hostnames>
  698. <hostname name="ec2-18-217-54-127.us-east-2.compute.amazonaws.com" type="PTR"/>
  699. </hostnames>
  700. <ports><extraports state="filtered" count="993">
  701. <extrareasons reason="no-responses" count="993"/>
  702. </extraports>
  703. <port protocol="tcp" portid="22"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  704. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  705. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  706. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  707. <port protocol="tcp" portid="8081"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  708. <port protocol="tcp" portid="8888"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  709. <port protocol="tcp" portid="9102"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="jetdirect" method="table" conf="3"/></port>
  710. </ports>
  711. <times srtt="151489" rttvar="2535" to="161629"/>
  712. </host>
  713. <host starttime="1606158577" endtime="1606161908"><status state="up" reason="syn-ack" reason_ttl="0"/>
  714. <address addr="185.52.3.205" addrtype="ipv4"/>
  715. <hostnames>
  716. </hostnames>
  717. <ports><extraports state="closed" count="993">
  718. <extrareasons reason="conn-refused" count="993"/>
  719. </extraports>
  720. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  721. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  722. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  723. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.52.3.205,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; ASU2JS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  724. <port protocol="tcp" portid="5550"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sdadmind" method="table" conf="3"/></port>
  725. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.52.3.205,/load&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; XBLWP7; ZuneWP7)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.52.3.205,/en_US/all.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; BOIE9;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  726. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  727. </ports>
  728. <times srtt="220615" rttvar="3710" to="235455"/>
  729. </host>
  730. <host starttime="1606158577" endtime="1606161881"><status state="up" reason="syn-ack" reason_ttl="0"/>
  731. <address addr="198.13.47.54" addrtype="ipv4"/>
  732. <hostnames>
  733. <hostname name="198.13.47.54.cacheso.com" type="PTR"/>
  734. </hostnames>
  735. <ports><extraports state="closed" count="990">
  736. <extrareasons reason="conn-refused" count="990"/>
  737. </extraports>
  738. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  739. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  740. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  741. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  742. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  743. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  744. <port protocol="tcp" portid="5963"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="indy" method="table" conf="3"/></port>
  745. <port protocol="tcp" portid="7937"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nsrexecd" method="table" conf="3"/></port>
  746. <port protocol="tcp" portid="50001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  747. <port protocol="tcp" portid="64680"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  748. </ports>
  749. <times srtt="302288" rttvar="886" to="305832"/>
  750. </host>
  751. <host starttime="1606158577" endtime="1606161832"><status state="up" reason="conn-refused" reason_ttl="0"/>
  752. <address addr="185.82.202.123" addrtype="ipv4"/>
  753. <hostnames>
  754. </hostnames>
  755. <ports><extraports state="closed" count="994">
  756. <extrareasons reason="conn-refused" count="994"/>
  757. </extraports>
  758. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  759. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  760. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  761. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  762. <port protocol="tcp" portid="4443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="pharos" method="table" conf="3"/></port>
  763. <port protocol="tcp" portid="8090"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="opsmessaging" method="table" conf="3"/></port>
  764. </ports>
  765. <times srtt="221458" rttvar="5649" to="244054"/>
  766. </host>
  767. <host starttime="1606158577" endtime="1606161902"><status state="up" reason="syn-ack" reason_ttl="0"/>
  768. <address addr="185.236.201.102" addrtype="ipv4"/>
  769. <hostnames>
  770. <hostname name="no-mans-land.m247.com" type="PTR"/>
  771. </hostnames>
  772. <ports><extraports state="closed" count="990">
  773. <extrareasons reason="conn-refused" count="990"/>
  774. </extraports>
  775. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  776. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  777. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  778. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  779. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  780. <port protocol="tcp" portid="2500"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rtsserv" method="table" conf="3"/></port>
  781. <port protocol="tcp" portid="5877"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  782. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  783. <port protocol="tcp" portid="49160"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  784. <port protocol="tcp" portid="65129"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  785. </ports>
  786. <times srtt="237339" rttvar="3372" to="250827"/>
  787. </host>
  788. <host starttime="1606158576" endtime="1606161833"><status state="up" reason="conn-refused" reason_ttl="0"/>
  789. <address addr="172.104.174.57" addrtype="ipv4"/>
  790. <hostnames>
  791. <hostname name="li1765-57.members.linode.com" type="PTR"/>
  792. </hostnames>
  793. <ports><extraports state="closed" count="998">
  794. <extrareasons reason="conn-refused" count="998"/>
  795. </extraports>
  796. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  797. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 172.104.174.57,/ca&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  798. </ports>
  799. <times srtt="384953" rttvar="7345" to="414333"/>
  800. </host>
  801. <host starttime="1606158576" endtime="1606161902"><status state="up" reason="syn-ack" reason_ttl="0"/>
  802. <address addr="185.244.149.152" addrtype="ipv4"/>
  803. <hostnames>
  804. </hostnames>
  805. <ports><extraports state="closed" count="995">
  806. <extrareasons reason="conn-refused" count="995"/>
  807. </extraports>
  808. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  809. <port protocol="tcp" portid="25"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  810. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  811. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  812. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  813. </ports>
  814. <times srtt="253314" rttvar="1288" to="258466"/>
  815. </host>
  816. <host starttime="1606158576" endtime="1606161910"><status state="up" reason="conn-refused" reason_ttl="0"/>
  817. <address addr="154.208.76.59" addrtype="ipv4"/>
  818. <hostnames>
  819. </hostnames>
  820. <ports><extraports state="closed" count="994">
  821. <extrareasons reason="conn-refused" count="994"/>
  822. </extraports>
  823. <port protocol="tcp" portid="111"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  824. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  825. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  826. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  827. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  828. <port protocol="tcp" portid="888"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  829. </ports>
  830. <times srtt="361133" rttvar="8570" to="395413"/>
  831. </host>
  832. <host starttime="1606158577" endtime="1606161866"><status state="up" reason="syn-ack" reason_ttl="0"/>
  833. <address addr="198.44.97.181" addrtype="ipv4"/>
  834. <hostnames>
  835. <hostname name="client-198-44-97-181.hostwindsdns.com" type="PTR"/>
  836. </hostnames>
  837. <ports><extraports state="closed" count="995">
  838. <extrareasons reason="conn-refused" count="995"/>
  839. </extraports>
  840. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  841. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  842. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 198.44.97.180,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 198.44.97.180,/pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  843. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  844. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 198.44.97.180,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0; msn OptimizedIE8;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  845. </ports>
  846. <times srtt="221612" rttvar="4012" to="237660"/>
  847. </host>
  848. <host starttime="1606158576" endtime="1606161894"><status state="up" reason="syn-ack" reason_ttl="0"/>
  849. <address addr="192.236.248.169" addrtype="ipv4"/>
  850. <hostnames>
  851. <hostname name="hwsrv-805727.hostwindsdns.com" type="PTR"/>
  852. </hostnames>
  853. <ports><extraports state="closed" count="996">
  854. <extrareasons reason="conn-refused" count="996"/>
  855. </extraports>
  856. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  857. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  858. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  859. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amapai-technologies.email,/dot.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  860. </ports>
  861. <times srtt="220741" rttvar="1158" to="225373"/>
  862. </host>
  863. <host starttime="1606158577" endtime="1606161910"><status state="up" reason="syn-ack" reason_ttl="0"/>
  864. <address addr="185.153.198.121" addrtype="ipv4"/>
  865. <hostnames>
  866. <hostname name="server-185-153-198-121.cloudedic.net" type="PTR"/>
  867. </hostnames>
  868. <ports><extraports state="closed" count="994">
  869. <extrareasons reason="conn-refused" count="994"/>
  870. </extraports>
  871. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  872. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  873. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  874. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  875. <port protocol="tcp" portid="3945"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="emcads" method="table" conf="3"/></port>
  876. <port protocol="tcp" portid="7007"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-bos" method="table" conf="3"/></port>
  877. </ports>
  878. <times srtt="265858" rttvar="3949" to="281654"/>
  879. </host>
  880. <host starttime="1606158577" endtime="1606161832"><status state="up" reason="conn-refused" reason_ttl="0"/>
  881. <address addr="172.241.29.156" addrtype="ipv4"/>
  882. <hostnames>
  883. </hostnames>
  884. <ports><extraports state="closed" count="989">
  885. <extrareasons reason="conn-refused" count="989"/>
  886. </extraports>
  887. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  888. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  889. <port protocol="tcp" portid="109"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop2" method="table" conf="3"/></port>
  890. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  891. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  892. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  893. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  894. <port protocol="tcp" portid="2020"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="xinupageserver" method="table" conf="3"/></port>
  895. <port protocol="tcp" portid="3766"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sitewatch-s" method="table" conf="3"/></port>
  896. <port protocol="tcp" portid="5080"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="onscreen" method="table" conf="3"/></port>
  897. <port protocol="tcp" portid="9876"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sd" method="table" conf="3"/></port>
  898. </ports>
  899. <times srtt="166464" rttvar="2136" to="175008"/>
  900. </host>
  901. <host starttime="1606158576" endtime="1606161862"><status state="up" reason="conn-refused" reason_ttl="0"/>
  902. <address addr="35.193.193.149" addrtype="ipv4"/>
  903. <hostnames>
  904. <hostname name="149.193.193.35.bc.googleusercontent.com" type="PTR"/>
  905. </hostnames>
  906. <ports><extraports state="filtered" count="996">
  907. <extrareasons reason="no-responses" count="996"/>
  908. </extraports>
  909. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  910. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  911. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 35.193.193.149,/dot.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MAAU; NP08)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  912. <port protocol="tcp" portid="3389"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  913. </ports>
  914. <times srtt="168407" rttvar="6529" to="194523"/>
  915. </host>
  916. <host starttime="1606158577" endtime="1606161910"><status state="up" reason="syn-ack" reason_ttl="0"/>
  917. <address addr="51.79.42.149" addrtype="ipv4"/>
  918. <hostnames>
  919. <hostname name="ip149.ip-51-79-42.net" type="PTR"/>
  920. </hostnames>
  921. <ports><extraports state="closed" count="996">
  922. <extrareasons reason="conn-refused" count="996"/>
  923. </extraports>
  924. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  925. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  926. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 10000&#xa;Jitter: 30&#xa;Maxdns: 255&#xa;C2 Server: 51.79.42.149,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 10000&#xa;Jitter: 30&#xa;Maxdns: 255&#xa;C2 Server: 51.79.42.149,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  927. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  928. </ports>
  929. <times srtt="145939" rttvar="1238" to="150891"/>
  930. </host>
  931. <host starttime="1606158576" endtime="1606161839"><status state="up" reason="syn-ack" reason_ttl="0"/>
  932. <address addr="185.162.235.35" addrtype="ipv4"/>
  933. <hostnames>
  934. </hostnames>
  935. <ports><extraports state="filtered" count="998">
  936. <extrareasons reason="no-responses" count="997"/>
  937. <extrareasons reason="host-unreach" count="1"/>
  938. </extraports>
  939. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.162.235.35,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.162.235.35,/__utm.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MANM)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  940. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  941. </ports>
  942. <times srtt="222192" rttvar="1744" to="229168"/>
  943. </host>
  944. <host starttime="1606158576" endtime="1606161870"><status state="up" reason="conn-refused" reason_ttl="0"/>
  945. <address addr="217.61.61.60" addrtype="ipv4"/>
  946. <hostnames>
  947. <hostname name="host60-61-61-217.serverdedicati.aruba.it" type="PTR"/>
  948. </hostnames>
  949. <ports><extraports state="closed" count="995">
  950. <extrareasons reason="conn-refused" count="995"/>
  951. </extraports>
  952. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  953. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  954. <port protocol="tcp" portid="179"><state state="filtered" reason="host-unreach" reason_ttl="0"/><service name="bgp" method="table" conf="3"/></port>
  955. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  956. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  957. </ports>
  958. <times srtt="235478" rttvar="1987" to="243426"/>
  959. </host>
  960. <host starttime="1606158578" endtime="1606161890"><status state="up" reason="syn-ack" reason_ttl="0"/>
  961. <address addr="192.144.181.141" addrtype="ipv4"/>
  962. <hostnames>
  963. </hostnames>
  964. <ports><extraports state="closed" count="987">
  965. <extrareasons reason="conn-refused" count="987"/>
  966. </extraports>
  967. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  968. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  969. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  970. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  971. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  972. <port protocol="tcp" portid="1494"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="citrix-ica" method="table" conf="3"/></port>
  973. <port protocol="tcp" portid="2222"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="EtherNetIP-1" method="table" conf="3"/></port>
  974. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  975. <port protocol="tcp" portid="5440"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  976. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  977. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  978. <port protocol="tcp" portid="7777"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cbt" method="table" conf="3"/></port>
  979. <port protocol="tcp" portid="49160"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  980. </ports>
  981. <times srtt="369787" rttvar="4039" to="385943"/>
  982. </host>
  983. <host starttime="1606158576" endtime="1606161839"><status state="up" reason="conn-refused" reason_ttl="0"/>
  984. <address addr="207.148.78.25" addrtype="ipv4"/>
  985. <hostnames>
  986. <hostname name="207.148.78.25.vultr.com" type="PTR"/>
  987. </hostnames>
  988. <ports><extraports state="closed" count="994">
  989. <extrareasons reason="conn-refused" count="994"/>
  990. </extraports>
  991. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  992. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  993. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  994. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  995. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  996. <port protocol="tcp" portid="1022"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="exp2" method="table" conf="3"/></port>
  997. </ports>
  998. <times srtt="382739" rttvar="7183" to="411471"/>
  999. </host>
  1000. <host starttime="1606158577" endtime="1606161892"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1001. <address addr="185.82.126.47" addrtype="ipv4"/>
  1002. <hostnames>
  1003. </hostnames>
  1004. <ports><extraports state="closed" count="994">
  1005. <extrareasons reason="conn-refused" count="994"/>
  1006. </extraports>
  1007. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1008. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1009. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.82.126.47,/pixel.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; FunWebProducts)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.82.126.47,/en_US/all.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENAU)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1010. <port protocol="tcp" portid="82"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="xfer" method="table" conf="3"/></port>
  1011. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.82.126.47,/pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MASB)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.82.126.47,/pixel.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MATMJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1012. <port protocol="tcp" portid="5666"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="nrpe" method="table" conf="3"/></port>
  1013. </ports>
  1014. <times srtt="247510" rttvar="3374" to="261006"/>
  1015. </host>
  1016. <host starttime="1606158576" endtime="1606161888"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1017. <address addr="217.12.218.199" addrtype="ipv4"/>
  1018. <hostnames>
  1019. <hostname name="dedic-ammarik-646723.hosted-by-itldc.com" type="PTR"/>
  1020. </hostnames>
  1021. <ports><extraports state="closed" count="990">
  1022. <extrareasons reason="conn-refused" count="990"/>
  1023. </extraports>
  1024. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1025. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1026. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 35000&#xa;Jitter: 22&#xa;Maxdns: 245&#xa;C2 Server: 217.12.218.199,/questions/32251816/c-sharp-directives-compilation-error&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36&#xa;HTTP Method Path 2: /questions/32251817/c-sharp-directives-compilation-error&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 35000&#xa;Jitter: 22&#xa;Maxdns: 245&#xa;C2 Server: 217.12.218.199,/questions/32251816/c-sharp-directives-compilation-error&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36&#xa;HTTP Method Path 2: /questions/32251817/c-sharp-directives-compilation-error&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1027. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1028. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1029. <port protocol="tcp" portid="407"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="timbuktu" method="table" conf="3"/></port>
  1030. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1031. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1032. <port protocol="tcp" portid="1027"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="IIS" method="table" conf="3"/></port>
  1033. <port protocol="tcp" portid="5550"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sdadmind" method="table" conf="3"/></port>
  1034. </ports>
  1035. <times srtt="221482" rttvar="1688" to="228234"/>
  1036. </host>
  1037. <host starttime="1606158576" endtime="1606161808"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1038. <address addr="204.16.247.41" addrtype="ipv4"/>
  1039. <hostnames>
  1040. </hostnames>
  1041. <ports><extraports state="closed" count="995">
  1042. <extrareasons reason="conn-refused" count="995"/>
  1043. </extraports>
  1044. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1045. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1046. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1047. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1048. <port protocol="tcp" portid="8082"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="blackice-alerts" method="table" conf="3"/></port>
  1049. </ports>
  1050. <times srtt="143272" rttvar="1358" to="148704"/>
  1051. </host>
  1052. <host starttime="1606158577" endtime="1606161897"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1053. <address addr="185.232.52.137" addrtype="ipv4"/>
  1054. <hostnames>
  1055. <hostname name="jimbatton89890.prohoster.info" type="PTR"/>
  1056. </hostnames>
  1057. <ports><extraports state="closed" count="992">
  1058. <extrareasons reason="conn-refused" count="992"/>
  1059. </extraports>
  1060. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1061. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1062. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.232.52.137,/ca&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts; IE0006_ver1;EN_GB)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1063. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1064. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.232.52.137,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MASP)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1065. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  1066. <port protocol="tcp" portid="5901"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vnc-1" method="table" conf="3"/></port>
  1067. <port protocol="tcp" portid="6001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="X11:1" method="table" conf="3"/></port>
  1068. </ports>
  1069. <times srtt="225679" rttvar="4247" to="242667"/>
  1070. </host>
  1071. <host starttime="1606158576" endtime="1606161915"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1072. <address addr="222.186.160.129" addrtype="ipv4"/>
  1073. <hostnames>
  1074. </hostnames>
  1075. <ports><extraports state="closed" count="890">
  1076. <extrareasons reason="conn-refused" count="890"/>
  1077. </extraports>
  1078. <port protocol="tcp" portid="13"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="daytime" method="table" conf="3"/></port>
  1079. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1080. <port protocol="tcp" portid="49"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="tacacs" method="table" conf="3"/></port>
  1081. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1082. <port protocol="tcp" portid="79"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="finger" method="table" conf="3"/></port>
  1083. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1084. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  1085. <port protocol="tcp" portid="212"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="anet" method="table" conf="3"/></port>
  1086. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1087. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1088. <port protocol="tcp" portid="515"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="printer" method="table" conf="3"/></port>
  1089. <port protocol="tcp" portid="843"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1090. <port protocol="tcp" portid="900"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="omginitialrefs" method="table" conf="3"/></port>
  1091. <port protocol="tcp" portid="912"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="apex-mesh" method="table" conf="3"/></port>
  1092. <port protocol="tcp" portid="1023"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netvenuechat" method="table" conf="3"/></port>
  1093. <port protocol="tcp" portid="1027"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="IIS" method="table" conf="3"/></port>
  1094. <port protocol="tcp" portid="1040"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netsaint" method="table" conf="3"/></port>
  1095. <port protocol="tcp" portid="1047"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="neod1" method="table" conf="3"/></port>
  1096. <port protocol="tcp" portid="1060"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="polestar" method="table" conf="3"/></port>
  1097. <port protocol="tcp" portid="1064"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="jstel" method="table" conf="3"/></port>
  1098. <port protocol="tcp" portid="1078"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="avocent-proxy" method="table" conf="3"/></port>
  1099. <port protocol="tcp" portid="1088"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cplscrambler-al" method="table" conf="3"/></port>
  1100. <port protocol="tcp" portid="1093"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="proofd" method="table" conf="3"/></port>
  1101. <port protocol="tcp" portid="1130"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="casp" method="table" conf="3"/></port>
  1102. <port protocol="tcp" portid="1165"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="qsm-gui" method="table" conf="3"/></port>
  1103. <port protocol="tcp" portid="1201"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="nucleus-sand" method="table" conf="3"/></port>
  1104. <port protocol="tcp" portid="1296"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="dproxy" method="table" conf="3"/></port>
  1105. <port protocol="tcp" portid="1311"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rxmon" method="table" conf="3"/></port>
  1106. <port protocol="tcp" portid="1443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ies-lm" method="table" conf="3"/></port>
  1107. <port protocol="tcp" portid="1524"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ingreslock" method="table" conf="3"/></port>
  1108. <port protocol="tcp" portid="1755"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="wms" method="table" conf="3"/></port>
  1109. <port protocol="tcp" portid="1761"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="landesk-rc" method="table" conf="3"/></port>
  1110. <port protocol="tcp" portid="1801"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msmq" method="table" conf="3"/></port>
  1111. <port protocol="tcp" portid="1863"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msnp" method="table" conf="3"/></port>
  1112. <port protocol="tcp" portid="2041"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="interbase" method="table" conf="3"/></port>
  1113. <port protocol="tcp" portid="2043"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="isis-bcast" method="table" conf="3"/></port>
  1114. <port protocol="tcp" portid="2119"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="gsigatekeeper" method="table" conf="3"/></port>
  1115. <port protocol="tcp" portid="2126"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="pktcable-cops" method="table" conf="3"/></port>
  1116. <port protocol="tcp" portid="2366"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="qip-login" method="table" conf="3"/></port>
  1117. <port protocol="tcp" portid="2809"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="corbaloc" method="table" conf="3"/></port>
  1118. <port protocol="tcp" portid="2811"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="gsiftp" method="table" conf="3"/></port>
  1119. <port protocol="tcp" portid="3000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ppp" method="table" conf="3"/></port>
  1120. <port protocol="tcp" portid="3003"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cgms" method="table" conf="3"/></port>
  1121. <port protocol="tcp" portid="3007"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="lotusmtap" method="table" conf="3"/></port>
  1122. <port protocol="tcp" portid="3071"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="csd-mgmt-port" method="table" conf="3"/></port>
  1123. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  1124. <port protocol="tcp" portid="3333"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="dec-notes" method="table" conf="3"/></port>
  1125. <port protocol="tcp" portid="3369"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="satvid-datalnk" method="table" conf="3"/></port>
  1126. <port protocol="tcp" portid="3404"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1127. <port protocol="tcp" portid="3493"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="nut" method="table" conf="3"/></port>
  1128. <port protocol="tcp" portid="3551"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="apcupsd" method="table" conf="3"/></port>
  1129. <port protocol="tcp" portid="4000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="remoteanything" method="table" conf="3"/></port>
  1130. <port protocol="tcp" portid="4045"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="lockd" method="table" conf="3"/></port>
  1131. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  1132. <port protocol="tcp" portid="5087"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="biotic" method="table" conf="3"/></port>
  1133. <port protocol="tcp" portid="5101"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="admdog" method="table" conf="3"/></port>
  1134. <port protocol="tcp" portid="5120"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="barracuda-bbs" method="table" conf="3"/></port>
  1135. <port protocol="tcp" portid="5432"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="postgresql" method="table" conf="3"/></port>
  1136. <port protocol="tcp" portid="5550"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sdadmind" method="table" conf="3"/></port>
  1137. <port protocol="tcp" portid="5631"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="pcanywheredata" method="table" conf="3"/></port>
  1138. <port protocol="tcp" portid="5718"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="dpm" method="table" conf="3"/></port>
  1139. <port protocol="tcp" portid="5859"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="wherehoo" method="table" conf="3"/></port>
  1140. <port protocol="tcp" portid="5900"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  1141. <port protocol="tcp" portid="5901"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vnc-1" method="table" conf="3"/></port>
  1142. <port protocol="tcp" portid="5902"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vnc-2" method="table" conf="3"/></port>
  1143. <port protocol="tcp" portid="5903"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vnc-3" method="table" conf="3"/></port>
  1144. <port protocol="tcp" portid="5904"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1145. <port protocol="tcp" portid="5906"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1146. <port protocol="tcp" portid="5907"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1147. <port protocol="tcp" portid="5910"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cm" method="table" conf="3"/></port>
  1148. <port protocol="tcp" portid="5911"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cpdlc" method="table" conf="3"/></port>
  1149. <port protocol="tcp" portid="5988"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="wbem-http" method="table" conf="3"/></port>
  1150. <port protocol="tcp" portid="5989"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="wbem-https" method="table" conf="3"/></port>
  1151. <port protocol="tcp" portid="6002"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="X11:2" method="table" conf="3"/></port>
  1152. <port protocol="tcp" portid="6025"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="x11" method="table" conf="3"/></port>
  1153. <port protocol="tcp" portid="6565"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1154. <port protocol="tcp" portid="6580"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="parsec-master" method="table" conf="3"/></port>
  1155. <port protocol="tcp" portid="6792"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1156. <port protocol="tcp" portid="7201"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="dlip" method="table" conf="3"/></port>
  1157. <port protocol="tcp" portid="7625"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1158. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1159. <port protocol="tcp" portid="8008"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1160. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1161. <port protocol="tcp" portid="8200"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="trivnet1" method="table" conf="3"/></port>
  1162. <port protocol="tcp" portid="8222"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1163. <port protocol="tcp" portid="8292"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blp3" method="table" conf="3"/></port>
  1164. <port protocol="tcp" portid="8400"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cvd" method="table" conf="3"/></port>
  1165. <port protocol="tcp" portid="8800"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sunwebadmin" method="table" conf="3"/></port>
  1166. <port protocol="tcp" portid="9011"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="d-star" method="table" conf="3"/></port>
  1167. <port protocol="tcp" portid="9091"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="xmltec-xmlmail" method="table" conf="3"/></port>
  1168. <port protocol="tcp" portid="9102"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="jetdirect" method="table" conf="3"/></port>
  1169. <port protocol="tcp" portid="9502"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1170. <port protocol="tcp" portid="9593"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cba8" method="table" conf="3"/></port>
  1171. <port protocol="tcp" portid="9999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="abyss" method="table" conf="3"/></port>
  1172. <port protocol="tcp" portid="10004"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="emcrmirccd" method="table" conf="3"/></port>
  1173. <port protocol="tcp" portid="10025"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1174. <port protocol="tcp" portid="10626"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1175. <port protocol="tcp" portid="14441"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1176. <port protocol="tcp" portid="16016"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1177. <port protocol="tcp" portid="16080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="osxwebadmin" method="table" conf="3"/></port>
  1178. <port protocol="tcp" portid="20828"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1179. <port protocol="tcp" portid="24800"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1180. <port protocol="tcp" portid="32768"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="filenet-tms" method="table" conf="3"/></port>
  1181. <port protocol="tcp" portid="32774"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sometimes-rpc11" method="table" conf="3"/></port>
  1182. <port protocol="tcp" portid="45100"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1183. <port protocol="tcp" portid="49400"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="compaqdiag" method="table" conf="3"/></port>
  1184. <port protocol="tcp" portid="51103"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1185. <port protocol="tcp" portid="57294"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1186. <port protocol="tcp" portid="63331"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1187. <port protocol="tcp" portid="65129"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1188. </ports>
  1189. <times srtt="337162" rttvar="4159" to="353798"/>
  1190. </host>
  1191. <host starttime="1606158576" endtime="1606161902"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1192. <address addr="204.16.247.89" addrtype="ipv4"/>
  1193. <hostnames>
  1194. </hostnames>
  1195. <ports><extraports state="closed" count="996">
  1196. <extrareasons reason="conn-refused" count="996"/>
  1197. </extraports>
  1198. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1199. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1200. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 204.16.247.89,/g.pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; LG; LG-E906)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1201. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1202. </ports>
  1203. <times srtt="143262" rttvar="1396" to="148846"/>
  1204. </host>
  1205. <taskprogress task="Connect Scan" time="1606163296" percent="41.31" remaining="1952" etc="1606165248"/>
  1206. <taskprogress task="Connect Scan" time="1606164697" percent="87.62" remaining="392" etc="1606165089"/>
  1207. <taskprogress task="Connect Scan" time="1606164869" percent="93.31" remaining="212" etc="1606165080"/>
  1208. <taskprogress task="NSE" time="1606165166" percent="57.55" remaining="22" etc="1606165187"/>
  1209. <taskprogress task="NSE" time="1606165188" percent="66.04" remaining="27" etc="1606165214"/>
  1210. <host starttime="1606158576" endtime="1606165145"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1211. <address addr="198.13.55.13" addrtype="ipv4"/>
  1212. <hostnames>
  1213. <hostname name="198.13.55.13.vultr.com" type="PTR"/>
  1214. </hostnames>
  1215. <ports><extraports state="closed" count="993">
  1216. <extrareasons reason="conn-refused" count="993"/>
  1217. </extraports>
  1218. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1219. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1220. <port protocol="tcp" portid="80"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  1221. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1222. <port protocol="tcp" portid="6666"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="irc" method="table" conf="3"/></port>
  1223. <port protocol="tcp" portid="12000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cce4x" method="table" conf="3"/></port>
  1224. <port protocol="tcp" portid="17877"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1225. </ports>
  1226. <times srtt="299754" rttvar="1109" to="304190"/>
  1227. </host>
  1228. <host starttime="1606158578" endtime="1606165248"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1229. <address addr="207.148.65.247" addrtype="ipv4"/>
  1230. <hostnames>
  1231. <hostname name="207.148.65.247.vultr.com" type="PTR"/>
  1232. </hostnames>
  1233. <ports><extraports state="closed" count="993">
  1234. <extrareasons reason="conn-refused" count="993"/>
  1235. </extraports>
  1236. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1237. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1238. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1239. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1240. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1241. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1242. <port protocol="tcp" portid="5988"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="wbem-http" method="table" conf="3"/></port>
  1243. </ports>
  1244. <times srtt="371732" rttvar="4630" to="390252"/>
  1245. </host>
  1246. <host starttime="1606158577" endtime="1606165272"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1247. <address addr="103.45.120.215" addrtype="ipv4"/>
  1248. <hostnames>
  1249. </hostnames>
  1250. <ports><extraports state="closed" count="983">
  1251. <extrareasons reason="conn-refused" count="983"/>
  1252. </extraports>
  1253. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1254. <port protocol="tcp" portid="83"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mit-ml-dev" method="table" conf="3"/></port>
  1255. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1256. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1257. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1258. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1259. <port protocol="tcp" portid="1025"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  1260. <port protocol="tcp" portid="1026"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="LSA-or-nterm" method="table" conf="3"/></port>
  1261. <port protocol="tcp" portid="1027"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="IIS" method="table" conf="3"/></port>
  1262. <port protocol="tcp" portid="1028"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1263. <port protocol="tcp" portid="1035"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="multidropper" method="table" conf="3"/></port>
  1264. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  1265. <port protocol="tcp" portid="1900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="upnp" method="table" conf="3"/></port>
  1266. <port protocol="tcp" portid="2222"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="EtherNetIP-1" method="table" conf="3"/></port>
  1267. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  1268. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8000&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 103.45.120.215,/__utm.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8000&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 103.45.120.215,/match&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1269. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1270. </ports>
  1271. <times srtt="394914" rttvar="2497" to="404902"/>
  1272. </host>
  1273. <host starttime="1606158577" endtime="1606165191"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1274. <address addr="172.241.29.155" addrtype="ipv4"/>
  1275. <hostnames>
  1276. </hostnames>
  1277. <ports><extraports state="closed" count="994">
  1278. <extrareasons reason="conn-refused" count="994"/>
  1279. </extraports>
  1280. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1281. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1282. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1283. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1284. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1285. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1286. </ports>
  1287. <times srtt="164278" rttvar="1234" to="169214"/>
  1288. </host>
  1289. <host starttime="1606158576" endtime="1606165172"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1290. <address addr="173.234.25.76" addrtype="ipv4"/>
  1291. <hostnames>
  1292. </hostnames>
  1293. <ports><extraports state="closed" count="995">
  1294. <extrareasons reason="conn-refused" count="995"/>
  1295. </extraports>
  1296. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1297. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 173.234.25.74,/fwlink,lousingloo.com,/g.pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 173.234.25.74,/match,lousingloo.com,/pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1298. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  1299. <port protocol="tcp" portid="1974"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="drp" method="table" conf="3"/></port>
  1300. <port protocol="tcp" portid="32778"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sometimes-rpc19" method="table" conf="3"/></port>
  1301. </ports>
  1302. <times srtt="190107" rttvar="845" to="193487"/>
  1303. </host>
  1304. <host starttime="1606158578" endtime="1606165209"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1305. <address addr="192.119.110.81" addrtype="ipv4"/>
  1306. <hostnames>
  1307. <hostname name="hwsrv-786620.hostwindsdns.com" type="PTR"/>
  1308. </hostnames>
  1309. <ports><extraports state="closed" count="991">
  1310. <extrareasons reason="conn-refused" count="991"/>
  1311. </extraports>
  1312. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1313. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1314. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.119.111.117,/cx&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.119.111.117,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1315. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  1316. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1317. <port protocol="tcp" portid="636"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldapssl" method="table" conf="3"/></port>
  1318. <port protocol="tcp" portid="801"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="device" method="table" conf="3"/></port>
  1319. <port protocol="tcp" portid="1201"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nucleus-sand" method="table" conf="3"/></port>
  1320. <port protocol="tcp" portid="10628"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1321. </ports>
  1322. <times srtt="217359" rttvar="1895" to="224939"/>
  1323. </host>
  1324. <host starttime="1606158577" endtime="1606165250"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1325. <address addr="172.104.9.181" addrtype="ipv4"/>
  1326. <hostnames>
  1327. <hostname name="li1744-181.members.linode.com" type="PTR"/>
  1328. </hostnames>
  1329. <ports><extraports state="filtered" count="998">
  1330. <extrareasons reason="no-responses" count="998"/>
  1331. </extraports>
  1332. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: www.immigrationstatus.net,/checkstatus/v1/,immigrationstatus.net,/checkstatus/v1/&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/18.177&#xa;HTTP Method Path 2: /checkstatus/v2/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: POST&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: www.immigrationstatus.net,/checkstatus/v1/,immigrationstatus.net,/checkstatus/v1/&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/18.177&#xa;HTTP Method Path 2: /checkstatus/v2/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: POST&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1333. <port protocol="tcp" portid="5000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="upnp" method="table" conf="3"/></port>
  1334. </ports>
  1335. <times srtt="139114" rttvar="979" to="143030"/>
  1336. </host>
  1337. <host starttime="1606158578" endtime="1606165191"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1338. <address addr="217.12.218.250" addrtype="ipv4"/>
  1339. <hostnames>
  1340. <hostname name="dedic-aprilim-640160.hosted-by-itldc.com" type="PTR"/>
  1341. </hostnames>
  1342. <ports><extraports state="closed" count="992">
  1343. <extrareasons reason="conn-refused" count="992"/>
  1344. </extraports>
  1345. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1346. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1347. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 35000&#xa;Jitter: 22&#xa;Maxdns: 245&#xa;C2 Server: 217.12.218.250,/questions/32251816/c-sharp-directives-compilation-error,zbfgns.xyz,/questions/32251816/c-sharp-directives-compilation-error&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36&#xa;HTTP Method Path 2: /questions/32251817/c-sharp-directives-compilation-error&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 35000&#xa;Jitter: 22&#xa;Maxdns: 245&#xa;C2 Server: 217.12.218.250,/questions/32251816/c-sharp-directives-compilation-error,zbfgns.xyz,/questions/32251816/c-sharp-directives-compilation-error&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36&#xa;HTTP Method Path 2: /questions/32251817/c-sharp-directives-compilation-error&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1348. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1349. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1350. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1351. <port protocol="tcp" portid="444"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="snpp" method="table" conf="3"/></port>
  1352. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1353. </ports>
  1354. <times srtt="219428" rttvar="894" to="223004"/>
  1355. </host>
  1356. <host starttime="1606158577" endtime="1606165255"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1357. <address addr="218.253.251.90" addrtype="ipv4"/>
  1358. <hostnames>
  1359. <hostname name="90.251-253-218-static.reserve.wtt.net.hk" type="PTR"/>
  1360. </hostnames>
  1361. <ports><extraports state="closed" count="992">
  1362. <extrareasons reason="conn-refused" count="992"/>
  1363. </extraports>
  1364. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1365. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1366. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 218.253.251.90,/g.pixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 218.253.251.90,/push&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1367. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  1368. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1369. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1370. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  1371. <port protocol="tcp" portid="8001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vcom-tunnel" method="table" conf="3"/></port>
  1372. </ports>
  1373. <times srtt="342481" rttvar="2896" to="354065"/>
  1374. </host>
  1375. <host starttime="1606158577" endtime="1606165203"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1376. <address addr="104.238.205.44" addrtype="ipv4"/>
  1377. <hostnames>
  1378. </hostnames>
  1379. <ports><extraports state="closed" count="996">
  1380. <extrareasons reason="conn-refused" count="996"/>
  1381. </extraports>
  1382. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1383. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1384. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1385. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1386. </ports>
  1387. <times srtt="158195" rttvar="1168" to="162867"/>
  1388. </host>
  1389. <host starttime="1606158576" endtime="1606165242"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1390. <address addr="185.144.100.29" addrtype="ipv4"/>
  1391. <hostnames>
  1392. <hostname name="29.100.144.185.baremetal.zare.com" type="PTR"/>
  1393. </hostnames>
  1394. <ports><extraports state="closed" count="995">
  1395. <extrareasons reason="conn-refused" count="995"/>
  1396. </extraports>
  1397. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1398. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1399. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1400. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1401. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1402. </ports>
  1403. <times srtt="214999" rttvar="470" to="216879"/>
  1404. </host>
  1405. <host starttime="1606158576" endtime="1606165248"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1406. <address addr="195.123.233.50" addrtype="ipv4"/>
  1407. <hostnames>
  1408. <hostname name="vds-634823.hosted-by-itldc.com" type="PTR"/>
  1409. </hostnames>
  1410. <ports><extraports state="closed" count="993">
  1411. <extrareasons reason="conn-refused" count="993"/>
  1412. </extraports>
  1413. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1414. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1415. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 195.123.233.50,/dpixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 195.123.233.50,/activity&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.2; Trident/4.0; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1416. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1417. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1418. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1419. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1420. </ports>
  1421. <times srtt="139283" rttvar="732" to="142211"/>
  1422. </host>
  1423. <host starttime="1606158578" endtime="1606165242"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1424. <address addr="185.136.159.207" addrtype="ipv4"/>
  1425. <hostnames>
  1426. </hostnames>
  1427. <ports><extraports state="closed" count="995">
  1428. <extrareasons reason="conn-refused" count="995"/>
  1429. </extraports>
  1430. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1431. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1432. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 30000&#xa;Jitter: 15&#xa;Maxdns: 255&#xa;C2 Server: www.stars-news.net,/update/RlskwN&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 10.0)&#xa;HTTP Method Path 2: /dounload/list&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1433. <port protocol="tcp" portid="617"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sco-dtmgr" method="table" conf="3"/></port>
  1434. <port protocol="tcp" portid="711"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cisco-tdp" method="table" conf="3"/></port>
  1435. </ports>
  1436. <times srtt="222791" rttvar="943" to="226563"/>
  1437. </host>
  1438. <host starttime="1606158578" endtime="1606165145"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1439. <address addr="202.182.125.249" addrtype="ipv4"/>
  1440. <hostnames>
  1441. <hostname name="202.182.125.249.vultr.com" type="PTR"/>
  1442. </hostnames>
  1443. <ports><extraports state="closed" count="994">
  1444. <extrareasons reason="conn-refused" count="994"/>
  1445. </extraports>
  1446. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1447. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1448. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1449. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1450. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1451. <port protocol="tcp" portid="1688"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nsjtp-data" method="table" conf="3"/></port>
  1452. </ports>
  1453. <times srtt="301002" rttvar="1364" to="306458"/>
  1454. </host>
  1455. <host starttime="1606158577" endtime="1606165239"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1456. <address addr="195.123.217.27" addrtype="ipv4"/>
  1457. <hostnames>
  1458. <hostname name="dedic-abrahome-646718.hosted-by-itldc.com" type="PTR"/>
  1459. </hostnames>
  1460. <ports><extraports state="closed" count="993">
  1461. <extrareasons reason="conn-refused" count="993"/>
  1462. </extraports>
  1463. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1464. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1465. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 35000&#xa;Jitter: 22&#xa;Maxdns: 245&#xa;C2 Server: 195.123.217.27,/questions/32251816/c-sharp-directives-compilation-error&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36&#xa;HTTP Method Path 2: /questions/32251817/c-sharp-directives-compilation-error&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 35000&#xa;Jitter: 22&#xa;Maxdns: 245&#xa;C2 Server: 195.123.217.27,/questions/32251816/c-sharp-directives-compilation-error&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36&#xa;HTTP Method Path 2: /questions/32251817/c-sharp-directives-compilation-error&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1466. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1467. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1468. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1469. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1470. </ports>
  1471. <times srtt="219259" rttvar="1236" to="224203"/>
  1472. </host>
  1473. <host starttime="1606158576" endtime="1606165252"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1474. <address addr="162.241.127.180" addrtype="ipv4"/>
  1475. <hostnames>
  1476. <hostname name="162-241-127-180.unifiedlayer.com" type="PTR"/>
  1477. </hostnames>
  1478. <ports><extraports state="closed" count="995">
  1479. <extrareasons reason="conn-refused" count="995"/>
  1480. </extraports>
  1481. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1482. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1483. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 162.241.127.180,/activity&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENCA)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1484. <port protocol="tcp" portid="2522"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="windb" method="table" conf="3"/></port>
  1485. <port protocol="tcp" portid="3269"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="globalcatLDAPssl" method="table" conf="3"/></port>
  1486. </ports>
  1487. <times srtt="162839" rttvar="837" to="166187"/>
  1488. </host>
  1489. <host starttime="1606158578" endtime="1606165248"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1490. <address addr="193.239.84.186" addrtype="ipv4"/>
  1491. <hostnames>
  1492. </hostnames>
  1493. <ports><extraports state="closed" count="992">
  1494. <extrareasons reason="conn-refused" count="992"/>
  1495. </extraports>
  1496. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1497. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1498. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1499. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1500. <port protocol="tcp" portid="1083"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ansoft-lm-1" method="table" conf="3"/></port>
  1501. <port protocol="tcp" portid="2525"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-v-worlds" method="table" conf="3"/></port>
  1502. <port protocol="tcp" portid="2967"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="symantec-av" method="table" conf="3"/></port>
  1503. <port protocol="tcp" portid="7402"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rtps-dd-mt" method="table" conf="3"/></port>
  1504. </ports>
  1505. <times srtt="216808" rttvar="862" to="220256"/>
  1506. </host>
  1507. <host starttime="1606158576" endtime="1606165192"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1508. <address addr="194.5.249.55" addrtype="ipv4"/>
  1509. <hostnames>
  1510. </hostnames>
  1511. <ports><extraports state="closed" count="996">
  1512. <extrareasons reason="conn-refused" count="996"/>
  1513. </extraports>
  1514. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1515. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 194.5.249.55,/dot.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENCA)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 194.5.249.55,/dpixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1516. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 194.5.249.55,/cx&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1517. <port protocol="tcp" portid="2522"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="windb" method="table" conf="3"/></port>
  1518. </ports>
  1519. <times srtt="253551" rttvar="3639" to="268107"/>
  1520. </host>
  1521. <host starttime="1606158577" endtime="1606165198"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1522. <address addr="192.119.111.117" addrtype="ipv4"/>
  1523. <hostnames>
  1524. <hostname name="client-192-119-111-117.hostwindsdns.com" type="PTR"/>
  1525. </hostnames>
  1526. <ports><extraports state="closed" count="994">
  1527. <extrareasons reason="conn-refused" count="994"/>
  1528. </extraports>
  1529. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1530. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1531. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.119.111.117,/cx&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.119.111.117,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1532. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  1533. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1534. <port protocol="tcp" portid="801"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="device" method="table" conf="3"/></port>
  1535. </ports>
  1536. <times srtt="218017" rttvar="1297" to="223205"/>
  1537. </host>
  1538. <host starttime="1606158577" endtime="1606165248"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1539. <address addr="195.123.239.142" addrtype="ipv4"/>
  1540. <hostnames>
  1541. <hostname name="vps.ss" type="PTR"/>
  1542. </hostnames>
  1543. <ports><extraports state="closed" count="990">
  1544. <extrareasons reason="conn-refused" count="990"/>
  1545. </extraports>
  1546. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1547. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1548. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1549. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1550. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 195.123.239.142,/cm&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1551. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1552. <port protocol="tcp" portid="808"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ccproxy-http" method="table" conf="3"/></port>
  1553. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1554. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  1555. <port protocol="tcp" portid="9000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cslistener" method="table" conf="3"/></port>
  1556. </ports>
  1557. <times srtt="358580" rttvar="2514" to="368636"/>
  1558. </host>
  1559. <host starttime="1606158576" endtime="1606165209"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1560. <address addr="207.219.199.120" addrtype="ipv4"/>
  1561. <hostnames>
  1562. </hostnames>
  1563. <ports><extraports state="filtered" count="994">
  1564. <extrareasons reason="no-responses" count="994"/>
  1565. </extraports>
  1566. <port protocol="tcp" portid="25"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  1567. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: s3app.eastus.cloudapp.azure.com,/iconpage.gif,azurecloudapi.eastus.cloudapp.azure.com,/iconpage.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; Touch; MASPJS)&#xa;HTTP Method Path 2: /iconimage.gif&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: s3app.eastus.cloudapp.azure.com,/iconpage.gif,azurecloudapi.eastus.cloudapp.azure.com,/iconpage.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSE)&#xa;HTTP Method Path 2: /iconimage.gif&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1568. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1569. <port protocol="tcp" portid="587"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="submission" method="table" conf="3"/></port>
  1570. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  1571. <port protocol="tcp" portid="8443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/></port>
  1572. </ports>
  1573. <times srtt="155990" rttvar="588" to="158342"/>
  1574. </host>
  1575. <host starttime="1606158576" endtime="1606165166"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1576. <address addr="173.234.155.54" addrtype="ipv4"/>
  1577. <hostnames>
  1578. </hostnames>
  1579. <ports><extraports state="closed" count="992">
  1580. <extrareasons reason="conn-refused" count="992"/>
  1581. </extraports>
  1582. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1583. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1584. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1585. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1586. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: img.intactlinks.com,/fwlink,print.intactlinks.com,/cx&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; ; NCLIENT50_AAPCDA5841E333)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1587. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1588. <port protocol="tcp" portid="1067"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="instl_boots" method="table" conf="3"/></port>
  1589. <port protocol="tcp" portid="8083"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="us-srv" method="table" conf="3"/></port>
  1590. </ports>
  1591. <times srtt="139444" rttvar="1025" to="143544"/>
  1592. </host>
  1593. <host starttime="1606158576" endtime="1606165252"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1594. <address addr="202.61.87.136" addrtype="ipv4"/>
  1595. <hostnames>
  1596. </hostnames>
  1597. <ports><extraports state="closed" count="987">
  1598. <extrareasons reason="conn-refused" count="987"/>
  1599. </extraports>
  1600. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1601. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  1602. <port protocol="tcp" portid="109"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop2" method="table" conf="3"/></port>
  1603. <port protocol="tcp" portid="110"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop3" method="table" conf="3"/></port>
  1604. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1605. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1606. <port protocol="tcp" portid="143"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="imap" method="table" conf="3"/></port>
  1607. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1608. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1609. <port protocol="tcp" portid="465"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  1610. <port protocol="tcp" portid="587"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="submission" method="table" conf="3"/></port>
  1611. <port protocol="tcp" portid="993"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="imaps" method="table" conf="3"/></port>
  1612. <port protocol="tcp" portid="995"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop3s" method="table" conf="3"/></port>
  1613. </ports>
  1614. <times srtt="356945" rttvar="2811" to="368189"/>
  1615. </host>
  1616. <host starttime="1606158578" endtime="1606165242"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1617. <address addr="212.129.150.253" addrtype="ipv4"/>
  1618. <hostnames>
  1619. </hostnames>
  1620. <ports><extraports state="closed" count="984">
  1621. <extrareasons reason="conn-refused" count="984"/>
  1622. </extraports>
  1623. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1624. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  1625. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1626. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1627. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1628. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1629. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1630. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1631. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  1632. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  1633. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  1634. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  1635. <port protocol="tcp" portid="1521"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="oracle" method="table" conf="3"/></port>
  1636. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  1637. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  1638. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  1639. </ports>
  1640. <times srtt="326809" rttvar="787" to="329957"/>
  1641. </host>
  1642. <host starttime="1606158576" endtime="1606165200"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1643. <address addr="211.149.143.218" addrtype="ipv4"/>
  1644. <hostnames>
  1645. </hostnames>
  1646. <ports><extraports state="closed" count="992">
  1647. <extrareasons reason="conn-refused" count="992"/>
  1648. </extraports>
  1649. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  1650. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1651. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1652. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1653. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1654. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1655. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8000&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 211.149.143.218,/push&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727; 360space)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8000&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 211.149.143.218,/cx&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; LEN2)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1656. <port protocol="tcp" portid="8994"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1657. </ports>
  1658. <times srtt="387166" rttvar="4667" to="405834"/>
  1659. </host>
  1660. <host starttime="1606158576" endtime="1606165256"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1661. <address addr="207.148.70.82" addrtype="ipv4"/>
  1662. <hostnames>
  1663. <hostname name="207.148.70.82.vultr.com" type="PTR"/>
  1664. </hostnames>
  1665. <ports><extraports state="closed" count="992">
  1666. <extrareasons reason="conn-refused" count="992"/>
  1667. </extraports>
  1668. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  1669. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1670. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1671. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1672. <port protocol="tcp" portid="1688"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nsjtp-data" method="table" conf="3"/></port>
  1673. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1674. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  1675. <port protocol="tcp" portid="8082"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-alerts" method="table" conf="3"/></port>
  1676. </ports>
  1677. <times srtt="364516" rttvar="6367" to="389984"/>
  1678. </host>
  1679. <host starttime="1606158577" endtime="1606165252"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1680. <address addr="211.49.225.208" addrtype="ipv4"/>
  1681. <hostnames>
  1682. </hostnames>
  1683. <ports><extraports state="closed" count="994">
  1684. <extrareasons reason="conn-refused" count="994"/>
  1685. </extraports>
  1686. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1687. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1688. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1689. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1690. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1691. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1692. </ports>
  1693. <times srtt="335328" rttvar="4739" to="354284"/>
  1694. </host>
  1695. <host starttime="1606158577" endtime="1606165203"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1696. <address addr="202.182.101.162" addrtype="ipv4"/>
  1697. <hostnames>
  1698. <hostname name="202.182.101.162.vultr.com" type="PTR"/>
  1699. </hostnames>
  1700. <ports><extraports state="closed" count="993">
  1701. <extrareasons reason="conn-refused" count="993"/>
  1702. </extraports>
  1703. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1704. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1705. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1706. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1707. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 202.182.101.162,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MANM)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1708. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1709. <port protocol="tcp" portid="981"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1710. </ports>
  1711. <times srtt="300809" rttvar="686" to="303553"/>
  1712. </host>
  1713. <host starttime="1606158576" endtime="1606165145"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1714. <address addr="172.105.118.92" addrtype="ipv4"/>
  1715. <hostnames>
  1716. <hostname name="li2011-92.members.linode.com" type="PTR"/>
  1717. </hostnames>
  1718. <ports><extraports state="filtered" count="993">
  1719. <extrareasons reason="no-responses" count="993"/>
  1720. </extraports>
  1721. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1722. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1723. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  1724. <port protocol="tcp" portid="110"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="pop3" method="table" conf="3"/></port>
  1725. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1726. <port protocol="tcp" portid="993"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="imaps" method="table" conf="3"/></port>
  1727. <port protocol="tcp" portid="995"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="pop3s" method="table" conf="3"/></port>
  1728. </ports>
  1729. <times srtt="372743" rttvar="2247" to="381731"/>
  1730. </host>
  1731. <host starttime="1606158577" endtime="1606165202"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1732. <address addr="172.98.192.94" addrtype="ipv4"/>
  1733. <hostnames>
  1734. </hostnames>
  1735. <ports><extraports state="closed" count="992">
  1736. <extrareasons reason="conn-refused" count="992"/>
  1737. </extraports>
  1738. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1739. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1740. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1741. <port protocol="tcp" portid="2522"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="windb" method="table" conf="3"/></port>
  1742. <port protocol="tcp" portid="3527"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="beserver-msg-q" method="table" conf="3"/></port>
  1743. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1744. <port protocol="tcp" portid="8181"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="intermapper" method="table" conf="3"/></port>
  1745. <port protocol="tcp" portid="8383"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="m2mservices" method="table" conf="3"/></port>
  1746. </ports>
  1747. <times srtt="153051" rttvar="1466" to="158915"/>
  1748. </host>
  1749. <host starttime="1606158576" endtime="1606165202"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1750. <address addr="182.92.122.148" addrtype="ipv4"/>
  1751. <hostnames>
  1752. </hostnames>
  1753. <ports><extraports state="filtered" count="993">
  1754. <extrareasons reason="no-responses" count="993"/>
  1755. </extraports>
  1756. <port protocol="tcp" portid="22"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1757. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1758. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1759. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1760. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  1761. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  1762. <port protocol="tcp" portid="8888"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  1763. </ports>
  1764. <times srtt="355982" rttvar="3206" to="368806"/>
  1765. </host>
  1766. <host starttime="1606158576" endtime="1606165190"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1767. <address addr="195.123.217.7" addrtype="ipv4"/>
  1768. <hostnames>
  1769. <hostname name="dedic-umabenenein-650629.hosted-by-itldc.com" type="PTR"/>
  1770. </hostnames>
  1771. <ports><extraports state="closed" count="993">
  1772. <extrareasons reason="conn-refused" count="993"/>
  1773. </extraports>
  1774. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1775. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1776. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 195.123.217.7,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,yten.xyz,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 195.123.217.7,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,yten.xyz,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1777. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1778. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1779. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 195.123.217.7,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books,yten.xyz,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1780. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1781. </ports>
  1782. <times srtt="218339" rttvar="809" to="221575"/>
  1783. </host>
  1784. <host starttime="1606158576" endtime="1606165178"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1785. <address addr="185.162.235.61" addrtype="ipv4"/>
  1786. <hostnames>
  1787. <hostname name="nl.dnsme.in" type="PTR"/>
  1788. </hostnames>
  1789. <ports><extraports state="closed" count="994">
  1790. <extrareasons reason="conn-refused" count="994"/>
  1791. </extraports>
  1792. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1793. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.162.235.61,/j.ad&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; Avant Browser)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1794. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1795. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.162.235.61,/visit.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MATM)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 185.162.235.61,/en_US/all.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; LBBROWSER)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1796. <port protocol="tcp" portid="445"><state state="filtered" reason="host-unreach" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1797. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  1798. </ports>
  1799. <times srtt="219525" rttvar="799" to="222721"/>
  1800. </host>
  1801. <host starttime="1606158577" endtime="1606165233"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1802. <address addr="198.44.97.180" addrtype="ipv4"/>
  1803. <hostnames>
  1804. <hostname name="client-198-44-97-180.hostwindsdns.com" type="PTR"/>
  1805. </hostnames>
  1806. <ports><extraports state="closed" count="994">
  1807. <extrareasons reason="conn-refused" count="994"/>
  1808. </extraports>
  1809. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1810. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1811. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 198.44.97.180,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 198.44.97.180,/pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1812. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  1813. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1814. <port protocol="tcp" portid="1234"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="hotline" method="table" conf="3"/></port>
  1815. </ports>
  1816. <times srtt="215582" rttvar="1454" to="221398"/>
  1817. </host>
  1818. <host starttime="1606158577" endtime="1606165214"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1819. <address addr="193.34.166.207" addrtype="ipv4"/>
  1820. <hostnames>
  1821. <hostname name="dns.timesyncad.com" type="PTR"/>
  1822. </hostnames>
  1823. <ports><extraports state="filtered" count="997">
  1824. <extrareasons reason="no-responses" count="997"/>
  1825. </extraports>
  1826. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1827. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: timesyncad.com,/ga.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;PTBR)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: timesyncad.com,/match&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1828. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: timesyncad.com,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MAAU; NP08)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1829. </ports>
  1830. <times srtt="209020" rttvar="808" to="212252"/>
  1831. </host>
  1832. <host starttime="1606158576" endtime="1606165145"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1833. <address addr="193.112.10.125" addrtype="ipv4"/>
  1834. <hostnames>
  1835. </hostnames>
  1836. <ports><extraports state="closed" count="995">
  1837. <extrareasons reason="conn-refused" count="995"/>
  1838. </extraports>
  1839. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1840. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1841. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1842. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1843. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  1844. </ports>
  1845. <times srtt="361232" rttvar="2996" to="373216"/>
  1846. </host>
  1847. <host starttime="1606158576" endtime="1606165248"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1848. <address addr="178.79.134.144" addrtype="ipv4"/>
  1849. <hostnames>
  1850. <hostname name="li190-144.members.linode.com" type="PTR"/>
  1851. </hostnames>
  1852. <ports><extraports state="closed" count="995">
  1853. <extrareasons reason="conn-refused" count="995"/>
  1854. </extraports>
  1855. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1856. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1857. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 178.79.134.144,/idle/1376547834/1&#xa;User Agent: Shockwave Flash&#xa;HTTP Method Path 2: /send/1376547834/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 1 (Use direct connection)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 178.79.134.144,/idle/1376547834/1&#xa;User Agent: Shockwave Flash&#xa;HTTP Method Path 2: /send/1376547834/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 1 (Use direct connection)&#xa;&#xa;"/></port>
  1858. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1859. <port protocol="tcp" portid="4443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="pharos" method="table" conf="3"/></port>
  1860. </ports>
  1861. <times srtt="210835" rttvar="1066" to="215099"/>
  1862. </host>
  1863. <host starttime="1606158577" endtime="1606165203"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1864. <address addr="193.168.147.249" addrtype="ipv4"/>
  1865. <hostnames>
  1866. </hostnames>
  1867. <ports><extraports state="closed" count="996">
  1868. <extrareasons reason="conn-refused" count="996"/>
  1869. </extraports>
  1870. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1871. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1872. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1873. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: mesteratosr.me,/api&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0&#xa;HTTP Method Path 2: /lowpacket/mt.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1874. </ports>
  1875. <times srtt="251929" rttvar="41034" to="416065"/>
  1876. </host>
  1877. <host starttime="1606158577" endtime="1606165260"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1878. <address addr="176.121.14.229" addrtype="ipv4"/>
  1879. <hostnames>
  1880. <hostname name="ns1648.ztomy.com" type="PTR"/>
  1881. </hostnames>
  1882. <ports><extraports state="closed" count="994">
  1883. <extrareasons reason="conn-refused" count="994"/>
  1884. </extraports>
  1885. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1886. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 176.121.14.229,/__utm.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 176.121.14.229,/activity&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MAAU; NP08)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1887. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 176.121.14.229,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MANM)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1888. <port protocol="tcp" portid="8500"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="fmtp" method="table" conf="3"/></port>
  1889. <port protocol="tcp" portid="9002"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="dynamid" method="table" conf="3"/></port>
  1890. <port protocol="tcp" portid="21571"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1891. </ports>
  1892. <times srtt="245347" rttvar="642" to="247915"/>
  1893. </host>
  1894. <host starttime="1606158577" endtime="1606165246"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1895. <address addr="193.34.166.73" addrtype="ipv4"/>
  1896. <hostnames>
  1897. <hostname name="dns.servupdates.com" type="PTR"/>
  1898. </hostnames>
  1899. <ports><extraports state="filtered" count="997">
  1900. <extrareasons reason="no-responses" count="997"/>
  1901. </extraports>
  1902. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1903. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: servupdates.com,/ga.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: servupdates.com,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1904. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: servupdates.com,/ca&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MANM)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1905. </ports>
  1906. <times srtt="209112" rttvar="611" to="211556"/>
  1907. </host>
  1908. <host starttime="1606158576" endtime="1606165226"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1909. <address addr="192.119.111.155" addrtype="ipv4"/>
  1910. <hostnames>
  1911. <hostname name="client-192-119-111-155.hostwindsdns.com" type="PTR"/>
  1912. </hostnames>
  1913. <ports><extraports state="closed" count="994">
  1914. <extrareasons reason="conn-refused" count="994"/>
  1915. </extraports>
  1916. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1917. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1918. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.119.111.117,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1919. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  1920. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1921. <port protocol="tcp" portid="801"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="device" method="table" conf="3"/></port>
  1922. </ports>
  1923. <times srtt="218108" rttvar="1313" to="223360"/>
  1924. </host>
  1925. <host starttime="1606158577" endtime="1606165229"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1926. <address addr="172.98.192.91" addrtype="ipv4"/>
  1927. <hostnames>
  1928. </hostnames>
  1929. <ports><extraports state="closed" count="992">
  1930. <extrareasons reason="conn-refused" count="992"/>
  1931. </extraports>
  1932. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1933. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1934. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 172.98.192.91,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  1935. <port protocol="tcp" portid="1187"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="alias" method="table" conf="3"/></port>
  1936. <port protocol="tcp" portid="1309"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="jtag-server" method="table" conf="3"/></port>
  1937. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  1938. <port protocol="tcp" portid="27715"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1939. <port protocol="tcp" portid="33899"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  1940. </ports>
  1941. <times srtt="153691" rttvar="1642" to="160259"/>
  1942. </host>
  1943. <host starttime="1606158577" endtime="1606165214"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1944. <address addr="178.162.199.36" addrtype="ipv4"/>
  1945. <hostnames>
  1946. </hostnames>
  1947. <ports><extraports state="closed" count="995">
  1948. <extrareasons reason="conn-refused" count="995"/>
  1949. </extraports>
  1950. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1951. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  1952. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1953. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1954. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  1955. </ports>
  1956. <times srtt="221767" rttvar="1710" to="228607"/>
  1957. </host>
  1958. <host starttime="1606158577" endtime="1606165253"><status state="up" reason="conn-refused" reason_ttl="0"/>
  1959. <address addr="188.119.113.24" addrtype="ipv4"/>
  1960. <hostnames>
  1961. <hostname name="anitaaseva.example.com" type="PTR"/>
  1962. </hostnames>
  1963. <ports><extraports state="closed" count="996">
  1964. <extrareasons reason="conn-refused" count="996"/>
  1965. </extraports>
  1966. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1967. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1968. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  1969. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1970. </ports>
  1971. <times srtt="220606" rttvar="1525" to="226706"/>
  1972. </host>
  1973. <host starttime="1606158576" endtime="1606165223"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1974. <address addr="182.92.120.156" addrtype="ipv4"/>
  1975. <hostnames>
  1976. </hostnames>
  1977. <ports><extraports state="filtered" count="952">
  1978. <extrareasons reason="no-responses" count="952"/>
  1979. </extraports>
  1980. <extraports state="closed" count="44">
  1981. <extrareasons reason="conn-refused" count="44"/>
  1982. </extraports>
  1983. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1984. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1985. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  1986. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  1987. </ports>
  1988. <times srtt="349593" rttvar="2226" to="358497"/>
  1989. </host>
  1990. <host starttime="1606158576" endtime="1606165221"><status state="up" reason="syn-ack" reason_ttl="0"/>
  1991. <address addr="159.65.115.160" addrtype="ipv4"/>
  1992. <hostnames>
  1993. </hostnames>
  1994. <ports><extraports state="filtered" count="996">
  1995. <extrareasons reason="no-responses" count="996"/>
  1996. </extraports>
  1997. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  1998. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  1999. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2000. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2001. </ports>
  2002. <times srtt="289847" rttvar="2126" to="298351"/>
  2003. </host>
  2004. <host starttime="1606158578" endtime="1606165216"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2005. <address addr="104.236.172.121" addrtype="ipv4"/>
  2006. <hostnames>
  2007. <hostname name="n00she.com" type="PTR"/>
  2008. </hostnames>
  2009. <ports><extraports state="filtered" count="988">
  2010. <extrareasons reason="no-responses" count="988"/>
  2011. </extraports>
  2012. <port protocol="tcp" portid="20"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ftp-data" method="table" conf="3"/></port>
  2013. <port protocol="tcp" portid="21"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  2014. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2015. <port protocol="tcp" portid="25"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  2016. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2017. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2018. <port protocol="tcp" portid="4444"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  2019. <port protocol="tcp" portid="4445"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="upnotifyp" method="table" conf="3"/></port>
  2020. <port protocol="tcp" portid="4446"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="n1-fwp" method="table" conf="3"/></port>
  2021. <port protocol="tcp" portid="5432"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="postgresql" method="table" conf="3"/></port>
  2022. <port protocol="tcp" portid="8000"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/></port>
  2023. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2024. </ports>
  2025. <times srtt="208562" rttvar="1678" to="215274"/>
  2026. </host>
  2027. <host starttime="1606158576" endtime="1606165221"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2028. <address addr="45.33.27.73" addrtype="ipv4"/>
  2029. <hostnames>
  2030. <hostname name="li981-73.members.linode.com" type="PTR"/>
  2031. </hostnames>
  2032. <ports><extraports state="filtered" count="998">
  2033. <extrareasons reason="no-responses" count="998"/>
  2034. </extraports>
  2035. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.33.27.73,/cx&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.33.27.73,/push&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2036. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2037. </ports>
  2038. <times srtt="164671" rttvar="1194" to="169447"/>
  2039. </host>
  2040. <host starttime="1606158576" endtime="1606165191"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2041. <address addr="157.230.184.142" addrtype="ipv4"/>
  2042. <hostnames>
  2043. </hostnames>
  2044. <ports><extraports state="closed" count="996">
  2045. <extrareasons reason="conn-refused" count="996"/>
  2046. </extraports>
  2047. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2048. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2049. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2050. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2051. </ports>
  2052. <times srtt="138407" rttvar="1004" to="142423"/>
  2053. </host>
  2054. <host starttime="1606158577" endtime="1606165220"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2055. <address addr="151.106.56.187" addrtype="ipv4"/>
  2056. <hostnames>
  2057. </hostnames>
  2058. <ports><extraports state="closed" count="993">
  2059. <extrareasons reason="conn-refused" count="993"/>
  2060. </extraports>
  2061. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2062. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2063. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2064. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2065. <port protocol="tcp" portid="2111"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="kx" method="table" conf="3"/></port>
  2066. <port protocol="tcp" portid="5987"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="wbem-rmi" method="table" conf="3"/></port>
  2067. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2068. </ports>
  2069. <times srtt="223628" rttvar="1392" to="229196"/>
  2070. </host>
  2071. <host starttime="1606158577" endtime="1606165226"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2072. <address addr="176.119.29.71" addrtype="ipv4"/>
  2073. <hostnames>
  2074. <hostname name="dedicated.vsys.host" type="PTR"/>
  2075. </hostnames>
  2076. <ports><extraports state="closed" count="994">
  2077. <extrareasons reason="conn-refused" count="994"/>
  2078. </extraports>
  2079. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2080. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2081. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 176.119.29.71,/pixel.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; LG; LG-E906)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 176.119.29.71,/ca&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2082. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2083. <port protocol="tcp" portid="12345"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbus" method="table" conf="3"/></port>
  2084. <port protocol="tcp" portid="16992"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="amt-soap-http" method="table" conf="3"/></port>
  2085. </ports>
  2086. <times srtt="225560" rttvar="4886" to="245104"/>
  2087. </host>
  2088. <host starttime="1606158577" endtime="1606165209"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2089. <address addr="176.121.14.251" addrtype="ipv4"/>
  2090. <hostnames>
  2091. <hostname name="ns1648.ztomy.com" type="PTR"/>
  2092. </hostnames>
  2093. <ports><extraports state="closed" count="998">
  2094. <extrareasons reason="conn-refused" count="998"/>
  2095. </extraports>
  2096. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2097. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2098. </ports>
  2099. <times srtt="258044" rttvar="22165" to="346704"/>
  2100. </host>
  2101. <host starttime="1606158576" endtime="1606165194"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2102. <address addr="168.119.82.216" addrtype="ipv4"/>
  2103. <hostnames>
  2104. <hostname name="static.216.82.119.168.clients.your-server.de" type="PTR"/>
  2105. </hostnames>
  2106. <ports><extraports state="closed" count="994">
  2107. <extrareasons reason="conn-refused" count="994"/>
  2108. </extraports>
  2109. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2110. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2111. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 168.119.82.216,/pixel.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENIN)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 168.119.82.216,/load&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; Touch)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2112. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  2113. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2114. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  2115. </ports>
  2116. <times srtt="227120" rttvar="2400" to="236720"/>
  2117. </host>
  2118. <host starttime="1606158577" endtime="1606165209"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2119. <address addr="167.179.66.246" addrtype="ipv4"/>
  2120. <hostnames>
  2121. <hostname name="167.179.66.246.vultr.com" type="PTR"/>
  2122. </hostnames>
  2123. <ports><extraports state="closed" count="992">
  2124. <extrareasons reason="conn-refused" count="992"/>
  2125. </extraports>
  2126. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2127. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2128. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2129. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2130. <port protocol="tcp" portid="2522"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="windb" method="table" conf="3"/></port>
  2131. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  2132. <port protocol="tcp" portid="9090"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="zeus-admin" method="table" conf="3"/></port>
  2133. <port protocol="tcp" portid="9999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="abyss" method="table" conf="3"/></port>
  2134. </ports>
  2135. <times srtt="301370" rttvar="1073" to="305662"/>
  2136. </host>
  2137. <host starttime="1606158577" endtime="1606165212"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2138. <address addr="47.104.143.234" addrtype="ipv4"/>
  2139. <hostnames>
  2140. </hostnames>
  2141. <ports><extraports state="closed" count="984">
  2142. <extrareasons reason="conn-refused" count="984"/>
  2143. </extraports>
  2144. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2145. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2146. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2147. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  2148. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2149. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2150. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2151. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  2152. <port protocol="tcp" portid="1011"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2153. <port protocol="tcp" portid="1433"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-sql-s" method="table" conf="3"/></port>
  2154. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  2155. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  2156. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  2157. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2158. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  2159. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2160. </ports>
  2161. <times srtt="369920" rttvar="1683" to="376652"/>
  2162. </host>
  2163. <host starttime="1606158577" endtime="1606165207"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2164. <address addr="161.35.218.255" addrtype="ipv4"/>
  2165. <hostnames>
  2166. </hostnames>
  2167. <ports><extraports state="closed" count="997">
  2168. <extrareasons reason="conn-refused" count="997"/>
  2169. </extraports>
  2170. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2171. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2172. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 161.35.218.255,/updates.rss&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2173. </ports>
  2174. <times srtt="224130" rttvar="2394" to="233706"/>
  2175. </host>
  2176. <host starttime="1606158577" endtime="1606165216"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2177. <address addr="168.119.0.88" addrtype="ipv4"/>
  2178. <hostnames>
  2179. <hostname name="static.88.0.119.168.clients.your-server.de" type="PTR"/>
  2180. </hostnames>
  2181. <ports><extraports state="closed" count="997">
  2182. <extrareasons reason="conn-refused" count="997"/>
  2183. </extraports>
  2184. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2185. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2186. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2187. </ports>
  2188. <times srtt="228117" rttvar="4037" to="244265"/>
  2189. </host>
  2190. <host starttime="1606158576" endtime="1606165166"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2191. <address addr="104.247.196.106" addrtype="ipv4"/>
  2192. <hostnames>
  2193. </hostnames>
  2194. <ports><extraports state="closed" count="993">
  2195. <extrareasons reason="conn-refused" count="993"/>
  2196. </extraports>
  2197. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2198. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2199. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2200. <port protocol="tcp" portid="2049"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nfs" method="table" conf="3"/></port>
  2201. <port protocol="tcp" portid="3814"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="neto-dcs" method="table" conf="3"/></port>
  2202. <port protocol="tcp" portid="5440"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2203. <port protocol="tcp" portid="6667"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="irc" method="table" conf="3"/></port>
  2204. </ports>
  2205. <times srtt="199102" rttvar="1479" to="205018"/>
  2206. </host>
  2207. <host starttime="1606158577" endtime="1606165145"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2208. <address addr="167.88.125.73" addrtype="ipv4"/>
  2209. <hostnames>
  2210. </hostnames>
  2211. <ports><extraports state="closed" count="991">
  2212. <extrareasons reason="conn-refused" count="991"/>
  2213. </extraports>
  2214. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2215. <port protocol="tcp" portid="25"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  2216. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2217. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  2218. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2219. <port protocol="tcp" portid="1028"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2220. <port protocol="tcp" portid="1096"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cnrprotocol" method="table" conf="3"/></port>
  2221. <port protocol="tcp" portid="1213"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="mpc-lifenet" method="table" conf="3"/></port>
  2222. <port protocol="tcp" portid="8084"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2223. </ports>
  2224. <times srtt="196105" rttvar="948" to="199897"/>
  2225. </host>
  2226. <host starttime="1606158577" endtime="1606165196"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2227. <address addr="176.121.14.249" addrtype="ipv4"/>
  2228. <hostnames>
  2229. <hostname name="ns1648.ztomy.com" type="PTR"/>
  2230. </hostnames>
  2231. <ports><extraports state="closed" count="990">
  2232. <extrareasons reason="conn-refused" count="990"/>
  2233. </extraports>
  2234. <port protocol="tcp" portid="1"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="tcpmux" method="table" conf="3"/></port>
  2235. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2236. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 176.121.14.249,/pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0; Touch)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 176.121.14.249,/dot.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2237. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 176.121.14.249,/j.ad&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; SV1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2238. <port protocol="tcp" portid="981"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2239. <port protocol="tcp" portid="1201"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nucleus-sand" method="table" conf="3"/></port>
  2240. <port protocol="tcp" portid="2022"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="down" method="table" conf="3"/></port>
  2241. <port protocol="tcp" portid="2809"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="corbaloc" method="table" conf="3"/></port>
  2242. <port protocol="tcp" portid="3128"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  2243. <port protocol="tcp" portid="24800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2244. </ports>
  2245. <times srtt="246356" rttvar="1982" to="254284"/>
  2246. </host>
  2247. <host starttime="1606158576" endtime="1606165173"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2248. <address addr="169.61.11.75" addrtype="ipv4"/>
  2249. <hostnames>
  2250. <hostname name="4b.0b.3da9.ip4.static.sl-reverse.com" type="PTR"/>
  2251. </hostnames>
  2252. <ports><extraports state="closed" count="994">
  2253. <extrareasons reason="conn-refused" count="994"/>
  2254. </extraports>
  2255. <port protocol="tcp" portid="19"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="chargen" method="table" conf="3"/></port>
  2256. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2257. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2258. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2259. <port protocol="tcp" portid="1083"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ansoft-lm-1" method="table" conf="3"/></port>
  2260. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2261. </ports>
  2262. <times srtt="160782" rttvar="1208" to="165614"/>
  2263. </host>
  2264. <host starttime="1606158577" endtime="1606165145"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2265. <address addr="103.45.98.227" addrtype="ipv4"/>
  2266. <hostnames>
  2267. </hostnames>
  2268. <ports><extraports state="closed" count="992">
  2269. <extrareasons reason="conn-refused" count="992"/>
  2270. </extraports>
  2271. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2272. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2273. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  2274. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2275. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2276. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2277. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  2278. <port protocol="tcp" portid="1900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="upnp" method="table" conf="3"/></port>
  2279. </ports>
  2280. <times srtt="399857" rttvar="6039" to="424013"/>
  2281. </host>
  2282. <host starttime="1606158576" endtime="1606165241"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2283. <address addr="173.234.25.78" addrtype="ipv4"/>
  2284. <hostnames>
  2285. </hostnames>
  2286. <ports><extraports state="closed" count="997">
  2287. <extrareasons reason="conn-refused" count="997"/>
  2288. </extraports>
  2289. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2290. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 173.234.25.74,/fwlink,lousingloo.com,/g.pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 173.234.25.74,/match,lousingloo.com,/pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2291. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  2292. </ports>
  2293. <times srtt="190036" rttvar="635" to="192576"/>
  2294. </host>
  2295. <host starttime="1606158578" endtime="1606165233"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2296. <address addr="103.253.43.98" addrtype="ipv4"/>
  2297. <hostnames>
  2298. <hostname name="mail43098.app3.wd-clothing.com" type="PTR"/>
  2299. </hostnames>
  2300. <ports><extraports state="closed" count="996">
  2301. <extrareasons reason="conn-refused" count="996"/>
  2302. </extraports>
  2303. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2304. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2305. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2306. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2307. </ports>
  2308. <times srtt="434107" rttvar="2006" to="442131"/>
  2309. </host>
  2310. <taskprogress task="Connect Scan" time="1606165501" percent="8.63" remaining="2424" etc="1606167924"/>
  2311. <taskprogress task="Connect Scan" time="1606165888" percent="20.55" remaining="2382" etc="1606168269"/>
  2312. <taskprogress task="Connect Scan" time="1606167493" percent="70.79" remaining="917" etc="1606168409"/>
  2313. <taskprogress task="NSE" time="1606168668" percent="84.51" remaining="7" etc="1606168675"/>
  2314. <host starttime="1606158577" endtime="1606168666"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2315. <address addr="45.61.136.65" addrtype="ipv4"/>
  2316. <hostnames>
  2317. </hostnames>
  2318. <ports><extraports state="filtered" count="997">
  2319. <extrareasons reason="no-responses" count="997"/>
  2320. </extraports>
  2321. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2322. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 37500&#xa;Jitter: 33&#xa;Maxdns: 245&#xa;C2 Server: 45.79.72.33,/auto.cfg.bat&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729&#xa;HTTP Method Path 2: /html&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 37500&#xa;Jitter: 33&#xa;Maxdns: 245&#xa;C2 Server: 45.79.72.33,/auto.cfg.bat&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729&#xa;HTTP Method Path 2: /html&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2323. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2324. </ports>
  2325. <times srtt="199858" rttvar="1209" to="204694"/>
  2326. </host>
  2327. <host starttime="1606158576" endtime="1606168669"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2328. <address addr="167.99.200.45" addrtype="ipv4"/>
  2329. <hostnames>
  2330. </hostnames>
  2331. <ports><extraports state="closed" count="996">
  2332. <extrareasons reason="conn-refused" count="996"/>
  2333. </extraports>
  2334. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2335. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 30000&#xa;Jitter: 20&#xa;Maxdns: 235&#xa;C2 Server: outlook-1.azureedge.net,/static/css/main.d22d3525.chunk.css&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36&#xa;HTTP Method Path 2: /owamail/calendar/service.svc&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: &#xd;Z\xD5\xCC&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2336. <port protocol="tcp" portid="1077"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="imgames" method="table" conf="3"/></port>
  2337. <port protocol="tcp" portid="9003"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2338. </ports>
  2339. <times srtt="217061" rttvar="7429" to="246777"/>
  2340. </host>
  2341. <host starttime="1606158576" endtime="1606168675"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2342. <address addr="156.255.2.36" addrtype="ipv4"/>
  2343. <hostnames>
  2344. </hostnames>
  2345. <ports><extraports state="closed" count="992">
  2346. <extrareasons reason="conn-refused" count="992"/>
  2347. </extraports>
  2348. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2349. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  2350. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2351. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  2352. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2353. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2354. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2355. <port protocol="tcp" portid="465"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  2356. </ports>
  2357. <times srtt="358503" rttvar="6194" to="383279"/>
  2358. </host>
  2359. <host starttime="1606158577" endtime="1606168672"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2360. <address addr="172.241.29.153" addrtype="ipv4"/>
  2361. <hostnames>
  2362. </hostnames>
  2363. <ports><extraports state="closed" count="994">
  2364. <extrareasons reason="conn-refused" count="994"/>
  2365. </extraports>
  2366. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2367. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2368. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  2369. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2370. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2371. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2372. </ports>
  2373. <times srtt="164400" rttvar="1442" to="170168"/>
  2374. </host>
  2375. <host starttime="1606158576" endtime="1606168655"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2376. <address addr="47.110.145.60" addrtype="ipv4"/>
  2377. <hostnames>
  2378. </hostnames>
  2379. <ports><extraports state="closed" count="988">
  2380. <extrareasons reason="conn-refused" count="988"/>
  2381. </extraports>
  2382. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2383. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2384. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2385. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2386. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2387. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2388. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  2389. <port protocol="tcp" portid="888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  2390. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  2391. <port protocol="tcp" portid="8089"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2392. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  2393. <port protocol="tcp" portid="9999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="abyss" method="table" conf="3"/></port>
  2394. </ports>
  2395. <times srtt="331317" rttvar="968" to="335189"/>
  2396. </host>
  2397. <host starttime="1606158576" endtime="1606168631"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2398. <address addr="167.172.5.160" addrtype="ipv4"/>
  2399. <hostnames>
  2400. </hostnames>
  2401. <ports><extraports state="closed" count="997">
  2402. <extrareasons reason="conn-refused" count="997"/>
  2403. </extraports>
  2404. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2405. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2406. <port protocol="tcp" portid="6839"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2407. </ports>
  2408. <times srtt="377147" rttvar="4895" to="396727"/>
  2409. </host>
  2410. <host starttime="1606158577" endtime="1606168671"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2411. <address addr="104.198.151.234" addrtype="ipv4"/>
  2412. <hostnames>
  2413. <hostname name="234.151.198.104.bc.googleusercontent.com" type="PTR"/>
  2414. </hostnames>
  2415. <ports><extraports state="filtered" count="999">
  2416. <extrareasons reason="no-responses" count="999"/>
  2417. </extraports>
  2418. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2419. </ports>
  2420. <times srtt="161353" rttvar="677" to="164061"/>
  2421. </host>
  2422. <host starttime="1606158576" endtime="1606168675"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2423. <address addr="13.91.4.128" addrtype="ipv4"/>
  2424. <hostnames>
  2425. </hostnames>
  2426. <ports><extraports state="filtered" count="999">
  2427. <extrareasons reason="no-responses" count="999"/>
  2428. </extraports>
  2429. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2430. </ports>
  2431. <times srtt="198693" rttvar="1190" to="203453"/>
  2432. </host>
  2433. <host starttime="1606158577" endtime="1606168669"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2434. <address addr="159.65.229.6" addrtype="ipv4"/>
  2435. <hostnames>
  2436. </hostnames>
  2437. <ports><extraports state="closed" count="998">
  2438. <extrareasons reason="conn-refused" count="998"/>
  2439. </extraports>
  2440. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2441. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 159.65.229.6,/load&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2442. </ports>
  2443. <times srtt="140784" rttvar="1770" to="147864"/>
  2444. </host>
  2445. <host starttime="1606158576" endtime="1606168675"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2446. <address addr="163.172.39.102" addrtype="ipv4"/>
  2447. <hostnames>
  2448. <hostname name="163-172-39-102.rev.poneytelecom.eu" type="PTR"/>
  2449. </hostnames>
  2450. <ports><extraports state="closed" count="989">
  2451. <extrareasons reason="conn-refused" count="989"/>
  2452. </extraports>
  2453. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2454. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2455. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2456. <port protocol="tcp" portid="3905"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="mupdate" method="table" conf="3"/></port>
  2457. <port protocol="tcp" portid="3920"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="exasoftport1" method="table" conf="3"/></port>
  2458. <port protocol="tcp" portid="4848"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="appserv-http" method="table" conf="3"/></port>
  2459. <port protocol="tcp" portid="5800"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2460. <port protocol="tcp" portid="5900"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  2461. <port protocol="tcp" portid="7676"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="imqbrokerd" method="table" conf="3"/></port>
  2462. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2463. <port protocol="tcp" portid="8181"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="intermapper" method="table" conf="3"/></port>
  2464. </ports>
  2465. <times srtt="213833" rttvar="1382" to="219361"/>
  2466. </host>
  2467. <host starttime="1606158576" endtime="1606168658"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2468. <address addr="154.8.160.196" addrtype="ipv4"/>
  2469. <hostnames>
  2470. </hostnames>
  2471. <ports><extraports state="closed" count="994">
  2472. <extrareasons reason="conn-refused" count="994"/>
  2473. </extraports>
  2474. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2475. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2476. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2477. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2478. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  2479. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  2480. </ports>
  2481. <times srtt="352210" rttvar="1247" to="357198"/>
  2482. </host>
  2483. <host starttime="1606158578" endtime="1606168637"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2484. <address addr="34.84.137.228" addrtype="ipv4"/>
  2485. <hostnames>
  2486. <hostname name="228.137.84.34.bc.googleusercontent.com" type="PTR"/>
  2487. </hostnames>
  2488. <ports><extraports state="closed" count="991">
  2489. <extrareasons reason="conn-refused" count="991"/>
  2490. </extraports>
  2491. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2492. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2493. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2494. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2495. <port protocol="tcp" portid="2160"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="apc-2160" method="table" conf="3"/></port>
  2496. <port protocol="tcp" portid="5822"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2497. <port protocol="tcp" portid="7911"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2498. <port protocol="tcp" portid="30718"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2499. <port protocol="tcp" portid="49999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2500. </ports>
  2501. <times srtt="294205" rttvar="1280" to="299325"/>
  2502. </host>
  2503. <host starttime="1606158576" endtime="1606168638"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2504. <address addr="161.35.38.97" addrtype="ipv4"/>
  2505. <hostnames>
  2506. </hostnames>
  2507. <ports><extraports state="closed" count="998">
  2508. <extrareasons reason="conn-refused" count="998"/>
  2509. </extraports>
  2510. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2511. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2512. </ports>
  2513. <times srtt="216700" rttvar="6818" to="243972"/>
  2514. </host>
  2515. <host starttime="1606158576" endtime="1606168677"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2516. <address addr="139.180.203.104" addrtype="ipv4"/>
  2517. <hostnames>
  2518. <hostname name="139.180.203.104.vultr.com" type="PTR"/>
  2519. </hostnames>
  2520. <ports><extraports state="filtered" count="997">
  2521. <extrareasons reason="no-responses" count="997"/>
  2522. </extraports>
  2523. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2524. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: microsoft.systemservices.network,/ca,139.180.203.104,/dot.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: microsoft.systemservices.network,/g.pixel,139.180.203.104,/__utm.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2525. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: microsoft.systemservices.network,/ca,139.180.203.104,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2526. </ports>
  2527. <times srtt="301923" rttvar="513" to="303975"/>
  2528. </host>
  2529. <host starttime="1606158578" endtime="1606168668"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2530. <address addr="134.209.5.246" addrtype="ipv4"/>
  2531. <hostnames>
  2532. </hostnames>
  2533. <ports><extraports state="closed" count="996">
  2534. <extrareasons reason="conn-refused" count="996"/>
  2535. </extraports>
  2536. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2537. <port protocol="tcp" portid="30"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2538. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2539. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 134.209.5.246,/visit.js&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2540. </ports>
  2541. <times srtt="207475" rttvar="922" to="211163"/>
  2542. </host>
  2543. <host starttime="1606158577" endtime="1606168651"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2544. <address addr="149.28.95.180" addrtype="ipv4"/>
  2545. <hostnames>
  2546. <hostname name="149.28.95.180.vultr.com" type="PTR"/>
  2547. </hostnames>
  2548. <ports><extraports state="closed" count="990">
  2549. <extrareasons reason="conn-refused" count="990"/>
  2550. </extraports>
  2551. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2552. <port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  2553. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2554. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2555. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2556. <port protocol="tcp" portid="1174"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="fnet-remote-ui" method="table" conf="3"/></port>
  2557. <port protocol="tcp" portid="1296"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="dproxy" method="table" conf="3"/></port>
  2558. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  2559. <port protocol="tcp" portid="5101"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="admdog" method="table" conf="3"/></port>
  2560. <port protocol="tcp" portid="32782"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2561. </ports>
  2562. <times srtt="188717" rttvar="2665" to="199377"/>
  2563. </host>
  2564. <host starttime="1606158576" endtime="1606168634"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2565. <address addr="104.237.4.40" addrtype="ipv4"/>
  2566. <hostnames>
  2567. <hostname name="mail2.purchasecare.net" type="PTR"/>
  2568. </hostnames>
  2569. <ports><extraports state="closed" count="997">
  2570. <extrareasons reason="conn-refused" count="997"/>
  2571. </extraports>
  2572. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2573. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2574. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2575. </ports>
  2576. <times srtt="163971" rttvar="970" to="167851"/>
  2577. </host>
  2578. <host starttime="1606158575" endtime="1606168683"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2579. <address addr="149.28.157.5" addrtype="ipv4"/>
  2580. <hostnames>
  2581. <hostname name="149.28.157.5.vultr.com" type="PTR"/>
  2582. </hostnames>
  2583. <ports><extraports state="filtered" count="994">
  2584. <extrareasons reason="no-responses" count="994"/>
  2585. </extraports>
  2586. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2587. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2588. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  2589. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2590. <port protocol="tcp" portid="1433"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ms-sql-s" method="table" conf="3"/></port>
  2591. <port protocol="tcp" portid="9000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cslistener" method="table" conf="3"/></port>
  2592. </ports>
  2593. <times srtt="373739" rttvar="5425" to="395439"/>
  2594. </host>
  2595. <host starttime="1606158576" endtime="1606168637"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2596. <address addr="52.89.33.58" addrtype="ipv4"/>
  2597. <hostnames>
  2598. <hostname name="ec2-52-89-33-58.us-west-2.compute.amazonaws.com" type="PTR"/>
  2599. </hostnames>
  2600. <ports><extraports state="filtered" count="998">
  2601. <extrareasons reason="no-responses" count="998"/>
  2602. </extraports>
  2603. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  2604. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2605. </ports>
  2606. <times srtt="227041" rttvar="7073" to="255333"/>
  2607. </host>
  2608. <host starttime="1606158576" endtime="1606168644"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2609. <address addr="159.203.86.116" addrtype="ipv4"/>
  2610. <hostnames>
  2611. <hostname name="inlinecms.com" type="PTR"/>
  2612. </hostnames>
  2613. <ports><extraports state="filtered" count="987">
  2614. <extrareasons reason="no-responses" count="987"/>
  2615. </extraports>
  2616. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2617. <port protocol="tcp" portid="88"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="kerberos-sec" method="table" conf="3"/></port>
  2618. <port protocol="tcp" portid="443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https" method="table" conf="3"/></port>
  2619. <port protocol="tcp" portid="444"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="snpp" method="table" conf="3"/></port>
  2620. <port protocol="tcp" portid="545"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ekshell" method="table" conf="3"/></port>
  2621. <port protocol="tcp" portid="5000"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="upnp" method="table" conf="3"/></port>
  2622. <port protocol="tcp" portid="5001"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="commplex-link" method="table" conf="3"/></port>
  2623. <port protocol="tcp" portid="5002"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="rfe" method="table" conf="3"/></port>
  2624. <port protocol="tcp" portid="5003"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="filemaker" method="table" conf="3"/></port>
  2625. <port protocol="tcp" portid="5004"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="avt-profile-1" method="table" conf="3"/></port>
  2626. <port protocol="tcp" portid="5009"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="airport-admin" method="table" conf="3"/></port>
  2627. <port protocol="tcp" portid="5050"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="mmcc" method="table" conf="3"/></port>
  2628. <port protocol="tcp" portid="8443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/></port>
  2629. </ports>
  2630. <times srtt="139582" rttvar="1002" to="143590"/>
  2631. </host>
  2632. <host starttime="1606158577" endtime="1606168654"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2633. <address addr="158.247.197.43" addrtype="ipv4"/>
  2634. <hostnames>
  2635. <hostname name="158.247.197.43.vultr.com" type="PTR"/>
  2636. </hostnames>
  2637. <ports><extraports state="closed" count="990">
  2638. <extrareasons reason="conn-refused" count="990"/>
  2639. </extraports>
  2640. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  2641. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2642. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2643. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 172.19.30.253,/ga.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; Touch)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 172.19.30.253,/__utm.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2644. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2645. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2646. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2647. <port protocol="tcp" portid="1688"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nsjtp-data" method="table" conf="3"/></port>
  2648. <port protocol="tcp" portid="7000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  2649. <port protocol="tcp" portid="8899"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ospf-lite" method="table" conf="3"/></port>
  2650. </ports>
  2651. <times srtt="326860" rttvar="1993" to="334832"/>
  2652. </host>
  2653. <host starttime="1606158577" endtime="1606168672"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2654. <address addr="160.124.49.133" addrtype="ipv4"/>
  2655. <hostnames>
  2656. </hostnames>
  2657. <ports><extraports state="filtered" count="993">
  2658. <extrareasons reason="host-unreaches" count="975"/>
  2659. <extrareasons reason="no-responses" count="18"/>
  2660. </extraports>
  2661. <port protocol="tcp" portid="22"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2662. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  2663. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2664. <port protocol="tcp" portid="4444"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  2665. <port protocol="tcp" portid="7777"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cbt" method="table" conf="3"/></port>
  2666. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  2667. <port protocol="tcp" portid="8088"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="radan-http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2668. </ports>
  2669. <times srtt="322128" rttvar="3185" to="334868"/>
  2670. </host>
  2671. <host starttime="1606158578" endtime="1606168648"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2672. <address addr="148.70.32.190" addrtype="ipv4"/>
  2673. <hostnames>
  2674. </hostnames>
  2675. <ports><extraports state="closed" count="994">
  2676. <extrareasons reason="conn-refused" count="994"/>
  2677. </extraports>
  2678. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2679. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 148.70.32.190,/pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MATMJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 148.70.32.190,/cx&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; MASP)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2680. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2681. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2682. <port protocol="tcp" portid="7938"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="lgtomapper" method="table" conf="3"/></port>
  2683. <port protocol="tcp" portid="50000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ibm-db2" method="table" conf="3"/></port>
  2684. </ports>
  2685. <times srtt="392371" rttvar="3603" to="406783"/>
  2686. </host>
  2687. <host starttime="1606158577" endtime="1606168650"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2688. <address addr="104.149.168.199" addrtype="ipv4"/>
  2689. <hostnames>
  2690. </hostnames>
  2691. <ports><extraports state="closed" count="993">
  2692. <extrareasons reason="conn-refused" count="993"/>
  2693. </extraports>
  2694. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2695. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  2696. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2697. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2698. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2699. <port protocol="tcp" portid="4004"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pxc-roid" method="table" conf="3"/></port>
  2700. <port protocol="tcp" portid="49152"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2701. </ports>
  2702. <times srtt="196248" rttvar="2404" to="205864"/>
  2703. </host>
  2704. <host starttime="1606158576" endtime="1606168687"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2705. <address addr="139.59.1.154" addrtype="ipv4"/>
  2706. <hostnames>
  2707. </hostnames>
  2708. <ports><extraports state="closed" count="991">
  2709. <extrareasons reason="conn-refused" count="991"/>
  2710. </extraports>
  2711. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2712. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2713. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 139.59.1.154,/ca&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 139.59.1.154,/match&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 733; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2714. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  2715. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2716. <port protocol="tcp" portid="1801"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msmq" method="table" conf="3"/></port>
  2717. <port protocol="tcp" portid="3000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ppp" method="table" conf="3"/></port>
  2718. <port protocol="tcp" portid="9110"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2719. <port protocol="tcp" portid="16018"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2720. </ports>
  2721. <times srtt="375895" rttvar="2008" to="383927"/>
  2722. </host>
  2723. <host starttime="1606158576" endtime="1606168638"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2724. <address addr="155.138.245.98" addrtype="ipv4"/>
  2725. <hostnames>
  2726. <hostname name="155.138.245.98.vultr.com" type="PTR"/>
  2727. </hostnames>
  2728. <ports><extraports state="closed" count="997">
  2729. <extrareasons reason="conn-refused" count="997"/>
  2730. </extraports>
  2731. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2732. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2733. <port protocol="tcp" portid="888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  2734. </ports>
  2735. <times srtt="163637" rttvar="1736" to="170581"/>
  2736. </host>
  2737. <host starttime="1606158576" endtime="1606168673"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2738. <address addr="145.249.106.134" addrtype="ipv4"/>
  2739. <hostnames>
  2740. </hostnames>
  2741. <ports><extraports state="closed" count="989">
  2742. <extrareasons reason="conn-refused" count="989"/>
  2743. </extraports>
  2744. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2745. <port protocol="tcp" portid="23"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="telnet" method="table" conf="3"/></port>
  2746. <port protocol="tcp" portid="32"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2747. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2748. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 145.249.106.134,/ga.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 145.249.106.134,/dpixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2749. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2750. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  2751. <port protocol="tcp" portid="2222"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="EtherNetIP-1" method="table" conf="3"/></port>
  2752. <port protocol="tcp" portid="2323"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="3d-nfsd" method="table" conf="3"/></port>
  2753. <port protocol="tcp" portid="5555"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="freeciv" method="table" conf="3"/></port>
  2754. <port protocol="tcp" portid="6789"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ibm-db2-admin" method="table" conf="3"/></port>
  2755. </ports>
  2756. <times srtt="210852" rttvar="801" to="214056"/>
  2757. </host>
  2758. <host starttime="1606158575" endtime="1606168670"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2759. <address addr="138.91.90.6" addrtype="ipv4"/>
  2760. <hostnames>
  2761. </hostnames>
  2762. <ports><extraports state="filtered" count="998">
  2763. <extrareasons reason="no-responses" count="998"/>
  2764. </extraports>
  2765. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2766. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2767. </ports>
  2768. <times srtt="199023" rttvar="1707" to="205851"/>
  2769. </host>
  2770. <host starttime="1606158576" endtime="1606168651"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2771. <address addr="103.96.151.147" addrtype="ipv4"/>
  2772. <hostnames>
  2773. </hostnames>
  2774. <ports><extraports state="closed" count="987">
  2775. <extrareasons reason="conn-refused" count="987"/>
  2776. </extraports>
  2777. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  2778. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2779. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2780. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  2781. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2782. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2783. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2784. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2785. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2786. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2787. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2788. <port protocol="tcp" portid="49156"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2789. <port protocol="tcp" portid="49157"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2790. </ports>
  2791. <times srtt="357888" rttvar="6047" to="382076"/>
  2792. </host>
  2793. <host starttime="1606158577" endtime="1606168644"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2794. <address addr="139.196.224.35" addrtype="ipv4"/>
  2795. <hostnames>
  2796. </hostnames>
  2797. <ports><extraports state="closed" count="984">
  2798. <extrareasons reason="conn-refused" count="984"/>
  2799. </extraports>
  2800. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2801. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  2802. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2803. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2804. <port protocol="tcp" portid="88"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="kerberos-sec" method="table" conf="3"/></port>
  2805. <port protocol="tcp" portid="89"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="su-mit-tg" method="table" conf="3"/></port>
  2806. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  2807. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2808. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2809. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2810. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  2811. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  2812. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  2813. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  2814. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  2815. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  2816. </ports>
  2817. <times srtt="335976" rttvar="1615" to="342436"/>
  2818. </host>
  2819. <host starttime="1606158576" endtime="1606168673"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2820. <address addr="144.217.207.19" addrtype="ipv4"/>
  2821. <hostnames>
  2822. <hostname name="ip19.ip-144-217-207.net" type="PTR"/>
  2823. </hostnames>
  2824. <ports><extraports state="closed" count="990">
  2825. <extrareasons reason="conn-refused" count="990"/>
  2826. </extraports>
  2827. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2828. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2829. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2830. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2831. <port protocol="tcp" portid="900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="omginitialrefs" method="table" conf="3"/></port>
  2832. <port protocol="tcp" portid="3809"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="apocd" method="table" conf="3"/></port>
  2833. <port protocol="tcp" portid="6156"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2834. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2835. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  2836. <port protocol="tcp" portid="65000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2837. </ports>
  2838. <times srtt="146118" rttvar="1140" to="150678"/>
  2839. </host>
  2840. <host starttime="1606158577" endtime="1606168654"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2841. <address addr="139.59.230.84" addrtype="ipv4"/>
  2842. <hostnames>
  2843. </hostnames>
  2844. <ports><extraports state="closed" count="997">
  2845. <extrareasons reason="conn-refused" count="997"/>
  2846. </extraports>
  2847. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2848. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2849. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2850. </ports>
  2851. <times srtt="372566" rttvar="3872" to="388054"/>
  2852. </host>
  2853. <host starttime="1606158576" endtime="1606168672"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2854. <address addr="23.19.227.11" addrtype="ipv4"/>
  2855. <hostnames>
  2856. </hostnames>
  2857. <ports><extraports state="closed" count="992">
  2858. <extrareasons reason="conn-refused" count="992"/>
  2859. </extraports>
  2860. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2861. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2862. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  2863. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2864. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2865. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2866. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2867. <port protocol="tcp" portid="49158"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2868. </ports>
  2869. <times srtt="139674" rttvar="1568" to="145946"/>
  2870. </host>
  2871. <host starttime="1606158576" endtime="1606168672"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2872. <address addr="54.233.105.164" addrtype="ipv4"/>
  2873. <hostnames>
  2874. <hostname name="ec2-54-233-105-164.sa-east-1.compute.amazonaws.com" type="PTR"/>
  2875. </hostnames>
  2876. <ports><extraports state="filtered" count="994">
  2877. <extrareasons reason="no-responses" count="994"/>
  2878. </extraports>
  2879. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2880. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2881. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2882. <port protocol="tcp" portid="4848"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="appserv-http" method="table" conf="3"/></port>
  2883. <port protocol="tcp" portid="5432"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="postgresql" method="table" conf="3"/></port>
  2884. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2885. </ports>
  2886. <times srtt="250085" rttvar="1090" to="254445"/>
  2887. </host>
  2888. <host starttime="1606158576" endtime="1606168658"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2889. <address addr="152.136.174.111" addrtype="ipv4"/>
  2890. <hostnames>
  2891. </hostnames>
  2892. <ports><extraports state="closed" count="992">
  2893. <extrareasons reason="conn-refused" count="992"/>
  2894. </extraports>
  2895. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2896. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2897. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2898. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2899. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2900. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  2901. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  2902. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  2903. </ports>
  2904. <times srtt="352789" rttvar="1305" to="358009"/>
  2905. </host>
  2906. <host starttime="1606158576" endtime="1606168675"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2907. <address addr="155.94.177.80" addrtype="ipv4"/>
  2908. <hostnames>
  2909. <hostname name="155.94.177.80.static.quadranet.com" type="PTR"/>
  2910. </hostnames>
  2911. <ports><extraports state="closed" count="996">
  2912. <extrareasons reason="conn-refused" count="996"/>
  2913. </extraports>
  2914. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2915. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2916. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2917. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2918. </ports>
  2919. <times srtt="234525" rttvar="44502" to="412533"/>
  2920. </host>
  2921. <host starttime="1606158577" endtime="1606168660"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2922. <address addr="43.226.155.81" addrtype="ipv4"/>
  2923. <hostnames>
  2924. </hostnames>
  2925. <ports><extraports state="closed" count="985">
  2926. <extrareasons reason="conn-refused" count="985"/>
  2927. </extraports>
  2928. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  2929. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2930. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2931. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2932. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  2933. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  2934. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2935. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  2936. <port protocol="tcp" portid="888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  2937. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  2938. <port protocol="tcp" portid="3128"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  2939. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  2940. <port protocol="tcp" portid="3333"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="dec-notes" method="table" conf="3"/></port>
  2941. <port protocol="tcp" portid="5555"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="freeciv" method="table" conf="3"/></port>
  2942. <port protocol="tcp" portid="8899"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ospf-lite" method="table" conf="3"/></port>
  2943. </ports>
  2944. <times srtt="370505" rttvar="4896" to="390089"/>
  2945. </host>
  2946. <host starttime="1606158577" endtime="1606168634"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2947. <address addr="104.243.46.74" addrtype="ipv4"/>
  2948. <hostnames>
  2949. </hostnames>
  2950. <ports><extraports state="closed" count="997">
  2951. <extrareasons reason="conn-refused" count="997"/>
  2952. </extraports>
  2953. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2954. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2955. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2956. </ports>
  2957. <times srtt="159883" rttvar="1601" to="166287"/>
  2958. </host>
  2959. <host starttime="1606158577" endtime="1606168671"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2960. <address addr="144.217.207.21" addrtype="ipv4"/>
  2961. <hostnames>
  2962. <hostname name="ip21.ip-144-217-207.net" type="PTR"/>
  2963. </hostnames>
  2964. <ports><extraports state="closed" count="991">
  2965. <extrareasons reason="conn-refused" count="991"/>
  2966. </extraports>
  2967. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2968. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2969. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2970. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 52.188.209.63,/cm&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts; IE0006_ver1;EN_GB)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  2971. <port protocol="tcp" portid="801"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="device" method="table" conf="3"/></port>
  2972. <port protocol="tcp" portid="4443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="pharos" method="table" conf="3"/></port>
  2973. <port protocol="tcp" portid="6001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="X11:1" method="table" conf="3"/></port>
  2974. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  2975. <port protocol="tcp" portid="8181"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="intermapper" method="table" conf="3"/></port>
  2976. </ports>
  2977. <times srtt="146528" rttvar="1674" to="153224"/>
  2978. </host>
  2979. <host starttime="1606158576" endtime="1606168637"><status state="up" reason="syn-ack" reason_ttl="0"/>
  2980. <address addr="147.78.64.161" addrtype="ipv4"/>
  2981. <hostnames>
  2982. <hostname name="petrkoleeeesnikov.example.com" type="PTR"/>
  2983. </hostnames>
  2984. <ports><extraports state="closed" count="993">
  2985. <extrareasons reason="conn-refused" count="993"/>
  2986. </extraports>
  2987. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  2988. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  2989. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2990. <port protocol="tcp" portid="111"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  2991. <port protocol="tcp" portid="179"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="bgp" method="table" conf="3"/></port>
  2992. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  2993. <port protocol="tcp" portid="8099"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  2994. </ports>
  2995. <times srtt="258519" rttvar="923" to="262211"/>
  2996. </host>
  2997. <host starttime="1606158576" endtime="1606168631"><status state="up" reason="conn-refused" reason_ttl="0"/>
  2998. <address addr="104.248.148.158" addrtype="ipv4"/>
  2999. <hostnames>
  3000. </hostnames>
  3001. <ports><extraports state="closed" count="998">
  3002. <extrareasons reason="conn-refused" count="998"/>
  3003. </extraports>
  3004. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3005. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3006. </ports>
  3007. <times srtt="379135" rttvar="3958" to="394967"/>
  3008. </host>
  3009. <host starttime="1606158576" endtime="1606168658"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3010. <address addr="103.117.72.60" addrtype="ipv4"/>
  3011. <hostnames>
  3012. </hostnames>
  3013. <ports><extraports state="closed" count="977">
  3014. <extrareasons reason="conn-refused" count="977"/>
  3015. </extraports>
  3016. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  3017. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3018. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3019. <port protocol="tcp" portid="88"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="kerberos-sec" method="table" conf="3"/></port>
  3020. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  3021. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3022. <port protocol="tcp" portid="389"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldap" method="table" conf="3"/></port>
  3023. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3024. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3025. <port protocol="tcp" portid="464"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="kpasswd5" method="table" conf="3"/></port>
  3026. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  3027. <port protocol="tcp" portid="636"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldapssl" method="table" conf="3"/></port>
  3028. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  3029. <port protocol="tcp" portid="1433"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-s" method="table" conf="3"/></port>
  3030. <port protocol="tcp" portid="1720"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="h323q931" method="table" conf="3"/></port>
  3031. <port protocol="tcp" portid="3001"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nessus" method="table" conf="3"/></port>
  3032. <port protocol="tcp" portid="3003"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cgms" method="table" conf="3"/></port>
  3033. <port protocol="tcp" portid="3306"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  3034. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3035. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3036. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3037. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3038. <port protocol="tcp" portid="49156"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3039. </ports>
  3040. <times srtt="357315" rttvar="2268" to="366387"/>
  3041. </host>
  3042. <host starttime="1606158576" endtime="1606168679"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3043. <address addr="146.6.15.12" addrtype="ipv4"/>
  3044. <hostnames>
  3045. <hostname name="cobaltstrike.infosec.utexas.edu" type="PTR"/>
  3046. </hostnames>
  3047. <ports><extraports state="filtered" count="986">
  3048. <extrareasons reason="host-unreaches" count="977"/>
  3049. <extrareasons reason="no-responses" count="9"/>
  3050. </extraports>
  3051. <port protocol="tcp" portid="21"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  3052. <port protocol="tcp" portid="25"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  3053. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  3054. <port protocol="tcp" portid="110"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="pop3" method="table" conf="3"/></port>
  3055. <port protocol="tcp" portid="143"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="imap" method="table" conf="3"/></port>
  3056. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 146.6.15.12,/g.pixel&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3057. <port protocol="tcp" portid="465"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  3058. <port protocol="tcp" portid="587"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="submission" method="table" conf="3"/></port>
  3059. <port protocol="tcp" portid="993"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="imaps" method="table" conf="3"/></port>
  3060. <port protocol="tcp" portid="995"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="pop3s" method="table" conf="3"/></port>
  3061. <port protocol="tcp" portid="1234"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="hotline" method="table" conf="3"/></port>
  3062. <port protocol="tcp" portid="4444"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3063. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  3064. <port protocol="tcp" portid="8181"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="intermapper" method="table" conf="3"/></port>
  3065. </ports>
  3066. <times srtt="168044" rttvar="1260" to="173084"/>
  3067. </host>
  3068. <host starttime="1606158576" endtime="1606168675"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3069. <address addr="139.155.59.181" addrtype="ipv4"/>
  3070. <hostnames>
  3071. </hostnames>
  3072. <ports><extraports state="closed" count="993">
  3073. <extrareasons reason="conn-refused" count="993"/>
  3074. </extraports>
  3075. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3076. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3077. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 172.19.30.253,/ca&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; Xbox)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 172.19.30.253,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0) LBBROWSER&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3078. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3079. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3080. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  3081. <port protocol="tcp" portid="8899"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ospf-lite" method="table" conf="3"/></port>
  3082. </ports>
  3083. <times srtt="386988" rttvar="3975" to="402888"/>
  3084. </host>
  3085. <host starttime="1606158576" endtime="1606168638"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3086. <address addr="18.216.120.69" addrtype="ipv4"/>
  3087. <hostnames>
  3088. <hostname name="ec2-18-216-120-69.us-east-2.compute.amazonaws.com" type="PTR"/>
  3089. </hostnames>
  3090. <ports><extraports state="filtered" count="998">
  3091. <extrareasons reason="no-responses" count="998"/>
  3092. </extraports>
  3093. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3094. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3095. </ports>
  3096. <times srtt="149767" rttvar="1498" to="155759"/>
  3097. </host>
  3098. <host starttime="1606158576" endtime="1606168681"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3099. <address addr="146.0.72.91" addrtype="ipv4"/>
  3100. <hostnames>
  3101. </hostnames>
  3102. <ports><extraports state="closed" count="995">
  3103. <extrareasons reason="conn-refused" count="995"/>
  3104. </extraports>
  3105. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3106. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3107. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3108. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3109. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  3110. </ports>
  3111. <times srtt="222408" rttvar="2811" to="233652"/>
  3112. </host>
  3113. <host starttime="1606158576" endtime="1606168672"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3114. <address addr="103.224.82.194" addrtype="ipv4"/>
  3115. <hostnames>
  3116. </hostnames>
  3117. <ports><extraports state="closed" count="989">
  3118. <extrareasons reason="conn-refused" count="989"/>
  3119. </extraports>
  3120. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3121. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3122. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3123. <port protocol="tcp" portid="111"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  3124. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  3125. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3126. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3127. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3128. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  3129. <port protocol="tcp" portid="1433"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-sql-s" method="table" conf="3"/></port>
  3130. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  3131. </ports>
  3132. <times srtt="321479" rttvar="2537" to="331627"/>
  3133. </host>
  3134. <host starttime="1606158578" endtime="1606168679"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3135. <address addr="103.254.75.240" addrtype="ipv4"/>
  3136. <hostnames>
  3137. </hostnames>
  3138. <ports><extraports state="closed" count="947">
  3139. <extrareasons reason="conn-refused" count="947"/>
  3140. </extraports>
  3141. <extraports state="filtered" count="50">
  3142. <extrareasons reason="no-responses" count="48"/>
  3143. <extrareasons reason="host-unreaches" count="2"/>
  3144. </extraports>
  3145. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  3146. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3147. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3148. </ports>
  3149. <times srtt="356812" rttvar="4202" to="373620"/>
  3150. </host>
  3151. <host starttime="1606158576" endtime="1606168654"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3152. <address addr="121.36.211.148" addrtype="ipv4"/>
  3153. <hostnames>
  3154. <hostname name="ecs-121-36-211-148.compute.hwclouds-dns.com" type="PTR"/>
  3155. </hostnames>
  3156. <ports><extraports state="closed" count="983">
  3157. <extrareasons reason="conn-refused" count="983"/>
  3158. </extraports>
  3159. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3160. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  3161. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3162. <port protocol="tcp" portid="90"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="dnsix" method="table" conf="3"/></port>
  3163. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  3164. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3165. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3166. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3167. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  3168. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  3169. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  3170. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  3171. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  3172. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3173. <port protocol="tcp" portid="5432"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="postgresql" method="table" conf="3"/></port>
  3174. <port protocol="tcp" portid="5904"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3175. <port protocol="tcp" portid="8089"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3176. </ports>
  3177. <times srtt="336843" rttvar="3366" to="350307"/>
  3178. </host>
  3179. <host starttime="1606158577" endtime="1606168658"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3180. <address addr="95.179.228.227" addrtype="ipv4"/>
  3181. <hostnames>
  3182. <hostname name="95.179.228.227.vultr.com" type="PTR"/>
  3183. </hostnames>
  3184. <ports><extraports state="closed" count="997">
  3185. <extrareasons reason="conn-refused" count="997"/>
  3186. </extraports>
  3187. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3188. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3189. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3190. </ports>
  3191. <times srtt="212264" rttvar="4222" to="229152"/>
  3192. </host>
  3193. <host starttime="1606158578" endtime="1606168672"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3194. <address addr="119.8.235.216" addrtype="ipv4"/>
  3195. <hostnames>
  3196. <hostname name="ecs-119-8-235-216.compute.hwclouds-dns.com" type="PTR"/>
  3197. </hostnames>
  3198. <ports><extraports state="closed" count="996">
  3199. <extrareasons reason="conn-refused" count="996"/>
  3200. </extraports>
  3201. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3202. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3203. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3204. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3205. </ports>
  3206. <times srtt="364835" rttvar="3042" to="377003"/>
  3207. </host>
  3208. <host starttime="1606158576" endtime="1606168659"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3209. <address addr="139.217.110.192" addrtype="ipv4"/>
  3210. <hostnames>
  3211. </hostnames>
  3212. <ports><extraports state="closed" count="991">
  3213. <extrareasons reason="conn-refused" count="991"/>
  3214. </extraports>
  3215. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3216. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3217. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3218. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  3219. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  3220. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3221. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  3222. <port protocol="tcp" portid="8800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sunwebadmin" method="table" conf="3"/></port>
  3223. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  3224. </ports>
  3225. <times srtt="380503" rttvar="3440" to="394263"/>
  3226. </host>
  3227. <host starttime="1606158576" endtime="1606168668"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3228. <address addr="141.98.80.152" addrtype="ipv4"/>
  3229. <hostnames>
  3230. </hostnames>
  3231. <ports><extraports state="closed" count="995">
  3232. <extrareasons reason="conn-refused" count="995"/>
  3233. </extraports>
  3234. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3235. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3236. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 141.98.80.152,/j.ad&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3237. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3238. <port protocol="tcp" portid="8000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/></port>
  3239. </ports>
  3240. <times srtt="219120" rttvar="1396" to="224704"/>
  3241. </host>
  3242. <host starttime="1606158577" endtime="1606168651"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3243. <address addr="146.56.205.248" addrtype="ipv4"/>
  3244. <hostnames>
  3245. </hostnames>
  3246. <ports><extraports state="closed" count="992">
  3247. <extrareasons reason="conn-refused" count="992"/>
  3248. </extraports>
  3249. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3250. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3251. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3252. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3253. <port protocol="tcp" portid="1782"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="hp-hcip" method="table" conf="3"/></port>
  3254. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3255. <port protocol="tcp" portid="34572"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3256. <port protocol="tcp" portid="50000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ibm-db2" method="table" conf="3"/></port>
  3257. </ports>
  3258. <times srtt="332369" rttvar="1589" to="338725"/>
  3259. </host>
  3260. <host starttime="1606158576" endtime="1606168675"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3261. <address addr="139.155.245.29" addrtype="ipv4"/>
  3262. <hostnames>
  3263. </hostnames>
  3264. <ports><extraports state="closed" count="986">
  3265. <extrareasons reason="conn-refused" count="986"/>
  3266. </extraports>
  3267. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3268. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3269. <port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  3270. <port protocol="tcp" portid="139"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3271. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3272. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3273. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  3274. <port protocol="tcp" portid="8022"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="oa-system" method="table" conf="3"/></port>
  3275. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3276. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3277. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3278. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3279. <port protocol="tcp" portid="49156"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3280. <port protocol="tcp" portid="49160"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3281. </ports>
  3282. <times srtt="384744" rttvar="2372" to="394232"/>
  3283. </host>
  3284. <host starttime="1606158577" endtime="1606168681"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3285. <address addr="43.240.15.68" addrtype="ipv4"/>
  3286. <hostnames>
  3287. <hostname name="ns1.asiahostway.com" type="PTR"/>
  3288. </hostnames>
  3289. <ports><extraports state="closed" count="993">
  3290. <extrareasons reason="conn-refused" count="993"/>
  3291. </extraports>
  3292. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3293. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3294. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  3295. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3296. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.180.99.65,/load&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3297. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3298. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  3299. </ports>
  3300. <times srtt="323418" rttvar="4932" to="343146"/>
  3301. </host>
  3302. <host starttime="1606158577" endtime="1606168644"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3303. <address addr="18.181.239.157" addrtype="ipv4"/>
  3304. <hostnames>
  3305. <hostname name="ec2-18-181-239-157.ap-northeast-1.compute.amazonaws.com" type="PTR"/>
  3306. </hostnames>
  3307. <ports><extraports state="filtered" count="998">
  3308. <extrareasons reason="no-responses" count="998"/>
  3309. </extraports>
  3310. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3311. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3312. </ports>
  3313. <times srtt="356934" rttvar="2885" to="368474"/>
  3314. </host>
  3315. <host starttime="1606158578" endtime="1606168650"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3316. <address addr="89.45.4.135" addrtype="ipv4"/>
  3317. <hostnames>
  3318. </hostnames>
  3319. <ports><extraports state="closed" count="995">
  3320. <extrareasons reason="conn-refused" count="995"/>
  3321. </extraports>
  3322. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3323. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3324. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3325. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 89.45.4.135,/j.ad&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 89.45.4.135,/ga.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP09; NP09; MAAU)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3326. <port protocol="tcp" portid="9898"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="monkeycom" method="table" conf="3"/></port>
  3327. </ports>
  3328. <times srtt="190709" rttvar="1361" to="196153"/>
  3329. </host>
  3330. <host starttime="1606158576" endtime="1606168644"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3331. <address addr="103.234.72.154" addrtype="ipv4"/>
  3332. <hostnames>
  3333. </hostnames>
  3334. <ports><extraports state="closed" count="990">
  3335. <extrareasons reason="conn-refused" count="990"/>
  3336. </extraports>
  3337. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3338. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3339. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3340. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3341. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  3342. <port protocol="tcp" portid="1234"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hotline" method="table" conf="3"/></port>
  3343. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  3344. <port protocol="tcp" portid="10001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="scp-config" method="table" conf="3"/></port>
  3345. <port protocol="tcp" portid="10002"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="documentum" method="table" conf="3"/></port>
  3346. <port protocol="tcp" portid="10003"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="documentum_s" method="table" conf="3"/></port>
  3347. </ports>
  3348. <times srtt="319162" rttvar="1410" to="324802"/>
  3349. </host>
  3350. <host starttime="1606158576" endtime="1606168638"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3351. <address addr="91.229.23.63" addrtype="ipv4"/>
  3352. <hostnames>
  3353. </hostnames>
  3354. <ports><extraports state="closed" count="996">
  3355. <extrareasons reason="conn-refused" count="996"/>
  3356. </extraports>
  3357. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3358. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3359. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3360. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3361. </ports>
  3362. <times srtt="219177" rttvar="1720" to="226057"/>
  3363. </host>
  3364. <host starttime="1606158576" endtime="1606168644"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3365. <address addr="141.164.41.118" addrtype="ipv4"/>
  3366. <hostnames>
  3367. <hostname name="141.164.41.118.vultr.com" type="PTR"/>
  3368. </hostnames>
  3369. <ports><extraports state="closed" count="995">
  3370. <extrareasons reason="conn-refused" count="995"/>
  3371. </extraports>
  3372. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3373. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3374. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3375. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3376. <port protocol="tcp" portid="4444"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3377. </ports>
  3378. <times srtt="335755" rttvar="2282" to="344883"/>
  3379. </host>
  3380. <host starttime="1606158576" endtime="1606168673"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3381. <address addr="80.82.77.164" addrtype="ipv4"/>
  3382. <hostnames>
  3383. </hostnames>
  3384. <ports><extraports state="closed" count="988">
  3385. <extrareasons reason="conn-refused" count="988"/>
  3386. </extraports>
  3387. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3388. <port protocol="tcp" portid="23"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="telnet" method="table" conf="3"/></port>
  3389. <port protocol="tcp" portid="32"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3390. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3391. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 80.82.77.164,/push&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; LG; LG-E906)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 80.82.77.164,/cx&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3392. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3393. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  3394. <port protocol="tcp" portid="2222"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="EtherNetIP-1" method="table" conf="3"/></port>
  3395. <port protocol="tcp" portid="2323"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="3d-nfsd" method="table" conf="3"/></port>
  3396. <port protocol="tcp" portid="5555"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="freeciv" method="table" conf="3"/></port>
  3397. <port protocol="tcp" portid="6789"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ibm-db2-admin" method="table" conf="3"/></port>
  3398. <port protocol="tcp" portid="12345"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbus" method="table" conf="3"/></port>
  3399. </ports>
  3400. <times srtt="210303" rttvar="1085" to="214643"/>
  3401. </host>
  3402. <host starttime="1606158576" endtime="1606168669"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3403. <address addr="139.60.161.215" addrtype="ipv4"/>
  3404. <hostnames>
  3405. </hostnames>
  3406. <ports><extraports state="closed" count="991">
  3407. <extrareasons reason="conn-refused" count="991"/>
  3408. </extraports>
  3409. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3410. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3411. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 600000&#xa;Jitter: 28&#xa;Maxdns: 245&#xa;C2 Server: 139.60.161.215,/jquery-3.3.1.min.js&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.3&#xa;HTTP Method Path 2: /jquery-3.3.2.min.js&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\dllhost.exe&#xa;Spawnto_x64: %windir%\sysnative\dllhost.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3412. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  3413. <port protocol="tcp" portid="1092"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="obrpd" method="table" conf="3"/></port>
  3414. <port protocol="tcp" portid="2381"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="compaq-https" method="table" conf="3"/></port>
  3415. <port protocol="tcp" portid="4848"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="appserv-http" method="table" conf="3"/></port>
  3416. <port protocol="tcp" portid="9929"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nping-echo" method="table" conf="3"/></port>
  3417. <port protocol="tcp" portid="15742"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3418. </ports>
  3419. <times srtt="138071" rttvar="512" to="140119"/>
  3420. </host>
  3421. <host starttime="1606158577" endtime="1606168679"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3422. <address addr="142.202.205.57" addrtype="ipv4"/>
  3423. <hostnames>
  3424. </hostnames>
  3425. <ports><extraports state="closed" count="992">
  3426. <extrareasons reason="conn-refused" count="992"/>
  3427. </extraports>
  3428. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3429. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3430. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3431. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  3432. <port protocol="tcp" portid="3000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ppp" method="table" conf="3"/></port>
  3433. <port protocol="tcp" portid="6006"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="X11:6" method="table" conf="3"/></port>
  3434. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3435. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  3436. </ports>
  3437. <times srtt="147005" rttvar="1059" to="151241"/>
  3438. </host>
  3439. <taskprogress task="Connect Scan" time="1606168830" percent="4.86" remaining="2802" etc="1606171632"/>
  3440. <host starttime="1606158578" endtime="1606172776"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3441. <address addr="142.202.205.88" addrtype="ipv4"/>
  3442. <hostnames>
  3443. </hostnames>
  3444. <ports><extraports state="closed" count="991">
  3445. <extrareasons reason="conn-refused" count="991"/>
  3446. </extraports>
  3447. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3448. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3449. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3450. <port protocol="tcp" portid="111"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  3451. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 142.202.205.88,/dot.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MAGWJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 142.202.205.88,/ptj&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3452. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  3453. <port protocol="tcp" portid="722"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3454. <port protocol="tcp" portid="880"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3455. <port protocol="tcp" portid="2638"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sybase" method="table" conf="3"/></port>
  3456. </ports>
  3457. <times srtt="148807" rttvar="1041" to="152971"/>
  3458. </host>
  3459. <host starttime="1606158577" endtime="1606172801"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3460. <address addr="121.41.82.60" addrtype="ipv4"/>
  3461. <hostnames>
  3462. </hostnames>
  3463. <ports><extraports state="closed" count="994">
  3464. <extrareasons reason="conn-refused" count="994"/>
  3465. </extraports>
  3466. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3467. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3468. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3469. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3470. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3471. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3472. </ports>
  3473. <times srtt="346217" rttvar="932" to="349945"/>
  3474. </host>
  3475. <host starttime="1606158577" endtime="1606172789"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3476. <address addr="139.155.42.254" addrtype="ipv4"/>
  3477. <hostnames>
  3478. </hostnames>
  3479. <ports><extraports state="closed" count="986">
  3480. <extrareasons reason="conn-refused" count="986"/>
  3481. </extraports>
  3482. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3483. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3484. <port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  3485. <port protocol="tcp" portid="139"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3486. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3487. <port protocol="tcp" portid="787"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="qsc" method="table" conf="3"/></port>
  3488. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  3489. <port protocol="tcp" portid="6969"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="acmsoda" method="table" conf="3"/></port>
  3490. <port protocol="tcp" portid="9110"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3491. <port protocol="tcp" portid="15742"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3492. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3493. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3494. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3495. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3496. </ports>
  3497. <times srtt="394797" rttvar="6554" to="421013"/>
  3498. </host>
  3499. <host starttime="1606158577" endtime="1606172770"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3500. <address addr="139.60.162.19" addrtype="ipv4"/>
  3501. <hostnames>
  3502. </hostnames>
  3503. <ports><extraports state="closed" count="993">
  3504. <extrareasons reason="conn-refused" count="993"/>
  3505. </extraports>
  3506. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3507. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3508. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 139.60.162.19,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; LBBROWSER)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 139.60.162.19,/pixel.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3509. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3510. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  3511. <port protocol="tcp" portid="4444"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3512. <port protocol="tcp" portid="55056"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3513. </ports>
  3514. <times srtt="139742" rttvar="628" to="142254"/>
  3515. </host>
  3516. <host starttime="1606158578" endtime="1606172801"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3517. <address addr="137.59.16.168" addrtype="ipv4"/>
  3518. <hostnames>
  3519. </hostnames>
  3520. <ports><extraports state="closed" count="996">
  3521. <extrareasons reason="conn-refused" count="996"/>
  3522. </extraports>
  3523. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3524. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3525. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3526. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3527. </ports>
  3528. <times srtt="392466" rttvar="54522" to="610554"/>
  3529. </host>
  3530. <host starttime="1606158577" endtime="1606172745"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3531. <address addr="87.251.70.12" addrtype="ipv4"/>
  3532. <hostnames>
  3533. </hostnames>
  3534. <ports><extraports state="closed" count="995">
  3535. <extrareasons reason="conn-refused" count="995"/>
  3536. </extraports>
  3537. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3538. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3539. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3540. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3541. <port protocol="tcp" portid="55600"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3542. </ports>
  3543. <times srtt="264263" rttvar="503" to="266275"/>
  3544. </host>
  3545. <host starttime="1606158576" endtime="1606172748"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3546. <address addr="47.107.145.96" addrtype="ipv4"/>
  3547. <hostnames>
  3548. </hostnames>
  3549. <ports><extraports state="closed" count="994">
  3550. <extrareasons reason="conn-refused" count="994"/>
  3551. </extraports>
  3552. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3553. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3554. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3555. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3556. <port protocol="tcp" portid="2710"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sso-service" method="table" conf="3"/></port>
  3557. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3558. </ports>
  3559. <times srtt="359139" rttvar="1635" to="365679"/>
  3560. </host>
  3561. <host starttime="1606158576" endtime="1606172737"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3562. <address addr="139.180.199.171" addrtype="ipv4"/>
  3563. <hostnames>
  3564. <hostname name="139.180.199.171.vultr.com" type="PTR"/>
  3565. </hostnames>
  3566. <ports><extraports state="closed" count="990">
  3567. <extrareasons reason="conn-refused" count="990"/>
  3568. </extraports>
  3569. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3570. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3571. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3572. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3573. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3574. <port protocol="tcp" portid="6002"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="X11:2" method="table" conf="3"/></port>
  3575. <port protocol="tcp" portid="6007"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="X11:7" method="table" conf="3"/></port>
  3576. <port protocol="tcp" portid="9011"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="d-star" method="table" conf="3"/></port>
  3577. <port protocol="tcp" portid="10629"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3578. <port protocol="tcp" portid="13722"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbackup" method="table" conf="3"/></port>
  3579. </ports>
  3580. <times srtt="303116" rttvar="886" to="306660"/>
  3581. </host>
  3582. <host starttime="1606158577" endtime="1606172788"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3583. <address addr="104.131.210.108" addrtype="ipv4"/>
  3584. <hostnames>
  3585. </hostnames>
  3586. <ports><extraports state="closed" count="991">
  3587. <extrareasons reason="conn-refused" count="991"/>
  3588. </extraports>
  3589. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3590. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3591. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3592. <port protocol="tcp" portid="84"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ctf" method="table" conf="3"/></port>
  3593. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3594. <port protocol="tcp" portid="2366"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="qip-login" method="table" conf="3"/></port>
  3595. <port protocol="tcp" portid="8021"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ftp-proxy" method="table" conf="3"/></port>
  3596. <port protocol="tcp" portid="16080"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="osxwebadmin" method="table" conf="3"/></port>
  3597. <port protocol="tcp" portid="55056"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3598. </ports>
  3599. <times srtt="140969" rttvar="690" to="143729"/>
  3600. </host>
  3601. <host starttime="1606158577" endtime="1606172733"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3602. <address addr="129.226.183.250" addrtype="ipv4"/>
  3603. <hostnames>
  3604. </hostnames>
  3605. <ports><extraports state="closed" count="998">
  3606. <extrareasons reason="conn-refused" count="998"/>
  3607. </extraports>
  3608. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3609. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3610. </ports>
  3611. <times srtt="362438" rttvar="2532" to="372566"/>
  3612. </host>
  3613. <host starttime="1606158577" endtime="1606172737"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3614. <address addr="95.179.239.225" addrtype="ipv4"/>
  3615. <hostnames>
  3616. <hostname name="95.179.239.225.vultr.com" type="PTR"/>
  3617. </hostnames>
  3618. <ports><extraports state="closed" count="993">
  3619. <extrareasons reason="conn-refused" count="993"/>
  3620. </extraports>
  3621. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3622. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3623. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3624. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3625. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3626. <port protocol="tcp" portid="465"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  3627. <port protocol="tcp" portid="8292"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="blp3" method="table" conf="3"/></port>
  3628. </ports>
  3629. <times srtt="251070" rttvar="42179" to="419786"/>
  3630. </host>
  3631. <host starttime="1606158577" endtime="1606172801"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3632. <address addr="121.37.190.118" addrtype="ipv4"/>
  3633. <hostnames>
  3634. <hostname name="ecs-121-37-190-118.compute.hwclouds-dns.com" type="PTR"/>
  3635. </hostnames>
  3636. <ports><extraports state="closed" count="986">
  3637. <extrareasons reason="conn-refused" count="986"/>
  3638. </extraports>
  3639. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3640. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  3641. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3642. <port protocol="tcp" portid="85"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="mit-ml-dev" method="table" conf="3"/></port>
  3643. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  3644. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3645. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3646. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3647. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  3648. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  3649. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  3650. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  3651. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  3652. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3653. </ports>
  3654. <times srtt="334828" rttvar="1541" to="340992"/>
  3655. </host>
  3656. <host starttime="1606158577" endtime="1606172740"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3657. <address addr="134.209.210.89" addrtype="ipv4"/>
  3658. <hostnames>
  3659. </hostnames>
  3660. <ports><extraports state="closed" count="996">
  3661. <extrareasons reason="conn-refused" count="996"/>
  3662. </extraports>
  3663. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3664. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3665. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 134.209.210.89,/activity&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3666. <port protocol="tcp" portid="1080"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="socks" method="table" conf="3"/></port>
  3667. </ports>
  3668. <times srtt="141636" rttvar="1128" to="146148"/>
  3669. </host>
  3670. <host starttime="1606158577" endtime="1606172768"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3671. <address addr="119.28.9.129" addrtype="ipv4"/>
  3672. <hostnames>
  3673. </hostnames>
  3674. <ports><extraports state="closed" count="992">
  3675. <extrareasons reason="conn-refused" count="992"/>
  3676. </extraports>
  3677. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3678. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3679. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 119.28.9.129,/g.pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MALC)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 119.28.9.129,/updates.rss&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3680. <port protocol="tcp" portid="125"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="locus-map" method="table" conf="3"/></port>
  3681. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3682. <port protocol="tcp" portid="720"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3683. <port protocol="tcp" portid="1110"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nfsd-status" method="table" conf="3"/></port>
  3684. <port protocol="tcp" portid="15002"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="onep-tls" method="table" conf="3"/></port>
  3685. </ports>
  3686. <times srtt="361024" rttvar="3232" to="373952"/>
  3687. </host>
  3688. <host starttime="1606158576" endtime="1606172737"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3689. <address addr="121.37.23.161" addrtype="ipv4"/>
  3690. <hostnames>
  3691. <hostname name="ecs-121-37-23-161.compute.hwclouds-dns.com" type="PTR"/>
  3692. </hostnames>
  3693. <ports><extraports state="closed" count="993">
  3694. <extrareasons reason="conn-refused" count="993"/>
  3695. </extraports>
  3696. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3697. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3698. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3699. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3700. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3701. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3702. <port protocol="tcp" portid="7000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  3703. </ports>
  3704. <times srtt="359903" rttvar="2193" to="368675"/>
  3705. </host>
  3706. <host starttime="1606158578" endtime="1606172796"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3707. <address addr="132.232.94.126" addrtype="ipv4"/>
  3708. <hostnames>
  3709. </hostnames>
  3710. <ports><extraports state="closed" count="991">
  3711. <extrareasons reason="conn-refused" count="991"/>
  3712. </extraports>
  3713. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3714. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3715. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: www.skyp.xyz,/push&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENGB)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: www.skyp.xyz,/__utm.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENIN)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3716. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3717. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3718. <port protocol="tcp" portid="1126"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="hpvmmdata" method="table" conf="3"/></port>
  3719. <port protocol="tcp" portid="5566"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="westec-connect" method="table" conf="3"/></port>
  3720. <port protocol="tcp" portid="5718"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="dpm" method="table" conf="3"/></port>
  3721. <port protocol="tcp" portid="7000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  3722. </ports>
  3723. <times srtt="387779" rttvar="6499" to="413775"/>
  3724. </host>
  3725. <host starttime="1606158576" endtime="1606172801"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3726. <address addr="120.24.64.98" addrtype="ipv4"/>
  3727. <hostnames>
  3728. </hostnames>
  3729. <ports><extraports state="closed" count="992">
  3730. <extrareasons reason="conn-refused" count="992"/>
  3731. </extraports>
  3732. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3733. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3734. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3735. <port protocol="tcp" portid="90"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="dnsix" method="table" conf="3"/></port>
  3736. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3737. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3738. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3739. <port protocol="tcp" portid="4445"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="upnotifyp" method="table" conf="3"/></port>
  3740. </ports>
  3741. <times srtt="360604" rttvar="734" to="363540"/>
  3742. </host>
  3743. <host starttime="1606158577" endtime="1606172803"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3744. <address addr="47.75.123.100" addrtype="ipv4"/>
  3745. <hostnames>
  3746. </hostnames>
  3747. <ports><extraports state="filtered" count="993">
  3748. <extrareasons reason="no-responses" count="993"/>
  3749. </extraports>
  3750. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3751. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3752. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  3753. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3754. <port protocol="tcp" portid="995"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="pop3s" method="table" conf="3"/></port>
  3755. <port protocol="tcp" portid="999"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="garcon" method="table" conf="3"/></port>
  3756. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  3757. </ports>
  3758. <times srtt="363958" rttvar="5920" to="387638"/>
  3759. </host>
  3760. <host starttime="1606158577" endtime="1606172745"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3761. <address addr="135.181.1.70" addrtype="ipv4"/>
  3762. <hostnames>
  3763. <hostname name="static.70.1.181.135.clients.your-server.de" type="PTR"/>
  3764. </hostnames>
  3765. <ports><extraports state="closed" count="995">
  3766. <extrareasons reason="conn-refused" count="995"/>
  3767. </extraports>
  3768. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3769. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3770. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3771. <port protocol="tcp" portid="3689"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rendezvous" method="table" conf="3"/></port>
  3772. <port protocol="tcp" portid="6666"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="irc" method="table" conf="3"/></port>
  3773. </ports>
  3774. <times srtt="241495" rttvar="4036" to="257639"/>
  3775. </host>
  3776. <host starttime="1606158576" endtime="1606172768"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3777. <address addr="104.243.41.123" addrtype="ipv4"/>
  3778. <hostnames>
  3779. </hostnames>
  3780. <ports><extraports state="closed" count="995">
  3781. <extrareasons reason="conn-refused" count="995"/>
  3782. </extraports>
  3783. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3784. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3785. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: cuphq.com,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; NP06)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3786. <port protocol="tcp" portid="1095"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nicelink" method="table" conf="3"/></port>
  3787. <port protocol="tcp" portid="10243"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3788. </ports>
  3789. <times srtt="151936" rttvar="21313" to="237188"/>
  3790. </host>
  3791. <host starttime="1606158577" endtime="1606172799"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3792. <address addr="118.178.252.156" addrtype="ipv4"/>
  3793. <hostnames>
  3794. </hostnames>
  3795. <ports><extraports state="filtered" count="996">
  3796. <extrareasons reason="no-responses" count="996"/>
  3797. </extraports>
  3798. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3799. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3800. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3801. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3802. </ports>
  3803. <times srtt="339877" rttvar="4534" to="358013"/>
  3804. </host>
  3805. <host starttime="1606158576" endtime="1606172779"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3806. <address addr="106.14.0.74" addrtype="ipv4"/>
  3807. <hostnames>
  3808. </hostnames>
  3809. <ports><extraports state="closed" count="983">
  3810. <extrareasons reason="conn-refused" count="983"/>
  3811. </extraports>
  3812. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3813. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  3814. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3815. <port protocol="tcp" portid="111"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  3816. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  3817. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3818. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3819. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3820. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  3821. <port protocol="tcp" portid="1000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cadlock" method="table" conf="3"/></port>
  3822. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  3823. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  3824. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  3825. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  3826. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3827. <port protocol="tcp" portid="5001"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="commplex-link" method="table" conf="3"/></port>
  3828. <port protocol="tcp" portid="8088"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="radan-http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8088&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 106.14.0.74,/pixel.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8088&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 106.14.0.74,/j.ad&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3829. </ports>
  3830. <times srtt="334702" rttvar="2748" to="345694"/>
  3831. </host>
  3832. <host starttime="1606158576" endtime="1606172737"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3833. <address addr="108.160.140.17" addrtype="ipv4"/>
  3834. <hostnames>
  3835. <hostname name="108.160.140.17.vultr.com" type="PTR"/>
  3836. </hostnames>
  3837. <ports><extraports state="closed" count="995">
  3838. <extrareasons reason="conn-refused" count="995"/>
  3839. </extraports>
  3840. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3841. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3842. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3843. <port protocol="tcp" portid="648"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rrp" method="table" conf="3"/></port>
  3844. <port protocol="tcp" portid="2009"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="news" method="table" conf="3"/></port>
  3845. </ports>
  3846. <times srtt="303753" rttvar="886" to="307297"/>
  3847. </host>
  3848. <host starttime="1606158577" endtime="1606172740"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3849. <address addr="94.140.115.246" addrtype="ipv4"/>
  3850. <hostnames>
  3851. </hostnames>
  3852. <ports><extraports state="closed" count="992">
  3853. <extrareasons reason="conn-refused" count="992"/>
  3854. </extraports>
  3855. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3856. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3857. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 94.140.115.246,/pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 94.140.115.246,/cm&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3858. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  3859. <port protocol="tcp" portid="135"><state state="filtered" reason="host-unreach" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  3860. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3861. <port protocol="tcp" portid="2601"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="zebra" method="table" conf="3"/></port>
  3862. <port protocol="tcp" portid="6112"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="dtspc" method="table" conf="3"/></port>
  3863. </ports>
  3864. <times srtt="246440" rttvar="4172" to="263128"/>
  3865. </host>
  3866. <host starttime="1606158577" endtime="1606172732"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3867. <address addr="123.56.133.239" addrtype="ipv4"/>
  3868. <hostnames>
  3869. </hostnames>
  3870. <ports><extraports state="closed" count="996">
  3871. <extrareasons reason="conn-refused" count="996"/>
  3872. </extraports>
  3873. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3874. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3875. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  3876. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  3877. </ports>
  3878. <times srtt="371107" rttvar="4264" to="388163"/>
  3879. </host>
  3880. <host starttime="1606158577" endtime="1606172792"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3881. <address addr="23.227.194.115" addrtype="ipv4"/>
  3882. <hostnames>
  3883. <hostname name="23-227-194-115.static.hvvc.us" type="PTR"/>
  3884. </hostnames>
  3885. <ports><extraports state="closed" count="996">
  3886. <extrareasons reason="conn-refused" count="996"/>
  3887. </extraports>
  3888. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3889. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3890. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 23.227.194.115,/pixel.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; MASP)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 23.227.194.115,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3891. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3892. </ports>
  3893. <times srtt="154266" rttvar="1451" to="160070"/>
  3894. </host>
  3895. <host starttime="1606158577" endtime="1606172768"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3896. <address addr="111.229.163.55" addrtype="ipv4"/>
  3897. <hostnames>
  3898. </hostnames>
  3899. <ports><extraports state="closed" count="983">
  3900. <extrareasons reason="conn-refused" count="983"/>
  3901. </extraports>
  3902. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3903. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  3904. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3905. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3906. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  3907. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  3908. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3909. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3910. <port protocol="tcp" portid="465"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  3911. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  3912. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  3913. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  3914. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  3915. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  3916. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  3917. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  3918. <port protocol="tcp" portid="8899"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ospf-lite" method="table" conf="3"/></port>
  3919. </ports>
  3920. <times srtt="331949" rttvar="4148" to="348541"/>
  3921. </host>
  3922. <host starttime="1606158577" endtime="1606172737"><status state="up" reason="conn-refused" reason_ttl="0"/>
  3923. <address addr="129.226.15.142" addrtype="ipv4"/>
  3924. <hostnames>
  3925. </hostnames>
  3926. <ports><extraports state="closed" count="995">
  3927. <extrareasons reason="conn-refused" count="995"/>
  3928. </extraports>
  3929. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3930. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3931. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  3932. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3933. <port protocol="tcp" portid="1088"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cplscrambler-al" method="table" conf="3"/></port>
  3934. </ports>
  3935. <times srtt="365445" rttvar="4669" to="384121"/>
  3936. </host>
  3937. <host starttime="1606158577" endtime="1606172763"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3938. <address addr="116.62.49.176" addrtype="ipv4"/>
  3939. <hostnames>
  3940. </hostnames>
  3941. <ports><extraports state="closed" count="992">
  3942. <extrareasons reason="conn-refused" count="992"/>
  3943. </extraports>
  3944. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3945. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3946. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 116.62.49.176,/cx&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENIN)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 116.62.49.176,/push&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MDDCJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3947. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  3948. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3949. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  3950. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  3951. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  3952. </ports>
  3953. <times srtt="341007" rttvar="2851" to="352411"/>
  3954. </host>
  3955. <host starttime="1606158577" endtime="1606172788"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3956. <address addr="123.56.15.237" addrtype="ipv4"/>
  3957. <hostnames>
  3958. </hostnames>
  3959. <ports><extraports state="filtered" count="996">
  3960. <extrareasons reason="no-responses" count="994"/>
  3961. <extrareasons reason="host-unreaches" count="2"/>
  3962. </extraports>
  3963. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3964. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3965. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3966. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  3967. </ports>
  3968. <times srtt="352267" rttvar="1169" to="356943"/>
  3969. </host>
  3970. <host starttime="1606158576" endtime="1606172801"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3971. <address addr="128.14.230.80" addrtype="ipv4"/>
  3972. <hostnames>
  3973. </hostnames>
  3974. <ports><extraports state="closed" count="990">
  3975. <extrareasons reason="conn-refused" count="990"/>
  3976. </extraports>
  3977. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  3978. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3979. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 218.14.230.80,/activity&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 218.14.230.80,/push&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MALC)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  3980. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  3981. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3982. <port protocol="tcp" portid="3828"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="neteh" method="table" conf="3"/></port>
  3983. <port protocol="tcp" portid="5214"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  3984. <port protocol="tcp" portid="8021"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ftp-proxy" method="table" conf="3"/></port>
  3985. <port protocol="tcp" portid="16080"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="osxwebadmin" method="table" conf="3"/></port>
  3986. <port protocol="tcp" portid="32779"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sometimes-rpc21" method="table" conf="3"/></port>
  3987. </ports>
  3988. <times srtt="328166" rttvar="1209" to="333002"/>
  3989. </host>
  3990. <host starttime="1606158575" endtime="1606172798"><status state="up" reason="syn-ack" reason_ttl="0"/>
  3991. <address addr="103.147.12.5" addrtype="ipv4"/>
  3992. <hostnames>
  3993. </hostnames>
  3994. <ports><extraports state="closed" count="987">
  3995. <extrareasons reason="conn-refused" count="987"/>
  3996. </extraports>
  3997. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  3998. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  3999. <port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4000. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4001. <port protocol="tcp" portid="2000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cisco-sccp" method="table" conf="3"/></port>
  4002. <port protocol="tcp" portid="5060"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sip" method="table" conf="3"/></port>
  4003. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4004. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4005. <port protocol="tcp" portid="49157"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4006. <port protocol="tcp" portid="49158"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4007. <port protocol="tcp" portid="49159"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4008. <port protocol="tcp" portid="49161"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4009. <port protocol="tcp" portid="55555"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4010. </ports>
  4011. <times srtt="358511" rttvar="6465" to="384371"/>
  4012. </host>
  4013. <host starttime="1606158577" endtime="1606172737"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4014. <address addr="116.63.189.240" addrtype="ipv4"/>
  4015. <hostnames>
  4016. <hostname name="ecs-116-63-189-240.compute.hwclouds-dns.com" type="PTR"/>
  4017. </hostnames>
  4018. <ports><extraports state="closed" count="989">
  4019. <extrareasons reason="conn-refused" count="989"/>
  4020. </extraports>
  4021. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4022. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4023. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4024. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4025. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  4026. <port protocol="tcp" portid="9595"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pds" method="table" conf="3"/></port>
  4027. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4028. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4029. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4030. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4031. <port protocol="tcp" portid="49161"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4032. </ports>
  4033. <times srtt="375129" rttvar="2952" to="386937"/>
  4034. </host>
  4035. <host starttime="1606158576" endtime="1606172768"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4036. <address addr="35.225.244.45" addrtype="ipv4"/>
  4037. <hostnames>
  4038. <hostname name="45.244.225.35.bc.googleusercontent.com" type="PTR"/>
  4039. </hostnames>
  4040. <ports><extraports state="closed" count="985">
  4041. <extrareasons reason="conn-refused" count="985"/>
  4042. </extraports>
  4043. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4044. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4045. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4046. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4047. <port protocol="tcp" portid="900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="omginitialrefs" method="table" conf="3"/></port>
  4048. <port protocol="tcp" portid="1021"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="exp1" method="table" conf="3"/></port>
  4049. <port protocol="tcp" portid="1049"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="td-postman" method="table" conf="3"/></port>
  4050. <port protocol="tcp" portid="1503"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="imtc-mcs" method="table" conf="3"/></port>
  4051. <port protocol="tcp" portid="5998"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ncd-diag" method="table" conf="3"/></port>
  4052. <port protocol="tcp" portid="6666"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="irc" method="table" conf="3"/></port>
  4053. <port protocol="tcp" portid="7000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  4054. <port protocol="tcp" portid="7911"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4055. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4056. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  4057. <port protocol="tcp" portid="16012"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4058. </ports>
  4059. <times srtt="162464" rttvar="1210" to="167304"/>
  4060. </host>
  4061. <host starttime="1606158579" endtime="1606172801"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4062. <address addr="13.59.24.171" addrtype="ipv4"/>
  4063. <hostnames>
  4064. <hostname name="ec2-13-59-24-171.us-east-2.compute.amazonaws.com" type="PTR"/>
  4065. </hostnames>
  4066. <ports><extraports state="filtered" count="998">
  4067. <extrareasons reason="no-responses" count="998"/>
  4068. </extraports>
  4069. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4070. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4071. </ports>
  4072. <times srtt="161400" rttvar="20636" to="243944"/>
  4073. </host>
  4074. <host starttime="1606158578" endtime="1606172803"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4075. <address addr="103.150.8.146" addrtype="ipv4"/>
  4076. <hostnames>
  4077. </hostnames>
  4078. <ports><extraports state="filtered" count="991">
  4079. <extrareasons reason="host-unreaches" count="982"/>
  4080. <extrareasons reason="no-responses" count="9"/>
  4081. </extraports>
  4082. <port protocol="tcp" portid="20"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ftp-data" method="table" conf="3"/></port>
  4083. <port protocol="tcp" portid="21"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  4084. <port protocol="tcp" portid="22"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4085. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4086. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4087. <port protocol="tcp" portid="8443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/></port>
  4088. <port protocol="tcp" portid="8800"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="sunwebadmin" method="table" conf="3"/></port>
  4089. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  4090. <port protocol="tcp" portid="9000"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="cslistener" method="table" conf="3"/></port>
  4091. </ports>
  4092. <times srtt="306020" rttvar="5760" to="329060"/>
  4093. </host>
  4094. <host starttime="1606158576" endtime="1606172789"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4095. <address addr="108.177.235.22" addrtype="ipv4"/>
  4096. <hostnames>
  4097. </hostnames>
  4098. <ports><extraports state="closed" count="989">
  4099. <extrareasons reason="conn-refused" count="989"/>
  4100. </extraports>
  4101. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4102. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4103. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4104. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4105. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4106. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4107. <port protocol="tcp" portid="1102"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="adobeserver-1" method="table" conf="3"/></port>
  4108. <port protocol="tcp" portid="5959"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4109. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4110. <port protocol="tcp" portid="9415"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4111. <port protocol="tcp" portid="24444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4112. </ports>
  4113. <times srtt="192658" rttvar="822" to="195946"/>
  4114. </host>
  4115. <host starttime="1606158576" endtime="1606172801"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4116. <address addr="122.10.52.70" addrtype="ipv4"/>
  4117. <hostnames>
  4118. </hostnames>
  4119. <ports><extraports state="closed" count="991">
  4120. <extrareasons reason="conn-refused" count="991"/>
  4121. </extraports>
  4122. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4123. <port protocol="tcp" portid="111"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  4124. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4125. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4126. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4127. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4128. <port protocol="tcp" portid="888"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  4129. <port protocol="tcp" portid="5718"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="dpm" method="table" conf="3"/></port>
  4130. <port protocol="tcp" portid="10010"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rxapi" method="table" conf="3"/></port>
  4131. </ports>
  4132. <times srtt="358687" rttvar="6740" to="385647"/>
  4133. </host>
  4134. <host starttime="1606158578" endtime="1606172773"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4135. <address addr="120.55.14.10" addrtype="ipv4"/>
  4136. <hostnames>
  4137. </hostnames>
  4138. <ports><extraports state="closed" count="983">
  4139. <extrareasons reason="conn-refused" count="983"/>
  4140. </extraports>
  4141. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4142. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  4143. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4144. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 10000&#xa;Jitter: 0&#xa;Maxdns: 235&#xa;C2 Server: 120.55.14.10,/wp-content/themes/calliope/wp_data.php&#xa;User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36&#xa;HTTP Method Path 2: /jquery-3.3.2.min.js&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x04\x04&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 10000&#xa;Jitter: 0&#xa;Maxdns: 235&#xa;C2 Server: 120.55.14.10,/wp-content/themes/calliope/wp_data.php&#xa;User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36&#xa;HTTP Method Path 2: /jquery-3.3.2.min.js&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x04\x04&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4145. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4146. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4147. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4148. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4149. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  4150. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  4151. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  4152. <port protocol="tcp" portid="2030"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="device2" method="table" conf="3"/></port>
  4153. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  4154. <port protocol="tcp" portid="3871"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="avocent-adsap" method="table" conf="3"/></port>
  4155. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4156. <port protocol="tcp" portid="6669"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="irc" method="table" conf="3"/></port>
  4157. <port protocol="tcp" portid="16992"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="amt-soap-http" method="table" conf="3"/></port>
  4158. </ports>
  4159. <times srtt="333186" rttvar="4117" to="349654"/>
  4160. </host>
  4161. <host starttime="1606158577" endtime="1606172798"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4162. <address addr="13.56.8.205" addrtype="ipv4"/>
  4163. <hostnames>
  4164. <hostname name="ec2-13-56-8-205.us-west-1.compute.amazonaws.com" type="PTR"/>
  4165. </hostnames>
  4166. <ports><extraports state="filtered" count="999">
  4167. <extrareasons reason="no-responses" count="999"/>
  4168. </extraports>
  4169. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4170. </ports>
  4171. <times srtt="206029" rttvar="1193" to="210801"/>
  4172. </host>
  4173. <host starttime="1606158578" endtime="1606172798"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4174. <address addr="122.114.81.237" addrtype="ipv4"/>
  4175. <hostnames>
  4176. </hostnames>
  4177. <ports><extraports state="closed" count="990">
  4178. <extrareasons reason="conn-refused" count="990"/>
  4179. </extraports>
  4180. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4181. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4182. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 122.114.81.237,/ssphome/homeindex/contact/ad-device=games&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36&#xa;HTTP Method Path 2: /login/ad/user.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 122.114.81.237,/ssphome/homeindex/contact/ad-device=games&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/72.0.3626.121 Safari/537.36&#xa;HTTP Method Path 2: /login/ad/user.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4183. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4184. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4185. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4186. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4187. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  4188. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4189. <port protocol="tcp" portid="8090"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="opsmessaging" method="table" conf="3"/></port>
  4190. </ports>
  4191. <times srtt="399423" rttvar="11156" to="444047"/>
  4192. </host>
  4193. <host starttime="1606158577" endtime="1606172788"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4194. <address addr="118.107.41.104" addrtype="ipv4"/>
  4195. <hostnames>
  4196. </hostnames>
  4197. <ports><extraports state="closed" count="994">
  4198. <extrareasons reason="conn-refused" count="994"/>
  4199. </extraports>
  4200. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4201. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4202. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4203. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4204. <port protocol="tcp" portid="1900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="upnp" method="table" conf="3"/></port>
  4205. <port protocol="tcp" portid="8899"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ospf-lite" method="table" conf="3"/></port>
  4206. </ports>
  4207. <times srtt="363100" rttvar="5152" to="383708"/>
  4208. </host>
  4209. <host starttime="1606158576" endtime="1606172807"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4210. <address addr="113.31.118.7" addrtype="ipv4"/>
  4211. <hostnames>
  4212. </hostnames>
  4213. <ports><extraports state="closed" count="978">
  4214. <extrareasons reason="conn-refused" count="978"/>
  4215. </extraports>
  4216. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4217. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  4218. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4219. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 113.31.118.7,/updates.rss&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C; .NET4.0E)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 113.31.118.7,/__utm.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MASB)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4220. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  4221. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4222. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4223. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4224. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4225. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  4226. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  4227. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  4228. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  4229. <port protocol="tcp" portid="2021"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="servexec" method="table" conf="3"/></port>
  4230. <port protocol="tcp" portid="2222"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="EtherNetIP-1" method="table" conf="3"/></port>
  4231. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  4232. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4233. <port protocol="tcp" portid="8082"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-alerts" method="table" conf="3"/></port>
  4234. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  4235. <port protocol="tcp" portid="9110"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4236. <port protocol="tcp" portid="16992"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="amt-soap-http" method="table" conf="3"/></port>
  4237. <port protocol="tcp" portid="62078"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="iphone-sync" method="table" conf="3"/></port>
  4238. </ports>
  4239. <times srtt="337176" rttvar="3226" to="350080"/>
  4240. </host>
  4241. <host starttime="1606158577" endtime="1606172748"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4242. <address addr="103.143.81.177" addrtype="ipv4"/>
  4243. <hostnames>
  4244. </hostnames>
  4245. <ports><extraports state="closed" count="994">
  4246. <extrareasons reason="conn-refused" count="994"/>
  4247. </extraports>
  4248. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4249. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4250. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4251. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4252. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  4253. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4254. </ports>
  4255. <times srtt="389344" rttvar="10103" to="429756"/>
  4256. </host>
  4257. <host starttime="1606158576" endtime="1606172801"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4258. <address addr="117.51.149.186" addrtype="ipv4"/>
  4259. <hostnames>
  4260. </hostnames>
  4261. <ports><extraports state="closed" count="985">
  4262. <extrareasons reason="conn-refused" count="985"/>
  4263. </extraports>
  4264. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4265. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4266. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4267. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  4268. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4269. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4270. <port protocol="tcp" portid="1524"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ingreslock" method="table" conf="3"/></port>
  4271. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  4272. <port protocol="tcp" portid="3828"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="neteh" method="table" conf="3"/></port>
  4273. <port protocol="tcp" portid="5214"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4274. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  4275. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  4276. <port protocol="tcp" portid="8009"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ajp13" method="table" conf="3"/></port>
  4277. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4278. <port protocol="tcp" portid="9101"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="jetdirect" method="table" conf="3"/></port>
  4279. </ports>
  4280. <times srtt="350883" rttvar="1290" to="356043"/>
  4281. </host>
  4282. <host starttime="1606158578" endtime="1606172801"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4283. <address addr="120.79.38.19" addrtype="ipv4"/>
  4284. <hostnames>
  4285. </hostnames>
  4286. <ports><extraports state="closed" count="969">
  4287. <extrareasons reason="conn-refused" count="969"/>
  4288. </extraports>
  4289. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  4290. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4291. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4292. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4293. <port protocol="tcp" portid="82"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="xfer" method="table" conf="3"/></port>
  4294. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4295. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4296. <port protocol="tcp" portid="888"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  4297. <port protocol="tcp" portid="1024"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="kdm" method="table" conf="3"/></port>
  4298. <port protocol="tcp" portid="2045"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cdfunc" method="table" conf="3"/></port>
  4299. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  4300. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4301. <port protocol="tcp" portid="9999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="abyss" method="table" conf="3"/></port>
  4302. <port protocol="tcp" portid="55555"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4303. <port protocol="tcp" portid="55600"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4304. <port protocol="tcp" portid="56737"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4305. <port protocol="tcp" portid="56738"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4306. <port protocol="tcp" portid="57294"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4307. <port protocol="tcp" portid="57797"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4308. <port protocol="tcp" portid="58080"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4309. <port protocol="tcp" portid="60020"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4310. <port protocol="tcp" portid="60443"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4311. <port protocol="tcp" portid="61532"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4312. <port protocol="tcp" portid="61900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4313. <port protocol="tcp" portid="62078"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="iphone-sync" method="table" conf="3"/></port>
  4314. <port protocol="tcp" portid="63331"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4315. <port protocol="tcp" portid="64623"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4316. <port protocol="tcp" portid="64680"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4317. <port protocol="tcp" portid="65000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4318. <port protocol="tcp" portid="65129"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4319. <port protocol="tcp" portid="65389"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4320. </ports>
  4321. <times srtt="362073" rttvar="1807" to="369301"/>
  4322. </host>
  4323. <host starttime="1606158576" endtime="1606172798"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4324. <address addr="106.55.153.204" addrtype="ipv4"/>
  4325. <hostnames>
  4326. </hostnames>
  4327. <ports><extraports state="closed" count="990">
  4328. <extrareasons reason="conn-refused" count="990"/>
  4329. </extraports>
  4330. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4331. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  4332. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4333. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4334. <port protocol="tcp" portid="901"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="samba-swat" method="table" conf="3"/></port>
  4335. <port protocol="tcp" portid="1025"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  4336. <port protocol="tcp" portid="1049"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="td-postman" method="table" conf="3"/></port>
  4337. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4338. <port protocol="tcp" portid="5901"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vnc-1" method="table" conf="3"/></port>
  4339. <port protocol="tcp" portid="6543"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mythtv" method="table" conf="3"/></port>
  4340. </ports>
  4341. <times srtt="362526" rttvar="2640" to="373086"/>
  4342. </host>
  4343. <host starttime="1606158577" endtime="1606172737"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4344. <address addr="111.229.51.128" addrtype="ipv4"/>
  4345. <hostnames>
  4346. </hostnames>
  4347. <ports><extraports state="closed" count="986">
  4348. <extrareasons reason="conn-refused" count="986"/>
  4349. </extraports>
  4350. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4351. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  4352. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4353. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4354. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4355. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4356. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4357. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  4358. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  4359. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  4360. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  4361. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  4362. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4363. <port protocol="tcp" portid="7000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  4364. </ports>
  4365. <times srtt="331881" rttvar="1215" to="336741"/>
  4366. </host>
  4367. <host starttime="1606158578" endtime="1606172763"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4368. <address addr="119.45.5.195" addrtype="ipv4"/>
  4369. <hostnames>
  4370. </hostnames>
  4371. <ports><extraports state="closed" count="973">
  4372. <extrareasons reason="conn-refused" count="973"/>
  4373. </extraports>
  4374. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4375. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4376. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4377. <port protocol="tcp" portid="264"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="bgmp" method="table" conf="3"/></port>
  4378. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4379. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4380. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4381. <port protocol="tcp" portid="5001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="commplex-link" method="table" conf="3"/></port>
  4382. <port protocol="tcp" portid="5002"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rfe" method="table" conf="3"/></port>
  4383. <port protocol="tcp" portid="5003"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="filemaker" method="table" conf="3"/></port>
  4384. <port protocol="tcp" portid="5004"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="avt-profile-1" method="table" conf="3"/></port>
  4385. <port protocol="tcp" portid="5009"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="airport-admin" method="table" conf="3"/></port>
  4386. <port protocol="tcp" portid="5030"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="surfpass" method="table" conf="3"/></port>
  4387. <port protocol="tcp" portid="5033"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="jtnetd-server" method="table" conf="3"/></port>
  4388. <port protocol="tcp" portid="5050"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mmcc" method="table" conf="3"/></port>
  4389. <port protocol="tcp" portid="5051"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ida-agent" method="table" conf="3"/></port>
  4390. <port protocol="tcp" portid="5054"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rlm-admin" method="table" conf="3"/></port>
  4391. <port protocol="tcp" portid="5060"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sip" method="table" conf="3"/></port>
  4392. <port protocol="tcp" portid="5061"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sip-tls" method="table" conf="3"/></port>
  4393. <port protocol="tcp" portid="5080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="onscreen" method="table" conf="3"/></port>
  4394. <port protocol="tcp" portid="5087"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="biotic" method="table" conf="3"/></port>
  4395. <port protocol="tcp" portid="5100"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="admd" method="table" conf="3"/></port>
  4396. <port protocol="tcp" portid="5101"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="admdog" method="table" conf="3"/></port>
  4397. <port protocol="tcp" portid="5102"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="admeng" method="table" conf="3"/></port>
  4398. <port protocol="tcp" portid="5120"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="barracuda-bbs" method="table" conf="3"/></port>
  4399. <port protocol="tcp" portid="5200"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="targus-getdata" method="table" conf="3"/></port>
  4400. <port protocol="tcp" portid="8082"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-alerts" method="table" conf="3"/></port>
  4401. </ports>
  4402. <times srtt="335113" rttvar="4131" to="351637"/>
  4403. </host>
  4404. <host starttime="1606158575" endtime="1606172733"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4405. <address addr="124.70.43.4" addrtype="ipv4"/>
  4406. <hostnames>
  4407. <hostname name="ecs-124-70-43-4.compute.hwclouds-dns.com" type="PTR"/>
  4408. </hostnames>
  4409. <ports><extraports state="closed" count="991">
  4410. <extrareasons reason="conn-refused" count="991"/>
  4411. </extraports>
  4412. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4413. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4414. <port protocol="tcp" portid="264"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="bgmp" method="table" conf="3"/></port>
  4415. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4416. <port protocol="tcp" portid="1107"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="isoipsigport-2" method="table" conf="3"/></port>
  4417. <port protocol="tcp" portid="3000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ppp" method="table" conf="3"/></port>
  4418. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  4419. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  4420. <port protocol="tcp" portid="13722"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbackup" method="table" conf="3"/></port>
  4421. </ports>
  4422. <times srtt="392476" rttvar="33048" to="524668"/>
  4423. </host>
  4424. <host starttime="1606158576" endtime="1606172763"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4425. <address addr="114.118.5.108" addrtype="ipv4"/>
  4426. <hostnames>
  4427. </hostnames>
  4428. <ports><extraports state="closed" count="941">
  4429. <extrareasons reason="conn-refused" count="941"/>
  4430. </extraports>
  4431. <extraports state="filtered" count="55">
  4432. <extrareasons reason="no-responses" count="55"/>
  4433. </extraports>
  4434. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 111.231.74.70,/pixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 111.231.74.70,/dpixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0b; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4435. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4436. <port protocol="tcp" portid="2222"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="EtherNetIP-1" method="table" conf="3"/></port>
  4437. <port protocol="tcp" portid="10001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="scp-config" method="table" conf="3"/></port>
  4438. </ports>
  4439. <times srtt="367061" rttvar="10018" to="407133"/>
  4440. </host>
  4441. <host starttime="1606158577" endtime="1606172771"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4442. <address addr="91.229.77.41" addrtype="ipv4"/>
  4443. <hostnames>
  4444. <hostname name="91.229.77.41.deltahost-ptr" type="PTR"/>
  4445. </hostnames>
  4446. <ports><extraports state="closed" count="993">
  4447. <extrareasons reason="conn-refused" count="993"/>
  4448. </extraports>
  4449. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4450. <port protocol="tcp" portid="389"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldap" method="table" conf="3"/></port>
  4451. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4452. <port protocol="tcp" portid="500"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="isakmp" method="table" conf="3"/></port>
  4453. <port protocol="tcp" portid="1080"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="socks" method="table" conf="3"/></port>
  4454. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4455. <port protocol="tcp" portid="44176"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4456. </ports>
  4457. <times srtt="253740" rttvar="818" to="257012"/>
  4458. </host>
  4459. <host starttime="1606158577" endtime="1606172801"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4460. <address addr="119.29.111.190" addrtype="ipv4"/>
  4461. <hostnames>
  4462. </hostnames>
  4463. <ports><extraports state="closed" count="986">
  4464. <extrareasons reason="conn-refused" count="986"/>
  4465. </extraports>
  4466. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4467. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4468. <port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4469. <port protocol="tcp" portid="139"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4470. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4471. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4472. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  4473. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4474. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4475. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4476. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4477. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4478. <port protocol="tcp" portid="49156"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4479. <port protocol="tcp" portid="49160"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4480. </ports>
  4481. <times srtt="357827" rttvar="1357" to="363255"/>
  4482. </host>
  4483. <host starttime="1606158576" endtime="1606172803"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4484. <address addr="117.50.106.161" addrtype="ipv4"/>
  4485. <hostnames>
  4486. </hostnames>
  4487. <ports><extraports state="filtered" count="989">
  4488. <extrareasons reason="no-responses" count="989"/>
  4489. </extraports>
  4490. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4491. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4492. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  4493. <port protocol="tcp" portid="81"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  4494. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4495. <port protocol="tcp" portid="3389"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  4496. <port protocol="tcp" portid="3390"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="dsc" method="table" conf="3"/></port>
  4497. <port protocol="tcp" portid="7000"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  4498. <port protocol="tcp" portid="7443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="oracleas-https" method="table" conf="3"/></port>
  4499. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  4500. <port protocol="tcp" portid="8443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/></port>
  4501. </ports>
  4502. <times srtt="357743" rttvar="1818" to="365015"/>
  4503. </host>
  4504. <host starttime="1606158577" endtime="1606172779"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4505. <address addr="47.103.41.75" addrtype="ipv4"/>
  4506. <hostnames>
  4507. </hostnames>
  4508. <ports><extraports state="closed" count="979">
  4509. <extrareasons reason="conn-refused" count="979"/>
  4510. </extraports>
  4511. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4512. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  4513. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4514. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.168.1.135,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.168.1.135,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4515. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4516. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4517. <port protocol="tcp" portid="255"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4518. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4519. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4520. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  4521. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  4522. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  4523. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  4524. <port protocol="tcp" portid="2702"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sms-xfer" method="table" conf="3"/></port>
  4525. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  4526. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  4527. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4528. <port protocol="tcp" portid="5678"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rrac" method="table" conf="3"/></port>
  4529. <port protocol="tcp" portid="7070"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="realserver" method="table" conf="3"/></port>
  4530. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4531. <port protocol="tcp" portid="9000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cslistener" method="table" conf="3"/></port>
  4532. </ports>
  4533. <times srtt="362831" rttvar="4721" to="381715"/>
  4534. </host>
  4535. <host starttime="1606158577" endtime="1606172792"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4536. <address addr="47.97.116.203" addrtype="ipv4"/>
  4537. <hostnames>
  4538. </hostnames>
  4539. <ports><extraports state="filtered" count="993">
  4540. <extrareasons reason="no-responses" count="993"/>
  4541. </extraports>
  4542. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4543. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4544. <port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4545. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4546. <port protocol="tcp" portid="2000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cisco-sccp" method="table" conf="3"/></port>
  4547. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4548. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4549. </ports>
  4550. <times srtt="350456" rttvar="4492" to="368424"/>
  4551. </host>
  4552. <host starttime="1606158576" endtime="1606172792"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4553. <address addr="87.120.37.89" addrtype="ipv4"/>
  4554. <hostnames>
  4555. </hostnames>
  4556. <ports><extraports state="closed" count="994">
  4557. <extrareasons reason="conn-refused" count="994"/>
  4558. </extraports>
  4559. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4560. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4561. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 10000&#xa;Jitter: 30&#xa;Maxdns: 255&#xa;C2 Server: 87.120.37.89,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 10000&#xa;Jitter: 30&#xa;Maxdns: 255&#xa;C2 Server: 87.120.37.89,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4562. <port protocol="tcp" portid="389"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldap" method="table" conf="3"/></port>
  4563. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4564. <port protocol="tcp" portid="1062"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="veracity" method="table" conf="3"/></port>
  4565. </ports>
  4566. <times srtt="349034" rttvar="54282" to="566162"/>
  4567. </host>
  4568. <host starttime="1606158577" endtime="1606172798"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4569. <address addr="103.234.72.32" addrtype="ipv4"/>
  4570. <hostnames>
  4571. </hostnames>
  4572. <ports><extraports state="closed" count="995">
  4573. <extrareasons reason="conn-refused" count="995"/>
  4574. </extraports>
  4575. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4576. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4577. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4578. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  4579. <port protocol="tcp" portid="1107"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="isoipsigport-2" method="table" conf="3"/></port>
  4580. </ports>
  4581. <times srtt="321170" rttvar="2451" to="330974"/>
  4582. </host>
  4583. <host starttime="1606158576" endtime="1606172741"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4584. <address addr="39.98.250.32" addrtype="ipv4"/>
  4585. <hostnames>
  4586. </hostnames>
  4587. <ports><extraports state="closed" count="987">
  4588. <extrareasons reason="conn-refused" count="987"/>
  4589. </extraports>
  4590. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4591. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4592. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4593. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4594. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4595. <port protocol="tcp" portid="987"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4596. <port protocol="tcp" portid="990"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ftps" method="table" conf="3"/></port>
  4597. <port protocol="tcp" portid="1914"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="elm-momentum" method="table" conf="3"/></port>
  4598. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  4599. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  4600. <port protocol="tcp" portid="6059"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="X11:59" method="table" conf="3"/></port>
  4601. <port protocol="tcp" portid="12345"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbus" method="table" conf="3"/></port>
  4602. <port protocol="tcp" portid="49999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4603. </ports>
  4604. <times srtt="380006" rttvar="2068" to="388278"/>
  4605. </host>
  4606. <host starttime="1606158576" endtime="1606172794"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4607. <address addr="106.53.20.202" addrtype="ipv4"/>
  4608. <hostnames>
  4609. </hostnames>
  4610. <ports><extraports state="closed" count="993">
  4611. <extrareasons reason="conn-refused" count="993"/>
  4612. </extraports>
  4613. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4614. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4615. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4616. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4617. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4618. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4619. <port protocol="tcp" portid="5678"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rrac" method="table" conf="3"/></port>
  4620. </ports>
  4621. <times srtt="356737" rttvar="2600" to="367137"/>
  4622. </host>
  4623. <host starttime="1606158577" endtime="1606172784"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4624. <address addr="45.76.48.40" addrtype="ipv4"/>
  4625. <hostnames>
  4626. <hostname name="45.76.48.40.vultr.com" type="PTR"/>
  4627. </hostnames>
  4628. <ports><extraports state="closed" count="992">
  4629. <extrareasons reason="conn-refused" count="992"/>
  4630. </extraports>
  4631. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4632. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.76.48.40,/load&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.76.48.40,/load&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; ASU2JS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4633. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  4634. <port protocol="tcp" portid="90"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="dnsix" method="table" conf="3"/></port>
  4635. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4636. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.76.48.40,/j.ad&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; XBLWP7; ZuneWP7)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.76.48.40,/updates.rss&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENCA)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4637. <port protocol="tcp" portid="8090"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="opsmessaging" method="table" conf="3"/></port>
  4638. <port protocol="tcp" portid="9001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="tor-orport" method="table" conf="3"/></port>
  4639. </ports>
  4640. <times srtt="302611" rttvar="490" to="304571"/>
  4641. </host>
  4642. <host starttime="1606158578" endtime="1606172778"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4643. <address addr="108.160.136.100" addrtype="ipv4"/>
  4644. <hostnames>
  4645. <hostname name="108.160.136.100.vultr.com" type="PTR"/>
  4646. </hostnames>
  4647. <ports><extraports state="closed" count="988">
  4648. <extrareasons reason="conn-refused" count="988"/>
  4649. </extraports>
  4650. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4651. <port protocol="tcp" portid="49"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="tacacs" method="table" conf="3"/></port>
  4652. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4653. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4654. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4655. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4656. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4657. <port protocol="tcp" portid="1300"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="h323hostcallsc" method="table" conf="3"/></port>
  4658. <port protocol="tcp" portid="1688"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nsjtp-data" method="table" conf="3"/></port>
  4659. <port protocol="tcp" portid="5214"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4660. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4661. <port protocol="tcp" portid="14441"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4662. </ports>
  4663. <times srtt="302882" rttvar="1140" to="307442"/>
  4664. </host>
  4665. <host starttime="1606158577" endtime="1606172801"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4666. <address addr="118.126.100.187" addrtype="ipv4"/>
  4667. <hostnames>
  4668. </hostnames>
  4669. <ports><extraports state="closed" count="991">
  4670. <extrareasons reason="conn-refused" count="991"/>
  4671. </extraports>
  4672. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4673. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4674. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4675. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4676. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4677. <port protocol="tcp" portid="5555"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="freeciv" method="table" conf="3"/></port>
  4678. <port protocol="tcp" portid="5730"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unieng" method="table" conf="3"/></port>
  4679. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4680. <port protocol="tcp" portid="8083"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="us-srv" method="table" conf="3"/></port>
  4681. </ports>
  4682. <times srtt="357545" rttvar="1816" to="364809"/>
  4683. </host>
  4684. <host starttime="1606158576" endtime="1606172783"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4685. <address addr="108.166.207.133" addrtype="ipv4"/>
  4686. <hostnames>
  4687. <hostname name="133-207-166-108-dedicated.multacom.com" type="PTR"/>
  4688. </hostnames>
  4689. <ports><extraports state="closed" count="994">
  4690. <extrareasons reason="conn-refused" count="994"/>
  4691. </extraports>
  4692. <port protocol="tcp" portid="3"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="compressnet" method="table" conf="3"/></port>
  4693. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4694. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 108.166.207.133,/cm&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 108.166.207.133,/pixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.4; .NET4.0C)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4695. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4696. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  4697. <port protocol="tcp" portid="3828"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="neteh" method="table" conf="3"/></port>
  4698. </ports>
  4699. <times srtt="195472" rttvar="769" to="198548"/>
  4700. </host>
  4701. <host starttime="1606158576" endtime="1606176240"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4702. <address addr="52.166.232.140" addrtype="ipv4"/>
  4703. <hostnames>
  4704. </hostnames>
  4705. <ports><extraports state="filtered" count="997">
  4706. <extrareasons reason="no-responses" count="997"/>
  4707. </extraports>
  4708. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4709. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  4710. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4711. </ports>
  4712. <times srtt="220979" rttvar="5296" to="242163"/>
  4713. </host>
  4714. <host starttime="1606158577" endtime="1606176169"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4715. <address addr="39.106.21.92" addrtype="ipv4"/>
  4716. <hostnames>
  4717. </hostnames>
  4718. <ports><extraports state="closed" count="994">
  4719. <extrareasons reason="conn-refused" count="994"/>
  4720. </extraports>
  4721. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4722. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4723. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4724. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  4725. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  4726. <port protocol="tcp" portid="7000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  4727. </ports>
  4728. <times srtt="352397" rttvar="899" to="355993"/>
  4729. </host>
  4730. <host starttime="1606158575" endtime="1606176175"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4731. <address addr="103.143.208.3" addrtype="ipv4"/>
  4732. <hostnames>
  4733. </hostnames>
  4734. <ports><extraports state="closed" count="987">
  4735. <extrareasons reason="conn-refused" count="987"/>
  4736. </extraports>
  4737. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4738. <port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4739. <port protocol="tcp" portid="139"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4740. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4741. <port protocol="tcp" portid="445"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4742. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  4743. <port protocol="tcp" portid="5000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="upnp" method="table" conf="3"/></port>
  4744. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4745. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4746. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4747. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4748. <port protocol="tcp" portid="49156"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4749. <port protocol="tcp" portid="49157"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4750. </ports>
  4751. <times srtt="419604" rttvar="2863" to="431056"/>
  4752. </host>
  4753. <host starttime="1606158578" endtime="1606176244"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4754. <address addr="108.62.118.37" addrtype="ipv4"/>
  4755. <hostnames>
  4756. <hostname name="static-108-62-118-37.nextroute.co" type="PTR"/>
  4757. </hostnames>
  4758. <ports><extraports state="closed" count="992">
  4759. <extrareasons reason="conn-refused" count="992"/>
  4760. </extraports>
  4761. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4762. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4763. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.trade,/ga.js&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.trade,/dpixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.3; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4764. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4765. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4766. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.trade,/ga.js&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET4.0C; .NET4.0E)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4767. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4768. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  4769. </ports>
  4770. <times srtt="134832" rttvar="1403" to="140444"/>
  4771. </host>
  4772. <host starttime="1606158576" endtime="1606176218"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4773. <address addr="109.201.142.110" addrtype="ipv4"/>
  4774. <hostnames>
  4775. <hostname name="pool.laughingmoonmusic.com" type="PTR"/>
  4776. </hostnames>
  4777. <ports><extraports state="closed" count="996">
  4778. <extrareasons reason="conn-refused" count="996"/>
  4779. </extraports>
  4780. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4781. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4782. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: forteupdate.com,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; ; NCLIENT50_AAPCDA5841E333)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: forteupdate.com,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALCJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4783. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: forteupdate.com,/activity&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; QQDownload 733; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4784. </ports>
  4785. <times srtt="218803" rttvar="2040" to="226963"/>
  4786. </host>
  4787. <host starttime="1606158576" endtime="1606176175"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4788. <address addr="3.122.109.210" addrtype="ipv4"/>
  4789. <hostnames>
  4790. <hostname name="ec2-3-122-109-210.eu-central-1.compute.amazonaws.com" type="PTR"/>
  4791. </hostnames>
  4792. <ports><extraports state="filtered" count="998">
  4793. <extrareasons reason="no-responses" count="998"/>
  4794. </extraports>
  4795. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  4796. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4797. </ports>
  4798. <times srtt="224771" rttvar="1860" to="232211"/>
  4799. </host>
  4800. <host starttime="1606158577" endtime="1606176186"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4801. <address addr="100.24.56.227" addrtype="ipv4"/>
  4802. <hostnames>
  4803. <hostname name="ec2-100-24-56-227.compute-1.amazonaws.com" type="PTR"/>
  4804. </hostnames>
  4805. <ports><extraports state="filtered" count="997">
  4806. <extrareasons reason="no-responses" count="997"/>
  4807. </extraports>
  4808. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4809. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4810. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4811. </ports>
  4812. <times srtt="135073" rttvar="1194" to="139849"/>
  4813. </host>
  4814. <host starttime="1606158576" endtime="1606176236"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4815. <address addr="106.75.67.182" addrtype="ipv4"/>
  4816. <hostnames>
  4817. </hostnames>
  4818. <ports><extraports state="closed" count="991">
  4819. <extrareasons reason="conn-refused" count="991"/>
  4820. </extraports>
  4821. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4822. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4823. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 106.75.67.182,/__utm.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 106.75.67.182,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSE)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4824. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  4825. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4826. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4827. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  4828. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  4829. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  4830. </ports>
  4831. <times srtt="358588" rttvar="5769" to="381664"/>
  4832. </host>
  4833. <host starttime="1606158577" endtime="1606176261"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4834. <address addr="81.70.213.71" addrtype="ipv4"/>
  4835. <hostnames>
  4836. </hostnames>
  4837. <ports><extraports state="closed" count="991">
  4838. <extrareasons reason="conn-refused" count="991"/>
  4839. </extraports>
  4840. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4841. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4842. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 10000&#xa;Jitter: 0&#xa;Maxdns: 235&#xa;C2 Server: 81.70.213.71,/wp-content/themes/calliope/wp_data.php&#xa;User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36&#xa;HTTP Method Path 2: /jquery-3.3.2.min.js&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x04\x04&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 10000&#xa;Jitter: 0&#xa;Maxdns: 235&#xa;C2 Server: 81.70.213.71,/wp-content/themes/calliope/wp_data.php&#xa;User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36&#xa;HTTP Method Path 2: /jquery-3.3.2.min.js&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x04\x04&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4843. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4844. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4845. <port protocol="tcp" portid="4004"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pxc-roid" method="table" conf="3"/></port>
  4846. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  4847. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  4848. <port protocol="tcp" portid="7001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-callback" method="table" conf="3"/></port>
  4849. </ports>
  4850. <times srtt="355778" rttvar="5039" to="375934"/>
  4851. </host>
  4852. <host starttime="1606158576" endtime="1606176234"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4853. <address addr="13.64.101.24" addrtype="ipv4"/>
  4854. <hostnames>
  4855. </hostnames>
  4856. <ports><extraports state="filtered" count="998">
  4857. <extrareasons reason="no-responses" count="998"/>
  4858. </extraports>
  4859. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4860. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4861. </ports>
  4862. <times srtt="202371" rttvar="3316" to="215635"/>
  4863. </host>
  4864. <host starttime="1606158577" endtime="1606176247"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4865. <address addr="47.112.16.34" addrtype="ipv4"/>
  4866. <hostnames>
  4867. </hostnames>
  4868. <ports><extraports state="closed" count="991">
  4869. <extrareasons reason="conn-refused" count="991"/>
  4870. </extraports>
  4871. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  4872. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4873. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4874. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4875. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4876. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4877. <port protocol="tcp" portid="1072"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cardax" method="table" conf="3"/></port>
  4878. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  4879. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  4880. </ports>
  4881. <times srtt="361923" rttvar="2433" to="371655"/>
  4882. </host>
  4883. <host starttime="1606158577" endtime="1606176254"><status state="up" reason="conn-refused" reason_ttl="0"/>
  4884. <address addr="108.61.200.55" addrtype="ipv4"/>
  4885. <hostnames>
  4886. <hostname name="108.61.200.55.vultr.com" type="PTR"/>
  4887. </hostnames>
  4888. <ports><extraports state="closed" count="996">
  4889. <extrareasons reason="conn-refused" count="996"/>
  4890. </extraports>
  4891. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4892. <port protocol="tcp" portid="222"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rsh-spx" method="table" conf="3"/></port>
  4893. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4894. <port protocol="tcp" portid="4000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="remoteanything" method="table" conf="3"/></port>
  4895. </ports>
  4896. <times srtt="303082" rttvar="484" to="305018"/>
  4897. </host>
  4898. <host starttime="1606158576" endtime="1606176173"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4899. <address addr="104.41.130.190" addrtype="ipv4"/>
  4900. <hostnames>
  4901. </hostnames>
  4902. <ports><extraports state="filtered" count="998">
  4903. <extrareasons reason="no-responses" count="998"/>
  4904. </extraports>
  4905. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4906. <port protocol="tcp" portid="10082"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="amandaidx" method="table" conf="3"/></port>
  4907. </ports>
  4908. <times srtt="135539" rttvar="857" to="138967"/>
  4909. </host>
  4910. <host starttime="1606158577" endtime="1606176175"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4911. <address addr="18.180.199.201" addrtype="ipv4"/>
  4912. <hostnames>
  4913. <hostname name="ec2-18-180-199-201.ap-northeast-1.compute.amazonaws.com" type="PTR"/>
  4914. </hostnames>
  4915. <ports><extraports state="closed" count="996">
  4916. <extrareasons reason="conn-refused" count="996"/>
  4917. </extraports>
  4918. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4919. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4920. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4921. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4922. </ports>
  4923. <times srtt="363254" rttvar="11991" to="411218"/>
  4924. </host>
  4925. <host starttime="1606158576" endtime="1606176198"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4926. <address addr="92.42.14.133" addrtype="ipv4"/>
  4927. <hostnames>
  4928. </hostnames>
  4929. <ports><extraports state="closed" count="991">
  4930. <extrareasons reason="conn-refused" count="991"/>
  4931. </extraports>
  4932. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4933. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 92.42.14.133,/cm&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; UHS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 92.42.14.133,/ptj&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  4934. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4935. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4936. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4937. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4938. <port protocol="tcp" portid="8000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/></port>
  4939. <port protocol="tcp" portid="9090"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="zeus-admin" method="table" conf="3"/></port>
  4940. <port protocol="tcp" portid="9999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="abyss" method="table" conf="3"/></port>
  4941. </ports>
  4942. <times srtt="242326" rttvar="4557" to="260554"/>
  4943. </host>
  4944. <host starttime="1606158577" endtime="1606176234"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4945. <address addr="101.200.229.41" addrtype="ipv4"/>
  4946. <hostnames>
  4947. </hostnames>
  4948. <ports><extraports state="closed" count="987">
  4949. <extrareasons reason="conn-refused" count="987"/>
  4950. </extraports>
  4951. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4952. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4953. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  4954. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  4955. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  4956. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  4957. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  4958. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  4959. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  4960. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4961. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4962. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4963. <port protocol="tcp" portid="49175"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  4964. </ports>
  4965. <times srtt="358409" rttvar="3148" to="371001"/>
  4966. </host>
  4967. <host starttime="1606158578" endtime="1606176183"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4968. <address addr="47.91.242.27" addrtype="ipv4"/>
  4969. <hostnames>
  4970. </hostnames>
  4971. <ports><extraports state="filtered" count="725">
  4972. <extrareasons reason="no-responses" count="725"/>
  4973. </extraports>
  4974. <extraports state="closed" count="270">
  4975. <extrareasons reason="conn-refused" count="270"/>
  4976. </extraports>
  4977. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4978. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4979. <port protocol="tcp" portid="2288"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netml" method="table" conf="3"/></port>
  4980. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  4981. <port protocol="tcp" portid="6006"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="X11:6" method="table" conf="3"/></port>
  4982. </ports>
  4983. <times srtt="366728" rttvar="2766" to="377792"/>
  4984. </host>
  4985. <host starttime="1606158578" endtime="1606176230"><status state="up" reason="syn-ack" reason_ttl="0"/>
  4986. <address addr="18.163.120.26" addrtype="ipv4"/>
  4987. <hostnames>
  4988. <hostname name="ec2-18-163-120-26.ap-east-1.compute.amazonaws.com" type="PTR"/>
  4989. </hostnames>
  4990. <ports><extraports state="closed" count="996">
  4991. <extrareasons reason="conn-refused" count="996"/>
  4992. </extraports>
  4993. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  4994. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  4995. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4996. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  4997. </ports>
  4998. <times srtt="360468" rttvar="3968" to="376340"/>
  4999. </host>
  5000. <host starttime="1606158578" endtime="1606176234"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5001. <address addr="87.248.0.216" addrtype="ipv4"/>
  5002. <hostnames>
  5003. <hostname name="ip-216-0-248-87.eidsiva.net" type="PTR"/>
  5004. </hostnames>
  5005. <ports><extraports state="filtered" count="996">
  5006. <extrareasons reason="no-responses" count="996"/>
  5007. </extraports>
  5008. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5009. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  5010. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: ebs.awsedge.net,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5011. <port protocol="tcp" portid="2200"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ici" method="table" conf="3"/></port>
  5012. </ports>
  5013. <times srtt="232959" rttvar="3051" to="245163"/>
  5014. </host>
  5015. <host starttime="1606158578" endtime="1606176173"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5016. <address addr="74.118.138.168" addrtype="ipv4"/>
  5017. <hostnames>
  5018. </hostnames>
  5019. <ports><extraports state="closed" count="994">
  5020. <extrareasons reason="conn-refused" count="994"/>
  5021. </extraports>
  5022. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5023. <port protocol="tcp" portid="49"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="tacacs" method="table" conf="3"/></port>
  5024. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5025. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5026. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5027. <port protocol="tcp" portid="9900"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="iua" method="table" conf="3"/></port>
  5028. </ports>
  5029. <times srtt="144014" rttvar="806" to="147238"/>
  5030. </host>
  5031. <host starttime="1606158576" endtime="1606176248"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5032. <address addr="63.142.243.214" addrtype="ipv4"/>
  5033. <hostnames>
  5034. </hostnames>
  5035. <ports><extraports state="closed" count="996">
  5036. <extrareasons reason="conn-refused" count="996"/>
  5037. </extraports>
  5038. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5039. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5040. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 63.142.243.214,/push&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5041. <port protocol="tcp" portid="1053"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="remote-as" method="table" conf="3"/></port>
  5042. </ports>
  5043. <times srtt="199658" rttvar="1982" to="207586"/>
  5044. </host>
  5045. <host starttime="1606158576" endtime="1606176247"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5046. <address addr="13.76.216.122" addrtype="ipv4"/>
  5047. <hostnames>
  5048. </hostnames>
  5049. <ports><extraports state="closed" count="995">
  5050. <extrareasons reason="conn-refused" count="995"/>
  5051. </extraports>
  5052. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5053. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5054. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5055. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5056. <port protocol="tcp" portid="7000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  5057. </ports>
  5058. <times srtt="375219" rttvar="12007" to="423247"/>
  5059. </host>
  5060. <host starttime="1606158578" endtime="1606176258"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5061. <address addr="43.242.201.222" addrtype="ipv4"/>
  5062. <hostnames>
  5063. </hostnames>
  5064. <ports><extraports state="closed" count="987">
  5065. <extrareasons reason="conn-refused" count="987"/>
  5066. </extraports>
  5067. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  5068. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  5069. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5070. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5071. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5072. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5073. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5074. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5075. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  5076. <port protocol="tcp" portid="3000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ppp" method="table" conf="3"/></port>
  5077. <port protocol="tcp" portid="8011"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5078. <port protocol="tcp" portid="8089"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5079. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5080. </ports>
  5081. <times srtt="340873" rttvar="6157" to="365501"/>
  5082. </host>
  5083. <host starttime="1606158577" endtime="1606176247"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5084. <address addr="95.217.197.66" addrtype="ipv4"/>
  5085. <hostnames>
  5086. <hostname name="static.66.197.217.95.clients.your-server.de" type="PTR"/>
  5087. </hostnames>
  5088. <ports><extraports state="closed" count="993">
  5089. <extrareasons reason="conn-refused" count="993"/>
  5090. </extraports>
  5091. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5092. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5093. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5094. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5095. <port protocol="tcp" portid="500"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="isakmp" method="table" conf="3"/></port>
  5096. <port protocol="tcp" portid="1583"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="simbaexpress" method="table" conf="3"/></port>
  5097. <port protocol="tcp" portid="12000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cce4x" method="table" conf="3"/></port>
  5098. </ports>
  5099. <times srtt="239516" rttvar="3432" to="253244"/>
  5100. </host>
  5101. <host starttime="1606158577" endtime="1606176234"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5102. <address addr="78.128.113.14" addrtype="ipv4"/>
  5103. <hostnames>
  5104. <hostname name="ip-113-14.4vendeta.com" type="PTR"/>
  5105. </hostnames>
  5106. <ports><extraports state="filtered" count="997">
  5107. <extrareasons reason="no-responses" count="997"/>
  5108. </extraports>
  5109. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5110. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  5111. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5112. </ports>
  5113. <times srtt="246064" rttvar="1402" to="251672"/>
  5114. </host>
  5115. <host starttime="1606158578" endtime="1606176237"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5116. <address addr="3.234.252.217" addrtype="ipv4"/>
  5117. <hostnames>
  5118. <hostname name="ec2-3-234-252-217.compute-1.amazonaws.com" type="PTR"/>
  5119. </hostnames>
  5120. <ports><extraports state="filtered" count="997">
  5121. <extrareasons reason="no-responses" count="997"/>
  5122. </extraports>
  5123. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5124. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5125. <port protocol="tcp" portid="443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https" method="table" conf="3"/></port>
  5126. </ports>
  5127. <times srtt="135127" rttvar="1687" to="141875"/>
  5128. </host>
  5129. <host starttime="1606158576" endtime="1606176177"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5130. <address addr="39.107.246.25" addrtype="ipv4"/>
  5131. <hostnames>
  5132. </hostnames>
  5133. <ports><extraports state="closed" count="994">
  5134. <extrareasons reason="conn-refused" count="994"/>
  5135. </extraports>
  5136. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5137. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5138. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5139. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5140. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  5141. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  5142. </ports>
  5143. <times srtt="357475" rttvar="2480" to="367395"/>
  5144. </host>
  5145. <host starttime="1606158576" endtime="1606176250"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5146. <address addr="88.119.174.150" addrtype="ipv4"/>
  5147. <hostnames>
  5148. <hostname name="12683-23248.bacloud.info" type="PTR"/>
  5149. </hostnames>
  5150. <ports><extraports state="closed" count="992">
  5151. <extrareasons reason="conn-refused" count="992"/>
  5152. </extraports>
  5153. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5154. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5155. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 88.119.174.150,/pixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 88.119.174.150,/j.ad&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5156. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5157. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5158. <port protocol="tcp" portid="1198"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cajo-discovery" method="table" conf="3"/></port>
  5159. <port protocol="tcp" portid="2557"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nicetec-mgmt" method="table" conf="3"/></port>
  5160. <port protocol="tcp" portid="14238"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5161. </ports>
  5162. <times srtt="153823" rttvar="1494" to="159799"/>
  5163. </host>
  5164. <host starttime="1606158577" endtime="1606176173"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5165. <address addr="88.214.26.33" addrtype="ipv4"/>
  5166. <hostnames>
  5167. <hostname name="hostby.fcloud.biz" type="PTR"/>
  5168. </hostnames>
  5169. <ports><extraports state="closed" count="997">
  5170. <extrareasons reason="conn-refused" count="997"/>
  5171. </extraports>
  5172. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5173. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5174. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5175. </ports>
  5176. <times srtt="254469" rttvar="1148" to="259061"/>
  5177. </host>
  5178. <host starttime="1606158576" endtime="1606176248"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5179. <address addr="95.217.197.124" addrtype="ipv4"/>
  5180. <hostnames>
  5181. <hostname name="static.124.197.217.95.clients.your-server.de" type="PTR"/>
  5182. </hostnames>
  5183. <ports><extraports state="closed" count="994">
  5184. <extrareasons reason="conn-refused" count="994"/>
  5185. </extraports>
  5186. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5187. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5188. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5189. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: oomdatacollect.global.ssl.fastly.net,/pixel.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5190. <port protocol="tcp" portid="500"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="isakmp" method="table" conf="3"/></port>
  5191. <port protocol="tcp" portid="12000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cce4x" method="table" conf="3"/></port>
  5192. </ports>
  5193. <times srtt="238511" rttvar="3461" to="252355"/>
  5194. </host>
  5195. <host starttime="1606158576" endtime="1606176257"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5196. <address addr="47.92.0.132" addrtype="ipv4"/>
  5197. <hostnames>
  5198. </hostnames>
  5199. <ports><extraports state="filtered" count="995">
  5200. <extrareasons reason="no-responses" count="995"/>
  5201. </extraports>
  5202. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5203. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5204. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 100000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 122.193.130.103,/static/superman/img/topnav/baiduyun.png,125.94.49.248,/static/superman/img/topnav/baiduyun.png,124.236.20.211,/static/superman/img/topnav/baiduyun.png,140.249.61.183,/static/superman/img/topnav/baiduyun.png&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36&#xa;HTTP Method Path 2: /search/index&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5205. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5206. <port protocol="tcp" portid="4443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="pharos" method="table" conf="3"/></port>
  5207. </ports>
  5208. <times srtt="362704" rttvar="2550" to="372904"/>
  5209. </host>
  5210. <host starttime="1606158576" endtime="1606176245"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5211. <address addr="100.25.151.21" addrtype="ipv4"/>
  5212. <hostnames>
  5213. <hostname name="ec2-100-25-151-21.compute-1.amazonaws.com" type="PTR"/>
  5214. </hostnames>
  5215. <ports><extraports state="filtered" count="996">
  5216. <extrareasons reason="no-responses" count="996"/>
  5217. </extraports>
  5218. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5219. <port protocol="tcp" portid="25"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  5220. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  5221. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 57913&#xa;Jitter: 43&#xa;Maxdns: 255&#xa;C2 Server: www.co-eu.com,/case.css&#xa;User Agent: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0&#xa;HTTP Method Path 2: /modcp&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x83\xED@\x99&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\svchost.exe&#xa;Spawnto_x64: %windir%\sysnative\svchost.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5222. </ports>
  5223. <times srtt="134982" rttvar="830" to="138302"/>
  5224. </host>
  5225. <host starttime="1606158576" endtime="1606176254"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5226. <address addr="23.106.160.137" addrtype="ipv4"/>
  5227. <hostnames>
  5228. </hostnames>
  5229. <ports><extraports state="closed" count="993">
  5230. <extrareasons reason="conn-refused" count="993"/>
  5231. </extraports>
  5232. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5233. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5234. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.work,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.work,/ca&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MANM)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5235. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5236. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5237. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5238. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5239. </ports>
  5240. <times srtt="208160" rttvar="509" to="210196"/>
  5241. </host>
  5242. <host starttime="1606158576" endtime="1606176234"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5243. <address addr="74.118.138.113" addrtype="ipv4"/>
  5244. <hostnames>
  5245. </hostnames>
  5246. <ports><extraports state="closed" count="996">
  5247. <extrareasons reason="conn-refused" count="996"/>
  5248. </extraports>
  5249. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5250. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5251. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: bird.allsafelink.com,/cx,masks.allsafelink.com,/visit.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP09; NP09; MAAU)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5252. <port protocol="tcp" portid="1862"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="mysql-cm-agent" method="table" conf="3"/></port>
  5253. </ports>
  5254. <times srtt="144037" rttvar="1101" to="148441"/>
  5255. </host>
  5256. <host starttime="1606158577" endtime="1606176247"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5257. <address addr="52.229.22.93" addrtype="ipv4"/>
  5258. <hostnames>
  5259. </hostnames>
  5260. <ports><extraports state="filtered" count="997">
  5261. <extrareasons reason="no-responses" count="997"/>
  5262. </extraports>
  5263. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5264. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5265. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 52.229.22.93,/dot.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSCOM)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5266. </ports>
  5267. <times srtt="209039" rttvar="7787" to="240187"/>
  5268. </host>
  5269. <host starttime="1606158577" endtime="1606176186"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5270. <address addr="46.148.26.246" addrtype="ipv4"/>
  5271. <hostnames>
  5272. <hostname name="boilserg.example.com" type="PTR"/>
  5273. </hostnames>
  5274. <ports><extraports state="closed" count="996">
  5275. <extrareasons reason="conn-refused" count="996"/>
  5276. </extraports>
  5277. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5278. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5279. <port protocol="tcp" portid="444"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="snpp" method="table" conf="3"/></port>
  5280. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  5281. </ports>
  5282. <times srtt="321247" rttvar="71386" to="606791"/>
  5283. </host>
  5284. <host starttime="1606158575" endtime="1606176234"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5285. <address addr="45.147.230.0" addrtype="ipv4"/>
  5286. <hostnames>
  5287. </hostnames>
  5288. <ports><extraports state="closed" count="991">
  5289. <extrareasons reason="conn-refused" count="991"/>
  5290. </extraports>
  5291. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5292. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5293. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.online,/updates.rss&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; Avant Browser)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.online,/pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5294. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5295. <port protocol="tcp" portid="911"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="xact-backup" method="table" conf="3"/></port>
  5296. <port protocol="tcp" portid="1334"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="writesrv" method="table" conf="3"/></port>
  5297. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.online,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.online,/activity&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5298. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  5299. <port protocol="tcp" portid="54328"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5300. </ports>
  5301. <times srtt="218513" rttvar="577" to="220821"/>
  5302. </host>
  5303. <host starttime="1606158577" endtime="1606176207"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5304. <address addr="45.149.16.218" addrtype="ipv4"/>
  5305. <hostnames>
  5306. </hostnames>
  5307. <ports><extraports state="closed" count="989">
  5308. <extrareasons reason="conn-refused" count="989"/>
  5309. </extraports>
  5310. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5311. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  5312. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5313. <port protocol="tcp" portid="109"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop2" method="table" conf="3"/></port>
  5314. <port protocol="tcp" portid="110"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop3" method="table" conf="3"/></port>
  5315. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5316. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5317. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5318. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  5319. <port protocol="tcp" portid="888"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  5320. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  5321. </ports>
  5322. <times srtt="321880" rttvar="1812" to="329128"/>
  5323. </host>
  5324. <host starttime="1606158577" endtime="1606176229"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5325. <address addr="35.241.79.76" addrtype="ipv4"/>
  5326. <hostnames>
  5327. <hostname name="76.79.241.35.bc.googleusercontent.com" type="PTR"/>
  5328. </hostnames>
  5329. <ports><extraports state="closed" count="996">
  5330. <extrareasons reason="conn-refused" count="996"/>
  5331. </extraports>
  5332. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5333. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5334. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5335. <port protocol="tcp" portid="49999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5336. </ports>
  5337. <times srtt="344272" rttvar="3587" to="358620"/>
  5338. </host>
  5339. <host starttime="1606158576" endtime="1606176224"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5340. <address addr="3.236.164.118" addrtype="ipv4"/>
  5341. <hostnames>
  5342. <hostname name="ec2-3-236-164-118.compute-1.amazonaws.com" type="PTR"/>
  5343. </hostnames>
  5344. <ports><extraports state="filtered" count="998">
  5345. <extrareasons reason="no-responses" count="998"/>
  5346. </extraports>
  5347. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  5348. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5349. </ports>
  5350. <times srtt="135902" rttvar="1418" to="141574"/>
  5351. </host>
  5352. <host starttime="1606158577" endtime="1606176228"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5353. <address addr="39.108.229.236" addrtype="ipv4"/>
  5354. <hostnames>
  5355. </hostnames>
  5356. <ports><extraports state="filtered" count="989">
  5357. <extrareasons reason="no-responses" count="989"/>
  5358. </extraports>
  5359. <port protocol="tcp" portid="20"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ftp-data" method="table" conf="3"/></port>
  5360. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  5361. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5362. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5363. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  5364. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5365. <port protocol="tcp" portid="888"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  5366. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  5367. <port protocol="tcp" portid="8081"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  5368. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  5369. <port protocol="tcp" portid="9080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="glrpc" method="table" conf="3"/></port>
  5370. </ports>
  5371. <times srtt="361559" rttvar="2398" to="371151"/>
  5372. </host>
  5373. <host starttime="1606158577" endtime="1606176189"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5374. <address addr="77.123.155.74" addrtype="ipv4"/>
  5375. <hostnames>
  5376. <hostname name="74.155.123.77.colo.static.dcvolia.com" type="PTR"/>
  5377. </hostnames>
  5378. <ports><extraports state="closed" count="996">
  5379. <extrareasons reason="conn-refused" count="996"/>
  5380. </extraports>
  5381. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5382. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5383. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 30000&#xa;Jitter: 20&#xa;Maxdns: 235&#xa;C2 Server: 77.123.155.74,/owa/&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)&#xa;HTTP Method Path 2: /OWA/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 30000&#xa;Jitter: 20&#xa;Maxdns: 235&#xa;C2 Server: 77.123.155.74,/owa/&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)&#xa;HTTP Method Path 2: /OWA/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5384. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5385. </ports>
  5386. <times srtt="248993" rttvar="1260" to="254033"/>
  5387. </host>
  5388. <host starttime="1606158576" endtime="1606176229"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5389. <address addr="66.42.40.220" addrtype="ipv4"/>
  5390. <hostnames>
  5391. <hostname name="66.42.40.220.vultr.com" type="PTR"/>
  5392. </hostnames>
  5393. <ports><extraports state="closed" count="995">
  5394. <extrareasons reason="conn-refused" count="995"/>
  5395. </extraports>
  5396. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5397. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5398. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 66.42.40.220,/ca&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5399. <port protocol="tcp" portid="1234"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hotline" method="table" conf="3"/></port>
  5400. <port protocol="tcp" portid="2222"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="EtherNetIP-1" method="table" conf="3"/></port>
  5401. </ports>
  5402. <times srtt="303748" rttvar="581" to="306072"/>
  5403. </host>
  5404. <host starttime="1606158576" endtime="1606176232"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5405. <address addr="35.241.143.134" addrtype="ipv4"/>
  5406. <hostnames>
  5407. <hostname name="134.143.241.35.bc.googleusercontent.com" type="PTR"/>
  5408. </hostnames>
  5409. <ports><extraports state="filtered" count="998">
  5410. <extrareasons reason="no-responses" count="998"/>
  5411. </extraports>
  5412. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 20&#xa;Maxdns: 235&#xa;C2 Server: control.commanderinthe.cloud,/search/&#xa;User Agent: Mozilla/5.0 (compatible, MSIE 11, Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /Search/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x04\x04&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 20&#xa;Maxdns: 235&#xa;C2 Server: control.commanderinthe.cloud,/search/&#xa;User Agent: Mozilla/5.0 (compatible, MSIE 11, Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /Search/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x04\x04&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5413. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 20&#xa;Maxdns: 235&#xa;C2 Server: control.commanderinthe.cloud,/search/&#xa;User Agent: Mozilla/5.0 (compatible, MSIE 11, Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /Search/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x04\x04&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5414. </ports>
  5415. <times srtt="218612" rttvar="2215" to="227472"/>
  5416. </host>
  5417. <host starttime="1606158577" endtime="1606176220"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5418. <address addr="40.122.106.213" addrtype="ipv4"/>
  5419. <hostnames>
  5420. </hostnames>
  5421. <ports><extraports state="filtered" count="998">
  5422. <extrareasons reason="no-responses" count="998"/>
  5423. </extraports>
  5424. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  5425. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 37000&#xa;Jitter: 25&#xa;Maxdns: 245&#xa;C2 Server: api.aperture.network,/functionalStatus&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/587.38 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36&#xa;HTTP Method Path 2: /rest/2/meetings&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5426. </ports>
  5427. <times srtt="174270" rttvar="1907" to="181898"/>
  5428. </host>
  5429. <host starttime="1606158576" endtime="1606176198"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5430. <address addr="45.141.84.32" addrtype="ipv4"/>
  5431. <hostnames>
  5432. </hostnames>
  5433. <ports><extraports state="closed" count="996">
  5434. <extrareasons reason="conn-refused" count="996"/>
  5435. </extraports>
  5436. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5437. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5438. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.141.84.32,/dpixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.141.84.32,/visit.js&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; InfoPath.2; .NET4.0C; .NET4.0E)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5439. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.141.84.32,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; ASU2JS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5440. </ports>
  5441. <times srtt="274733" rttvar="5580" to="297053"/>
  5442. </host>
  5443. <host starttime="1606158577" endtime="1606176173"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5444. <address addr="3.133.100.221" addrtype="ipv4"/>
  5445. <hostnames>
  5446. <hostname name="ec2-3-133-100-221.us-east-2.compute.amazonaws.com" type="PTR"/>
  5447. </hostnames>
  5448. <ports><extraports state="filtered" count="997">
  5449. <extrareasons reason="no-responses" count="997"/>
  5450. </extraports>
  5451. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5452. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  5453. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5454. </ports>
  5455. <times srtt="150789" rttvar="603" to="153201"/>
  5456. </host>
  5457. <host starttime="1606158577" endtime="1606176221"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5458. <address addr="3.137.206.229" addrtype="ipv4"/>
  5459. <hostnames>
  5460. <hostname name="ec2-3-137-206-229.us-east-2.compute.amazonaws.com" type="PTR"/>
  5461. </hostnames>
  5462. <ports><extraports state="filtered" count="997">
  5463. <extrareasons reason="no-responses" count="997"/>
  5464. </extraports>
  5465. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5466. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5467. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 3.133.100.221,/j.ad&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; Xbox)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5468. </ports>
  5469. <times srtt="171050" rttvar="41231" to="335974"/>
  5470. </host>
  5471. <host starttime="1606158578" endtime="1606176240"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5472. <address addr="49.235.158.131" addrtype="ipv4"/>
  5473. <hostnames>
  5474. </hostnames>
  5475. <ports><extraports state="closed" count="985">
  5476. <extrareasons reason="conn-refused" count="985"/>
  5477. </extraports>
  5478. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5479. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  5480. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5481. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5482. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5483. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5484. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5485. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5486. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  5487. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  5488. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  5489. <port protocol="tcp" portid="1088"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cplscrambler-al" method="table" conf="3"/></port>
  5490. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  5491. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  5492. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  5493. </ports>
  5494. <times srtt="336922" rttvar="7270" to="366002"/>
  5495. </host>
  5496. <host starttime="1606158577" endtime="1606176219"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5497. <address addr="79.141.167.40" addrtype="ipv4"/>
  5498. <hostnames>
  5499. <hostname name="organisation.buroerrod.co.uk" type="PTR"/>
  5500. </hostnames>
  5501. <ports><extraports state="closed" count="997">
  5502. <extrareasons reason="conn-refused" count="997"/>
  5503. </extraports>
  5504. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5505. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 79.141.167.40,/updates.rss&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALC)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 79.141.167.40,/dpixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MAM2)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5506. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5507. </ports>
  5508. <times srtt="154280" rttvar="951" to="158084"/>
  5509. </host>
  5510. <host starttime="1606158575" endtime="1606176207"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5511. <address addr="39.109.116.2" addrtype="ipv4"/>
  5512. <hostnames>
  5513. </hostnames>
  5514. <ports><extraports state="closed" count="986">
  5515. <extrareasons reason="conn-refused" count="986"/>
  5516. </extraports>
  5517. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  5518. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 100000&#xa;Jitter: 20&#xa;Maxdns: 255&#xa;C2 Server: 59.151.40.186,/box-static/disk-header/header/img/logo.png,120.132.70.253,/box-static/disk-header/header/img/logo.png,222.73.162.46,/img/flexible/logo/pc/result.png&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36&#xa;HTTP Method Path 2: /search/index&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 100000&#xa;Jitter: 20&#xa;Maxdns: 255&#xa;C2 Server: 59.151.40.186,/static/superman/img/topnav/baiduyun.png,120.132.70.253,/img/flexible/logo/pc/result.png,222.73.162.46,/img/flexible/logo/pc/result.png&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36&#xa;HTTP Method Path 2: /search/index&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5519. <port protocol="tcp" portid="109"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop2" method="table" conf="3"/></port>
  5520. <port protocol="tcp" portid="110"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop3" method="table" conf="3"/></port>
  5521. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5522. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5523. <port protocol="tcp" portid="143"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="imap" method="table" conf="3"/></port>
  5524. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5525. <port protocol="tcp" portid="444"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="snpp" method="table" conf="3"/></port>
  5526. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5527. <port protocol="tcp" portid="465"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  5528. <port protocol="tcp" portid="993"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="imaps" method="table" conf="3"/></port>
  5529. <port protocol="tcp" portid="995"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop3s" method="table" conf="3"/></port>
  5530. <port protocol="tcp" portid="5900"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  5531. </ports>
  5532. <times srtt="353358" rttvar="8657" to="387986"/>
  5533. </host>
  5534. <host starttime="1606158576" endtime="1606176212"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5535. <address addr="79.141.164.206" addrtype="ipv4"/>
  5536. <hostnames>
  5537. <hostname name="i3cb.maloof.pw" type="PTR"/>
  5538. </hostnames>
  5539. <ports><extraports state="closed" count="997">
  5540. <extrareasons reason="conn-refused" count="997"/>
  5541. </extraports>
  5542. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5543. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 79.141.164.206,/load&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 79.141.164.206,/g.pixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5544. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 79.141.164.206,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; XBLWP7; ZuneWP7)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5545. </ports>
  5546. <times srtt="220359" rttvar="1843" to="227731"/>
  5547. </host>
  5548. <host starttime="1606158577" endtime="1606176175"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5549. <address addr="23.106.160.191" addrtype="ipv4"/>
  5550. <hostnames>
  5551. </hostnames>
  5552. <ports><extraports state="closed" count="994">
  5553. <extrareasons reason="conn-refused" count="994"/>
  5554. </extraports>
  5555. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5556. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5557. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5558. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5559. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5560. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5561. </ports>
  5562. <times srtt="208294" rttvar="1210" to="213134"/>
  5563. </host>
  5564. <host starttime="1606158577" endtime="1606176199"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5565. <address addr="23.106.160.229" addrtype="ipv4"/>
  5566. <hostnames>
  5567. </hostnames>
  5568. <ports><extraports state="closed" count="993">
  5569. <extrareasons reason="conn-refused" count="993"/>
  5570. </extraports>
  5571. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5572. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5573. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5574. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5575. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5576. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5577. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5578. </ports>
  5579. <times srtt="207803" rttvar="442" to="209571"/>
  5580. </host>
  5581. <host starttime="1606158576" endtime="1606176169"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5582. <address addr="40.121.162.127" addrtype="ipv4"/>
  5583. <hostnames>
  5584. </hostnames>
  5585. <ports><extraports state="closed" count="997">
  5586. <extrareasons reason="conn-refused" count="997"/>
  5587. </extraports>
  5588. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5589. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5590. <port protocol="tcp" portid="587"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="submission" method="table" conf="3"/></port>
  5591. </ports>
  5592. <times srtt="135416" rttvar="608" to="137848"/>
  5593. </host>
  5594. <host starttime="1606158577" endtime="1606176173"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5595. <address addr="64.187.238.202" addrtype="ipv4"/>
  5596. <hostnames>
  5597. <hostname name="64.187.238.202.alnitech.com" type="PTR"/>
  5598. </hostnames>
  5599. <ports><extraports state="closed" count="998">
  5600. <extrareasons reason="conn-refused" count="998"/>
  5601. </extraports>
  5602. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5603. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5604. </ports>
  5605. <times srtt="156157" rttvar="670" to="158837"/>
  5606. </host>
  5607. <host starttime="1606158577" endtime="1606176206"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5608. <address addr="3.129.21.151" addrtype="ipv4"/>
  5609. <hostnames>
  5610. <hostname name="ec2-3-129-21-151.us-east-2.compute.amazonaws.com" type="PTR"/>
  5611. </hostnames>
  5612. <ports><extraports state="filtered" count="997">
  5613. <extrareasons reason="no-responses" count="997"/>
  5614. </extraports>
  5615. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5616. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  5617. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5618. </ports>
  5619. <times srtt="151499" rttvar="1205" to="156319"/>
  5620. </host>
  5621. <host starttime="1606158577" endtime="1606176219"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5622. <address addr="45.77.249.181" addrtype="ipv4"/>
  5623. <hostnames>
  5624. <hostname name="45.77.249.181.vultr.com" type="PTR"/>
  5625. </hostnames>
  5626. <ports><extraports state="closed" count="993">
  5627. <extrareasons reason="conn-refused" count="993"/>
  5628. </extraports>
  5629. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5630. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5631. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5632. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5633. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5634. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5635. <port protocol="tcp" portid="1092"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="obrpd" method="table" conf="3"/></port>
  5636. </ports>
  5637. <times srtt="371835" rttvar="4957" to="391663"/>
  5638. </host>
  5639. <host starttime="1606158577" endtime="1606176175"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5640. <address addr="45.83.140.231" addrtype="ipv4"/>
  5641. <hostnames>
  5642. <hostname name="nordns.vps.hosteons.com" type="PTR"/>
  5643. </hostnames>
  5644. <ports><extraports state="filtered" count="996">
  5645. <extrareasons reason="no-responses" count="996"/>
  5646. </extraports>
  5647. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5648. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5649. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  5650. <port protocol="tcp" portid="8888"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  5651. </ports>
  5652. <times srtt="474349" rttvar="31688" to="601101"/>
  5653. </host>
  5654. <host starttime="1606158578" endtime="1606176186"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5655. <address addr="46.161.27.220" addrtype="ipv4"/>
  5656. <hostnames>
  5657. </hostnames>
  5658. <ports><extraports state="closed" count="997">
  5659. <extrareasons reason="conn-refused" count="997"/>
  5660. </extraports>
  5661. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5662. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5663. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 46.161.27.220,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5664. </ports>
  5665. <times srtt="220976" rttvar="1258" to="226008"/>
  5666. </host>
  5667. <host starttime="1606158577" endtime="1606176207"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5668. <address addr="45.32.36.214" addrtype="ipv4"/>
  5669. <hostnames>
  5670. <hostname name="cdn178.cdnsu.com" type="PTR"/>
  5671. </hostnames>
  5672. <ports><extraports state="closed" count="995">
  5673. <extrareasons reason="conn-refused" count="995"/>
  5674. </extraports>
  5675. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5676. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5677. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5678. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5679. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5680. </ports>
  5681. <times srtt="303488" rttvar="1163" to="308140"/>
  5682. </host>
  5683. <host starttime="1606158577" endtime="1606176253"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5684. <address addr="23.106.223.53" addrtype="ipv4"/>
  5685. <hostnames>
  5686. </hostnames>
  5687. <ports><extraports state="closed" count="987">
  5688. <extrareasons reason="conn-refused" count="987"/>
  5689. </extraports>
  5690. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5691. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5692. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 61312&#xa;Jitter: 41&#xa;Maxdns: 252&#xa;C2 Server: 23.106.223.53,/mobile-ipad-home.css&#xa;User Agent: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0&#xa;HTTP Method Path 2: /tab_home&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: 9\x9C\xA0\xBE&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\svchost.exe&#xa;Spawnto_x64: %windir%\sysnative\svchost.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 61312&#xa;Jitter: 41&#xa;Maxdns: 252&#xa;C2 Server: 23.106.223.53,/mobile-ipad-home.css&#xa;User Agent: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0&#xa;HTTP Method Path 2: /tab_home&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: 9\x9C\xA0\xBE&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\svchost.exe&#xa;Spawnto_x64: %windir%\sysnative\svchost.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5693. <port protocol="tcp" portid="82"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="xfer" method="table" conf="3"/></port>
  5694. <port protocol="tcp" portid="83"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mit-ml-dev" method="table" conf="3"/></port>
  5695. <port protocol="tcp" portid="84"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ctf" method="table" conf="3"/></port>
  5696. <port protocol="tcp" portid="85"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mit-ml-dev" method="table" conf="3"/></port>
  5697. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5698. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5699. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5700. <port protocol="tcp" portid="444"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="snpp" method="table" conf="3"/></port>
  5701. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5702. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 61312&#xa;Jitter: 41&#xa;Maxdns: 252&#xa;C2 Server: 23.106.223.53,/br&#xa;User Agent: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0&#xa;HTTP Method Path 2: /case&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: 9\x9C\xA0\xBE&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\svchost.exe&#xa;Spawnto_x64: %windir%\sysnative\svchost.exe&#xa;Proxy_Hostname: http://10.142.158.206:8080&#xa;Proxy_AccessType: 0 (Unknown)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 61312&#xa;Jitter: 41&#xa;Maxdns: 252&#xa;C2 Server: 23.106.223.53,/Content&#xa;User Agent: Mozilla/5.0 (Linux; Android 7.0; Pixel C Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0&#xa;HTTP Method Path 2: /case&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: 9\x9C\xA0\xBE&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\svchost.exe&#xa;Spawnto_x64: %windir%\sysnative\svchost.exe&#xa;Proxy_Hostname: http://10.142.158.206:8080&#xa;Proxy_AccessType: 0 (Unknown)&#xa;&#xa;"/></port>
  5703. </ports>
  5704. <times srtt="208737" rttvar="1331" to="214061"/>
  5705. </host>
  5706. <host starttime="1606158576" endtime="1606176203"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5707. <address addr="47.56.144.122" addrtype="ipv4"/>
  5708. <hostnames>
  5709. </hostnames>
  5710. <ports><extraports state="closed" count="990">
  5711. <extrareasons reason="conn-refused" count="990"/>
  5712. </extraports>
  5713. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5714. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5715. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: sb.flashfack.ren,/load&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: sb.flashfack.ren,/ga.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5716. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.56.144.122,/visit.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP08; MAAU; NP08)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5717. <port protocol="tcp" portid="8007"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ajp12" method="table" conf="3"/></port>
  5718. <port protocol="tcp" portid="64623"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5719. <port protocol="tcp" portid="64680"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5720. <port protocol="tcp" portid="65000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5721. <port protocol="tcp" portid="65129"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5722. <port protocol="tcp" portid="65389"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5723. </ports>
  5724. <times srtt="369060" rttvar="6595" to="395440"/>
  5725. </host>
  5726. <host starttime="1606158577" endtime="1606176198"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5727. <address addr="59.11.209.223" addrtype="ipv4"/>
  5728. <hostnames>
  5729. </hostnames>
  5730. <ports><extraports state="closed" count="983">
  5731. <extrareasons reason="conn-refused" count="983"/>
  5732. </extraports>
  5733. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5734. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: www.kwwwing.com,/g.pixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: www.kwwwing.com,/j.ad&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; ; NCLIENT50_AAPCDA5841E333)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5735. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5736. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5737. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5738. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5739. <port protocol="tcp" portid="1080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="socks" method="table" conf="3"/></port>
  5740. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  5741. <port protocol="tcp" portid="4045"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="lockd" method="table" conf="3"/></port>
  5742. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  5743. <port protocol="tcp" portid="6667"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="irc" method="table" conf="3"/></port>
  5744. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5745. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5746. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5747. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5748. <port protocol="tcp" portid="49157"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5749. <port protocol="tcp" portid="49158"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5750. </ports>
  5751. <times srtt="326847" rttvar="3677" to="341555"/>
  5752. </host>
  5753. <host starttime="1606158577" endtime="1606179394"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5754. <address addr="47.242.76.173" addrtype="ipv4"/>
  5755. <hostnames>
  5756. </hostnames>
  5757. <ports><extraports state="closed" count="986">
  5758. <extrareasons reason="conn-refused" count="986"/>
  5759. </extraports>
  5760. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5761. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5762. <port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5763. <port protocol="tcp" portid="139"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5764. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5765. <port protocol="tcp" portid="445"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5766. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  5767. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5768. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5769. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5770. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5771. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5772. <port protocol="tcp" portid="49157"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5773. <port protocol="tcp" portid="49158"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5774. </ports>
  5775. <times srtt="363720" rttvar="3221" to="376604"/>
  5776. </host>
  5777. <host starttime="1606158578" endtime="1606179387"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5778. <address addr="46.166.173.24" addrtype="ipv4"/>
  5779. <hostnames>
  5780. </hostnames>
  5781. <ports><extraports state="closed" count="995">
  5782. <extrareasons reason="conn-refused" count="995"/>
  5783. </extraports>
  5784. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5785. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5786. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5787. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  5788. <port protocol="tcp" portid="12345"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbus" method="table" conf="3"/></port>
  5789. </ports>
  5790. <times srtt="244989" rttvar="1028" to="249101"/>
  5791. </host>
  5792. <host starttime="1606158576" endtime="1606179387"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5793. <address addr="64.128.143.70" addrtype="ipv4"/>
  5794. <hostnames>
  5795. </hostnames>
  5796. <ports><extraports state="filtered" count="998">
  5797. <extrareasons reason="no-responses" count="998"/>
  5798. </extraports>
  5799. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5800. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5801. </ports>
  5802. <times srtt="151578" rttvar="1246" to="156562"/>
  5803. </host>
  5804. <host starttime="1606158577" endtime="1606179388"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5805. <address addr="45.134.169.75" addrtype="ipv4"/>
  5806. <hostnames>
  5807. </hostnames>
  5808. <ports><extraports state="closed" count="983">
  5809. <extrareasons reason="conn-refused" count="983"/>
  5810. </extraports>
  5811. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  5812. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5813. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5814. <port protocol="tcp" portid="109"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop2" method="table" conf="3"/></port>
  5815. <port protocol="tcp" portid="110"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop3" method="table" conf="3"/></port>
  5816. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5817. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5818. <port protocol="tcp" portid="143"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="imap" method="table" conf="3"/></port>
  5819. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5820. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5821. <port protocol="tcp" portid="465"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  5822. <port protocol="tcp" portid="587"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="submission" method="table" conf="3"/></port>
  5823. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  5824. <port protocol="tcp" portid="993"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="imaps" method="table" conf="3"/></port>
  5825. <port protocol="tcp" portid="995"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pop3s" method="table" conf="3"/></port>
  5826. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  5827. <port protocol="tcp" portid="1935"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rtmp" method="table" conf="3"/></port>
  5828. </ports>
  5829. <times srtt="322967" rttvar="4424" to="340663"/>
  5830. </host>
  5831. <host starttime="1606158577" endtime="1606179385"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5832. <address addr="45.32.129.110" addrtype="ipv4"/>
  5833. <hostnames>
  5834. <hostname name="45.32.129.110.vultr.com" type="PTR"/>
  5835. </hostnames>
  5836. <ports><extraports state="closed" count="992">
  5837. <extrareasons reason="conn-refused" count="992"/>
  5838. </extraports>
  5839. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5840. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5841. <port protocol="tcp" portid="80"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  5842. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5843. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5844. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5845. <port protocol="tcp" portid="1688"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nsjtp-data" method="table" conf="3"/></port>
  5846. <port protocol="tcp" portid="8088"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="radan-http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5847. </ports>
  5848. <times srtt="208055" rttvar="652" to="210663"/>
  5849. </host>
  5850. <host starttime="1606158576" endtime="1606179363"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5851. <address addr="45.76.210.100" addrtype="ipv4"/>
  5852. <hostnames>
  5853. <hostname name="45.76.210.100.vultr.com" type="PTR"/>
  5854. </hostnames>
  5855. <ports><extraports state="closed" count="994">
  5856. <extrareasons reason="conn-refused" count="994"/>
  5857. </extraports>
  5858. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5859. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5860. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: microsofts.network,/__utm.gif,http.microsoftsupdate.workers.dev,/__utm.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)&#xa;HTTP Method Path 2: /___utm.gif&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: microsofts.network,/__utm.gif,http.microsoftsupdate.workers.dev,/__utm.gif&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /___utm.gif&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5861. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5862. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5863. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5864. </ports>
  5865. <times srtt="303477" rttvar="1605" to="309897"/>
  5866. </host>
  5867. <host starttime="1606158576" endtime="1606179336"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5868. <address addr="23.101.204.40" addrtype="ipv4"/>
  5869. <hostnames>
  5870. </hostnames>
  5871. <ports><extraports state="filtered" count="999">
  5872. <extrareasons reason="no-responses" count="999"/>
  5873. </extraports>
  5874. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5875. </ports>
  5876. <times srtt="200067" rttvar="791" to="203231"/>
  5877. </host>
  5878. <host starttime="1606158577" endtime="1606179370"><status state="up" reason="conn-refused" reason_ttl="0"/>
  5879. <address addr="39.107.60.234" addrtype="ipv4"/>
  5880. <hostnames>
  5881. </hostnames>
  5882. <ports><extraports state="closed" count="994">
  5883. <extrareasons reason="conn-refused" count="994"/>
  5884. </extraports>
  5885. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5886. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5887. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5888. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5889. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  5890. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  5891. </ports>
  5892. <times srtt="356761" rttvar="1953" to="364573"/>
  5893. </host>
  5894. <host starttime="1606158575" endtime="1606179392"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5895. <address addr="47.242.148.4" addrtype="ipv4"/>
  5896. <hostnames>
  5897. </hostnames>
  5898. <ports><extraports state="closed" count="995">
  5899. <extrareasons reason="conn-refused" count="995"/>
  5900. </extraports>
  5901. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5902. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5903. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.242.148.4,/updates.rss&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.242.148.4,/activity&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0; msn OptimizedIE8;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5904. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5905. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5906. </ports>
  5907. <times srtt="363818" rttvar="3615" to="378278"/>
  5908. </host>
  5909. <host starttime="1606158576" endtime="1606179396"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5910. <address addr="54.214.197.200" addrtype="ipv4"/>
  5911. <hostnames>
  5912. <hostname name="ec2-54-214-197-200.us-west-2.compute.amazonaws.com" type="PTR"/>
  5913. </hostnames>
  5914. <ports><extraports state="filtered" count="997">
  5915. <extrareasons reason="no-responses" count="997"/>
  5916. </extraports>
  5917. <port protocol="tcp" portid="22"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5918. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5919. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: pnwcontent-delivery.com,/pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5920. </ports>
  5921. <times srtt="221684" rttvar="9091" to="258048"/>
  5922. </host>
  5923. <host starttime="1606158576" endtime="1606179342"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5924. <address addr="45.146.165.140" addrtype="ipv4"/>
  5925. <hostnames>
  5926. </hostnames>
  5927. <ports><extraports state="closed" count="994">
  5928. <extrareasons reason="conn-refused" count="994"/>
  5929. </extraports>
  5930. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5931. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.146.165.140,/g.pixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.146.165.140,/ga.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENAU)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5932. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  5933. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  5934. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.146.165.140,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  5935. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  5936. </ports>
  5937. <times srtt="243523" rttvar="3625" to="258023"/>
  5938. </host>
  5939. <host starttime="1606158577" endtime="1606179387"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5940. <address addr="39.101.136.149" addrtype="ipv4"/>
  5941. <hostnames>
  5942. </hostnames>
  5943. <ports><extraports state="filtered" count="974">
  5944. <extrareasons reason="no-responses" count="974"/>
  5945. </extraports>
  5946. <port protocol="tcp" portid="21"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  5947. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5948. <port protocol="tcp" portid="25"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  5949. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5950. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5951. <port protocol="tcp" portid="143"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="imap" method="table" conf="3"/></port>
  5952. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5953. <port protocol="tcp" portid="465"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="smtps" method="table" conf="3"/></port>
  5954. <port protocol="tcp" portid="808"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ccproxy-http" method="table" conf="3"/></port>
  5955. <port protocol="tcp" portid="2020"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="xinupageserver" method="table" conf="3"/></port>
  5956. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  5957. <port protocol="tcp" portid="3389"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  5958. <port protocol="tcp" portid="3690"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="svn" method="table" conf="3"/></port>
  5959. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5960. <port protocol="tcp" portid="8010"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="xmpp" method="table" conf="3"/></port>
  5961. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  5962. <port protocol="tcp" portid="8888"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  5963. <port protocol="tcp" portid="9001"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="tor-orport" method="table" conf="3"/></port>
  5964. <port protocol="tcp" portid="50000"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ibm-db2" method="table" conf="3"/></port>
  5965. <port protocol="tcp" portid="50001"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5966. <port protocol="tcp" portid="50002"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="iiimsf" method="table" conf="3"/></port>
  5967. <port protocol="tcp" portid="50003"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5968. <port protocol="tcp" portid="50006"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5969. <port protocol="tcp" portid="50300"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5970. <port protocol="tcp" portid="50389"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5971. <port protocol="tcp" portid="50500"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5972. </ports>
  5973. <times srtt="362645" rttvar="10033" to="402777"/>
  5974. </host>
  5975. <host starttime="1606158578" endtime="1606179328"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5976. <address addr="46.166.129.176" addrtype="ipv4"/>
  5977. <hostnames>
  5978. <hostname name="gov.earthaninternational.com" type="PTR"/>
  5979. </hostnames>
  5980. <ports><extraports state="closed" count="995">
  5981. <extrareasons reason="conn-refused" count="995"/>
  5982. </extraports>
  5983. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  5984. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5985. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  5986. <port protocol="tcp" portid="1011"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  5987. <port protocol="tcp" portid="1093"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="proofd" method="table" conf="3"/></port>
  5988. </ports>
  5989. <times srtt="220447" rttvar="1819" to="227723"/>
  5990. </host>
  5991. <host starttime="1606158576" endtime="1606179396"><status state="up" reason="syn-ack" reason_ttl="0"/>
  5992. <address addr="47.104.11.169" addrtype="ipv4"/>
  5993. <hostnames>
  5994. </hostnames>
  5995. <ports><extraports state="closed" count="989">
  5996. <extrareasons reason="conn-refused" count="989"/>
  5997. </extraports>
  5998. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  5999. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6000. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6001. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6002. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6003. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6004. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6005. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  6006. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  6007. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  6008. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  6009. </ports>
  6010. <times srtt="379470" rttvar="2970" to="391350"/>
  6011. </host>
  6012. <host starttime="1606158576" endtime="1606179366"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6013. <address addr="23.235.147.35" addrtype="ipv4"/>
  6014. <hostnames>
  6015. </hostnames>
  6016. <ports><extraports state="closed" count="990">
  6017. <extrareasons reason="conn-refused" count="990"/>
  6018. </extraports>
  6019. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  6020. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6021. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6022. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: update.checkavail.space,/cm&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MATMJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: update.checkavail.space,/ca&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; Touch; MASPJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6023. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6024. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6025. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: update.checkavail.space,/en_US/all.js&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: update.checkavail.space,/dpixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6026. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6027. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  6028. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  6029. </ports>
  6030. <times srtt="321952" rttvar="1881" to="329476"/>
  6031. </host>
  6032. <host starttime="1606158576" endtime="1606179313"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6033. <address addr="45.227.255.189" addrtype="ipv4"/>
  6034. <hostnames>
  6035. <hostname name="hosting-by.web4net.org" type="PTR"/>
  6036. </hostnames>
  6037. <ports><extraports state="closed" count="996">
  6038. <extrareasons reason="conn-refused" count="996"/>
  6039. </extraports>
  6040. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6041. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6042. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6043. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6044. </ports>
  6045. <times srtt="219952" rttvar="2240" to="228912"/>
  6046. </host>
  6047. <host starttime="1606158577" endtime="1606179328"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6048. <address addr="46.8.177.137" addrtype="ipv4"/>
  6049. <hostnames>
  6050. </hostnames>
  6051. <ports><extraports state="closed" count="994">
  6052. <extrareasons reason="conn-refused" count="994"/>
  6053. </extraports>
  6054. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6055. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6056. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6057. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6058. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6059. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6060. </ports>
  6061. <times srtt="359005" rttvar="5210" to="379845"/>
  6062. </host>
  6063. <host starttime="1606158578" endtime="1606179322"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6064. <address addr="20.36.203.162" addrtype="ipv4"/>
  6065. <hostnames>
  6066. </hostnames>
  6067. <ports><extraports state="filtered" count="995">
  6068. <extrareasons reason="no-responses" count="995"/>
  6069. </extraports>
  6070. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6071. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  6072. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6073. <port protocol="tcp" portid="444"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="snpp" method="table" conf="3"/></port>
  6074. <port protocol="tcp" portid="445"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6075. </ports>
  6076. <times srtt="139158" rttvar="1210" to="143998"/>
  6077. </host>
  6078. <host starttime="1606158576" endtime="1606179387"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6079. <address addr="45.10.20.166" addrtype="ipv4"/>
  6080. <hostnames>
  6081. </hostnames>
  6082. <ports><extraports state="closed" count="996">
  6083. <extrareasons reason="conn-refused" count="996"/>
  6084. </extraports>
  6085. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6086. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6087. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6088. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6089. </ports>
  6090. <times srtt="217111" rttvar="3816" to="232375"/>
  6091. </host>
  6092. <host starttime="1606158576" endtime="1606179394"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6093. <address addr="23.108.57.27" addrtype="ipv4"/>
  6094. <hostnames>
  6095. </hostnames>
  6096. <ports><extraports state="closed" count="993">
  6097. <extrareasons reason="conn-refused" count="993"/>
  6098. </extraports>
  6099. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6100. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6101. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6102. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6103. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6104. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6105. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6106. </ports>
  6107. <times srtt="160423" rttvar="1376" to="165927"/>
  6108. </host>
  6109. <host starttime="1606158576" endtime="1606179388"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6110. <address addr="45.14.149.202" addrtype="ipv4"/>
  6111. <hostnames>
  6112. </hostnames>
  6113. <ports><extraports state="closed" count="996">
  6114. <extrareasons reason="conn-refused" count="996"/>
  6115. </extraports>
  6116. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6117. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6118. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6119. <port protocol="tcp" portid="8899"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ospf-lite" method="table" conf="3"/></port>
  6120. </ports>
  6121. <times srtt="263347" rttvar="1533" to="269479"/>
  6122. </host>
  6123. <host starttime="1606158577" endtime="1606179388"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6124. <address addr="46.166.129.182" addrtype="ipv4"/>
  6125. <hostnames>
  6126. <hostname name="gov.earthanman.com" type="PTR"/>
  6127. </hostnames>
  6128. <ports><extraports state="closed" count="997">
  6129. <extrareasons reason="conn-refused" count="997"/>
  6130. </extraports>
  6131. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6132. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6133. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6134. </ports>
  6135. <times srtt="219151" rttvar="2045" to="227331"/>
  6136. </host>
  6137. <host starttime="1606158576" endtime="1606179388"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6138. <address addr="45.147.231.51" addrtype="ipv4"/>
  6139. <hostnames>
  6140. </hostnames>
  6141. <ports><extraports state="closed" count="994">
  6142. <extrareasons reason="conn-refused" count="994"/>
  6143. </extraports>
  6144. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6145. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6146. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.site,/ca&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0; msn OptimizedIE8;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.site,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSE)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6147. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6148. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6149. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  6150. </ports>
  6151. <times srtt="218670" rttvar="1215" to="223530"/>
  6152. </host>
  6153. <host starttime="1606158576" endtime="1606179385"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6154. <address addr="49.232.1.114" addrtype="ipv4"/>
  6155. <hostnames>
  6156. </hostnames>
  6157. <ports><extraports state="closed" count="989">
  6158. <extrareasons reason="conn-refused" count="989"/>
  6159. </extraports>
  6160. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6161. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 49.232.1.114,/ga.js&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 1.1.4322; BOIE8;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 49.232.1.114,/fwlink&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; LEN2)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6162. <port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6163. <port protocol="tcp" portid="139"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6164. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6165. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6166. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  6167. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  6168. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  6169. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  6170. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  6171. </ports>
  6172. <times srtt="381727" rttvar="6478" to="407639"/>
  6173. </host>
  6174. <host starttime="1606158577" endtime="1606179388"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6175. <address addr="46.166.129.169" addrtype="ipv4"/>
  6176. <hostnames>
  6177. <hostname name="olympusservice.net" type="PTR"/>
  6178. </hostnames>
  6179. <ports><extraports state="closed" count="997">
  6180. <extrareasons reason="conn-refused" count="997"/>
  6181. </extraports>
  6182. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6183. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6184. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6185. </ports>
  6186. <times srtt="218908" rttvar="1281" to="224032"/>
  6187. </host>
  6188. <host starttime="1606158577" endtime="1606179385"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6189. <address addr="45.254.64.7" addrtype="ipv4"/>
  6190. <hostnames>
  6191. </hostnames>
  6192. <ports><extraports state="closed" count="985">
  6193. <extrareasons reason="conn-refused" count="985"/>
  6194. </extraports>
  6195. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6196. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6197. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  6198. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6199. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6200. <port protocol="tcp" portid="1234"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hotline" method="table" conf="3"/></port>
  6201. <port protocol="tcp" portid="1433"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-sql-s" method="table" conf="3"/></port>
  6202. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  6203. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  6204. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  6205. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  6206. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6207. <port protocol="tcp" portid="8087"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="simplifymedia" method="table" conf="3"/></port>
  6208. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6209. <port protocol="tcp" portid="55555"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6210. </ports>
  6211. <times srtt="364605" rttvar="1054" to="368821"/>
  6212. </host>
  6213. <host starttime="1606158577" endtime="1606179363"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6214. <address addr="51.195.35.0" addrtype="ipv4"/>
  6215. <hostnames>
  6216. <hostname name="ip0.ip-51-195-35.eu" type="PTR"/>
  6217. </hostnames>
  6218. <ports><extraports state="closed" count="996">
  6219. <extrareasons reason="conn-refused" count="996"/>
  6220. </extraports>
  6221. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6222. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6223. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 51.195.35.0,/g.pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6224. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  6225. </ports>
  6226. <times srtt="226377" rttvar="2870" to="237857"/>
  6227. </host>
  6228. <host starttime="1606158576" endtime="1606179388"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6229. <address addr="47.95.37.84" addrtype="ipv4"/>
  6230. <hostnames>
  6231. </hostnames>
  6232. <ports><extraports state="closed" count="982">
  6233. <extrareasons reason="conn-refused" count="982"/>
  6234. </extraports>
  6235. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6236. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6237. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6238. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6239. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6240. <port protocol="tcp" portid="880"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6241. <port protocol="tcp" portid="888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  6242. <port protocol="tcp" portid="2144"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="lv-ffx" method="table" conf="3"/></port>
  6243. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  6244. <port protocol="tcp" portid="4321"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rwhois" method="table" conf="3"/></port>
  6245. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  6246. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  6247. <port protocol="tcp" portid="7777"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cbt" method="table" conf="3"/></port>
  6248. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6249. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6250. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6251. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  6252. <port protocol="tcp" portid="10001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="scp-config" method="table" conf="3"/></port>
  6253. </ports>
  6254. <times srtt="355962" rttvar="2364" to="365418"/>
  6255. </host>
  6256. <host starttime="1606158577" endtime="1606179354"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6257. <address addr="34.96.251.166" addrtype="ipv4"/>
  6258. <hostnames>
  6259. <hostname name="166.251.96.34.bc.googleusercontent.com" type="PTR"/>
  6260. </hostnames>
  6261. <ports><extraports state="closed" count="994">
  6262. <extrareasons reason="conn-refused" count="994"/>
  6263. </extraports>
  6264. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6265. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6266. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6267. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6268. <port protocol="tcp" portid="8099"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6269. <port protocol="tcp" portid="49999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6270. </ports>
  6271. <times srtt="341805" rttvar="4429" to="359521"/>
  6272. </host>
  6273. <host starttime="1606158578" endtime="1606179388"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6274. <address addr="45.153.243.215" addrtype="ipv4"/>
  6275. <hostnames>
  6276. </hostnames>
  6277. <ports><extraports state="closed" count="995">
  6278. <extrareasons reason="conn-refused" count="995"/>
  6279. </extraports>
  6280. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6281. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6282. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.support,/push&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.4; InfoPath.2)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.support,/activity&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/4.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6283. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.support,/cm&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MASP)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6284. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6285. </ports>
  6286. <times srtt="220130" rttvar="1522" to="226218"/>
  6287. </host>
  6288. <host starttime="1606158577" endtime="1606179354"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6289. <address addr="47.94.195.242" addrtype="ipv4"/>
  6290. <hostnames>
  6291. </hostnames>
  6292. <ports><extraports state="closed" count="990">
  6293. <extrareasons reason="conn-refused" count="990"/>
  6294. </extraports>
  6295. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6296. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6297. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6298. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6299. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6300. <port protocol="tcp" portid="4444"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  6301. <port protocol="tcp" portid="5555"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="freeciv" method="table" conf="3"/></port>
  6302. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  6303. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  6304. <port protocol="tcp" portid="49999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6305. </ports>
  6306. <times srtt="361047" rttvar="6514" to="387103"/>
  6307. </host>
  6308. <host starttime="1606158577" endtime="1606179328"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6309. <address addr="46.166.162.97" addrtype="ipv4"/>
  6310. <hostnames>
  6311. </hostnames>
  6312. <ports><extraports state="closed" count="996">
  6313. <extrareasons reason="conn-refused" count="996"/>
  6314. </extraports>
  6315. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6316. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6317. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6318. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  6319. </ports>
  6320. <times srtt="245215" rttvar="989" to="249171"/>
  6321. </host>
  6322. <host starttime="1606158576" endtime="1606179363"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6323. <address addr="47.110.90.89" addrtype="ipv4"/>
  6324. <hostnames>
  6325. </hostnames>
  6326. <ports><extraports state="closed" count="993">
  6327. <extrareasons reason="conn-refused" count="993"/>
  6328. </extraports>
  6329. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6330. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6331. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6332. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6333. <port protocol="tcp" portid="801"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="device" method="table" conf="3"/></port>
  6334. <port protocol="tcp" portid="4443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="pharos" method="table" conf="3"/></port>
  6335. <port protocol="tcp" portid="5678"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rrac" method="table" conf="3"/></port>
  6336. </ports>
  6337. <times srtt="347970" rttvar="6525" to="374070"/>
  6338. </host>
  6339. <host starttime="1606158576" endtime="1606179397"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6340. <address addr="43.225.30.90" addrtype="ipv4"/>
  6341. <hostnames>
  6342. </hostnames>
  6343. <ports><extraports state="closed" count="991">
  6344. <extrareasons reason="conn-refused" count="991"/>
  6345. </extraports>
  6346. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6347. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  6348. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  6349. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6350. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6351. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6352. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6353. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6354. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  6355. </ports>
  6356. <times srtt="336954" rttvar="2922" to="348642"/>
  6357. </host>
  6358. <host starttime="1606158576" endtime="1606179394"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6359. <address addr="47.92.93.180" addrtype="ipv4"/>
  6360. <hostnames>
  6361. </hostnames>
  6362. <ports><extraports state="closed" count="994">
  6363. <extrareasons reason="conn-refused" count="994"/>
  6364. </extraports>
  6365. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6366. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.92.93.180,/updates.rss&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MDDRJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.92.93.180,/dot.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MASB)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6367. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6368. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6369. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  6370. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  6371. </ports>
  6372. <times srtt="371916" rttvar="5655" to="394536"/>
  6373. </host>
  6374. <host starttime="1606158576" endtime="1606179393"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6375. <address addr="49.232.42.92" addrtype="ipv4"/>
  6376. <hostnames>
  6377. </hostnames>
  6378. <ports><extraports state="closed" count="993">
  6379. <extrareasons reason="conn-refused" count="993"/>
  6380. </extraports>
  6381. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6382. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6383. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 49.232.42.92,/g.pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; LEN2)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 49.232.42.92,/dpixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6384. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6385. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6386. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  6387. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  6388. </ports>
  6389. <times srtt="361321" rttvar="1557" to="367549"/>
  6390. </host>
  6391. <host starttime="1606158577" endtime="1606179377"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6392. <address addr="45.11.180.250" addrtype="ipv4"/>
  6393. <hostnames>
  6394. </hostnames>
  6395. <ports><extraports state="closed" count="995">
  6396. <extrareasons reason="conn-refused" count="995"/>
  6397. </extraports>
  6398. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6399. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6400. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.11.180.250,/dpixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.11.180.250,/en_US/all.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP08; MAAU; NP08)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6401. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  6402. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6403. </ports>
  6404. <times srtt="219072" rttvar="882" to="222600"/>
  6405. </host>
  6406. <host starttime="1606158576" endtime="1606179378"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6407. <address addr="18.141.196.104" addrtype="ipv4"/>
  6408. <hostnames>
  6409. <hostname name="ec2-18-141-196-104.ap-southeast-1.compute.amazonaws.com" type="PTR"/>
  6410. </hostnames>
  6411. <ports><extraports state="filtered" count="997">
  6412. <extrareasons reason="no-responses" count="997"/>
  6413. </extraports>
  6414. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6415. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6416. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6417. </ports>
  6418. <times srtt="384712" rttvar="5865" to="408172"/>
  6419. </host>
  6420. <host starttime="1606158577" endtime="1606179378"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6421. <address addr="47.93.137.13" addrtype="ipv4"/>
  6422. <hostnames>
  6423. </hostnames>
  6424. <ports><extraports state="closed" count="993">
  6425. <extrareasons reason="conn-refused" count="993"/>
  6426. </extraports>
  6427. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6428. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6429. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  6430. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6431. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6432. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  6433. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  6434. </ports>
  6435. <times srtt="369792" rttvar="4476" to="387696"/>
  6436. </host>
  6437. <host starttime="1606158578" endtime="1606179377"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6438. <address addr="46.166.128.234" addrtype="ipv4"/>
  6439. <hostnames>
  6440. </hostnames>
  6441. <ports><extraports state="closed" count="996">
  6442. <extrareasons reason="conn-refused" count="996"/>
  6443. </extraports>
  6444. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6445. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6446. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 46.166.128.234,/j.ad&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 46.166.128.234,/pixel.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6447. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 46.166.128.234,/cx&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6448. </ports>
  6449. <times srtt="220134" rttvar="928" to="223846"/>
  6450. </host>
  6451. <host starttime="1606158577" endtime="1606179385"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6452. <address addr="42.192.129.232" addrtype="ipv4"/>
  6453. <hostnames>
  6454. </hostnames>
  6455. <ports><extraports state="closed" count="975">
  6456. <extrareasons reason="conn-refused" count="975"/>
  6457. </extraports>
  6458. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6459. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  6460. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6461. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6462. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6463. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6464. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6465. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6466. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  6467. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  6468. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  6469. <port protocol="tcp" portid="1111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="lmsocialserver" method="table" conf="3"/></port>
  6470. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  6471. <port protocol="tcp" portid="2222"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="EtherNetIP-1" method="table" conf="3"/></port>
  6472. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  6473. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  6474. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  6475. <port protocol="tcp" portid="6000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="X11" method="table" conf="3"/></port>
  6476. <port protocol="tcp" portid="6666"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="irc" method="table" conf="3"/></port>
  6477. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8000&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: ,/fwlink&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;NLNL)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8000&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: ,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MASAJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6478. <port protocol="tcp" portid="9999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="abyss" method="table" conf="3"/></port>
  6479. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6480. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6481. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6482. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6483. </ports>
  6484. <times srtt="342150" rttvar="6665" to="368810"/>
  6485. </host>
  6486. <host starttime="1606158576" endtime="1606179327"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6487. <address addr="34.72.161.61" addrtype="ipv4"/>
  6488. <hostnames>
  6489. <hostname name="61.161.72.34.bc.googleusercontent.com" type="PTR"/>
  6490. </hostnames>
  6491. <ports><extraports state="filtered" count="995">
  6492. <extrareasons reason="no-responses" count="995"/>
  6493. </extraports>
  6494. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6495. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6496. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  6497. <port protocol="tcp" portid="8081"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  6498. <port protocol="tcp" portid="8443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/></port>
  6499. </ports>
  6500. <times srtt="162739" rttvar="557" to="164967"/>
  6501. </host>
  6502. <host starttime="1606158577" endtime="1606179355"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6503. <address addr="31.14.40.143" addrtype="ipv4"/>
  6504. <hostnames>
  6505. </hostnames>
  6506. <ports><extraports state="closed" count="995">
  6507. <extrareasons reason="conn-refused" count="995"/>
  6508. </extraports>
  6509. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6510. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 31.14.40.143,/fwlink&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 31.14.40.143,/pixel&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6511. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6512. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  6513. <port protocol="tcp" portid="4000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="remoteanything" method="table" conf="3"/></port>
  6514. </ports>
  6515. <times srtt="240883" rttvar="600" to="243283"/>
  6516. </host>
  6517. <host starttime="1606158577" endtime="1606179328"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6518. <address addr="34.121.230.223" addrtype="ipv4"/>
  6519. <hostnames>
  6520. <hostname name="223.230.121.34.bc.googleusercontent.com" type="PTR"/>
  6521. </hostnames>
  6522. <ports><extraports state="filtered" count="995">
  6523. <extrareasons reason="no-responses" count="995"/>
  6524. </extraports>
  6525. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6526. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6527. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  6528. <port protocol="tcp" portid="8081"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  6529. <port protocol="tcp" portid="8443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/></port>
  6530. </ports>
  6531. <times srtt="163411" rttvar="868" to="166883"/>
  6532. </host>
  6533. <host starttime="1606158577" endtime="1606179370"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6534. <address addr="23.106.160.138" addrtype="ipv4"/>
  6535. <hostnames>
  6536. </hostnames>
  6537. <ports><extraports state="closed" count="992">
  6538. <extrareasons reason="conn-refused" count="992"/>
  6539. </extraports>
  6540. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6541. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6542. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.world,/pixel.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MALC)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.world,/cx&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6543. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6544. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6545. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amajai-technologies.world,/load&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6546. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6547. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  6548. </ports>
  6549. <times srtt="207732" rttvar="491" to="209696"/>
  6550. </host>
  6551. <host starttime="1606158577" endtime="1606179363"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6552. <address addr="18.223.155.112" addrtype="ipv4"/>
  6553. <hostnames>
  6554. <hostname name="ec2-18-223-155-112.us-east-2.compute.amazonaws.com" type="PTR"/>
  6555. </hostnames>
  6556. <ports><extraports state="closed" count="996">
  6557. <extrareasons reason="conn-refused" count="996"/>
  6558. </extraports>
  6559. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6560. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6561. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 18.223.155.112,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MATBJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6562. <port protocol="tcp" portid="7777"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cbt" method="table" conf="3"/></port>
  6563. </ports>
  6564. <times srtt="150963" rttvar="594" to="153339"/>
  6565. </host>
  6566. <host starttime="1606158576" endtime="1606179354"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6567. <address addr="3.137.217.140" addrtype="ipv4"/>
  6568. <hostnames>
  6569. <hostname name="ec2-3-137-217-140.us-east-2.compute.amazonaws.com" type="PTR"/>
  6570. </hostnames>
  6571. <ports><extraports state="filtered" count="997">
  6572. <extrareasons reason="no-responses" count="997"/>
  6573. </extraports>
  6574. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6575. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  6576. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 3.137.217.140,/dot.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUSMSNIP)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6577. </ports>
  6578. <times srtt="150589" rttvar="653" to="153201"/>
  6579. </host>
  6580. <host starttime="1606158576" endtime="1606179387"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6581. <address addr="3.83.145.77" addrtype="ipv4"/>
  6582. <hostnames>
  6583. <hostname name="ec2-3-83-145-77.compute-1.amazonaws.com" type="PTR"/>
  6584. </hostnames>
  6585. <ports><extraports state="filtered" count="996">
  6586. <extrareasons reason="no-responses" count="996"/>
  6587. </extraports>
  6588. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6589. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 20&#xa;C2 Server: d18apeaghqw12n.cloudfront.net,/w/api.php&#xa;HTTP Method Path 2: /wiki&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 20&#xa;C2 Server: d18apeaghqw12n.cloudfront.net,/w/api.php&#xa;HTTP Method Path 2: /wiki&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6590. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6591. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  6592. </ports>
  6593. <times srtt="134832" rttvar="1446" to="140616"/>
  6594. </host>
  6595. <host starttime="1606158578" endtime="1606179313"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6596. <address addr="18.130.155.157" addrtype="ipv4"/>
  6597. <hostnames>
  6598. <hostname name="ec2-18-130-155-157.eu-west-2.compute.amazonaws.com" type="PTR"/>
  6599. </hostnames>
  6600. <ports><extraports state="filtered" count="998">
  6601. <extrareasons reason="no-responses" count="998"/>
  6602. </extraports>
  6603. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  6604. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6605. </ports>
  6606. <times srtt="213656" rttvar="1373" to="219148"/>
  6607. </host>
  6608. <host starttime="1606158576" endtime="1606179343"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6609. <address addr="23.106.215.40" addrtype="ipv4"/>
  6610. <hostnames>
  6611. </hostnames>
  6612. <ports><extraports state="closed" count="993">
  6613. <extrareasons reason="conn-refused" count="993"/>
  6614. </extraports>
  6615. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6616. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6617. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6618. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6619. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6620. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6621. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6622. </ports>
  6623. <times srtt="208937" rttvar="831" to="212261"/>
  6624. </host>
  6625. <host starttime="1606158577" endtime="1606179351"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6626. <address addr="5.149.253.199" addrtype="ipv4"/>
  6627. <hostnames>
  6628. <hostname name="found.tzeroci.com" type="PTR"/>
  6629. </hostnames>
  6630. <ports><extraports state="closed" count="997">
  6631. <extrareasons reason="conn-refused" count="997"/>
  6632. </extraports>
  6633. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6634. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.149.253.199,/dot.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MATP; MATP)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.149.253.199,/dpixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MANM)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6635. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6636. </ports>
  6637. <times srtt="154007" rttvar="940" to="157767"/>
  6638. </host>
  6639. <host starttime="1606158577" endtime="1606179322"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6640. <address addr="3.138.181.35" addrtype="ipv4"/>
  6641. <hostnames>
  6642. <hostname name="ec2-3-138-181-35.us-east-2.compute.amazonaws.com" type="PTR"/>
  6643. </hostnames>
  6644. <ports><extraports state="filtered" count="998">
  6645. <extrareasons reason="no-responses" count="998"/>
  6646. </extraports>
  6647. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6648. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6649. </ports>
  6650. <times srtt="151218" rttvar="764" to="154274"/>
  6651. </host>
  6652. <host starttime="1606158577" endtime="1606179318"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6653. <address addr="3.236.183.143" addrtype="ipv4"/>
  6654. <hostnames>
  6655. <hostname name="ec2-3-236-183-143.compute-1.amazonaws.com" type="PTR"/>
  6656. </hostnames>
  6657. <ports><extraports state="filtered" count="998">
  6658. <extrareasons reason="no-responses" count="998"/>
  6659. </extraports>
  6660. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  6661. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6662. </ports>
  6663. <times srtt="134807" rttvar="436" to="136551"/>
  6664. </host>
  6665. <host starttime="1606158577" endtime="1606179344"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6666. <address addr="5.196.114.192" addrtype="ipv4"/>
  6667. <hostnames>
  6668. <hostname name="ip192.ip-5-196-114.eu" type="PTR"/>
  6669. </hostnames>
  6670. <ports><extraports state="closed" count="996">
  6671. <extrareasons reason="conn-refused" count="996"/>
  6672. </extraports>
  6673. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6674. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6675. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6676. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amazoning.sytes.net,/dpixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; ASU2JS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: amazoning.sytes.net,/dpixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUSMSNIP)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6677. </ports>
  6678. <times srtt="217861" rttvar="1715" to="224721"/>
  6679. </host>
  6680. <host starttime="1606158578" endtime="1606179372"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6681. <address addr="5.34.180.166" addrtype="ipv4"/>
  6682. <hostnames>
  6683. <hostname name="vds-624491.hosted-by-itldc.com" type="PTR"/>
  6684. </hostnames>
  6685. <ports><extraports state="closed" count="991">
  6686. <extrareasons reason="conn-refused" count="991"/>
  6687. </extraports>
  6688. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6689. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  6690. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6691. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.34.180.166,/j.ad&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; GTB7.4; .NET4.0C)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.34.180.166,/cx&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6692. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6693. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6694. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6695. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6696. <port protocol="tcp" portid="587"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="submission" method="table" conf="3"/></port>
  6697. </ports>
  6698. <times srtt="222113" rttvar="848" to="225505"/>
  6699. </host>
  6700. <host starttime="1606158577" endtime="1606179328"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6701. <address addr="3.234.255.7" addrtype="ipv4"/>
  6702. <hostnames>
  6703. <hostname name="ec2-3-234-255-7.compute-1.amazonaws.com" type="PTR"/>
  6704. </hostnames>
  6705. <ports><extraports state="filtered" count="998">
  6706. <extrareasons reason="no-responses" count="998"/>
  6707. </extraports>
  6708. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  6709. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6710. </ports>
  6711. <times srtt="134442" rttvar="759" to="137478"/>
  6712. </host>
  6713. <host starttime="1606158577" endtime="1606179355"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6714. <address addr="5.34.180.164" addrtype="ipv4"/>
  6715. <hostnames>
  6716. <hostname name="vds-624497.hosted-by-itldc.com" type="PTR"/>
  6717. </hostnames>
  6718. <ports><extraports state="closed" count="993">
  6719. <extrareasons reason="conn-refused" count="993"/>
  6720. </extraports>
  6721. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6722. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6723. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.34.180.164,/cm&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENUSMSE)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.34.180.164,/dot.gif&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6724. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6725. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6726. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6727. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6728. </ports>
  6729. <times srtt="222268" rttvar="2779" to="233384"/>
  6730. </host>
  6731. <host starttime="1606158576" endtime="1606179328"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6732. <address addr="8.210.253.122" addrtype="ipv4"/>
  6733. <hostnames>
  6734. </hostnames>
  6735. <ports><extraports state="closed" count="998">
  6736. <extrareasons reason="conn-refused" count="998"/>
  6737. </extraports>
  6738. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6739. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6740. </ports>
  6741. <times srtt="370805" rttvar="4155" to="387425"/>
  6742. </host>
  6743. <host starttime="1606158577" endtime="1606179600"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6744. <address addr="8.210.155.96" addrtype="ipv4"/>
  6745. <hostnames>
  6746. </hostnames>
  6747. <ports><extraports state="closed" count="995">
  6748. <extrareasons reason="conn-refused" count="995"/>
  6749. </extraports>
  6750. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6751. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: www.csmu.website,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: www.csmu.website,/en_US/all.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6752. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6753. <port protocol="tcp" portid="5730"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unieng" method="table" conf="3"/></port>
  6754. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6755. </ports>
  6756. <times srtt="695288" rttvar="277217" to="1804156"/>
  6757. </host>
  6758. <host starttime="1606158576" endtime="1606179381"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6759. <address addr="3.80.164.184" addrtype="ipv4"/>
  6760. <hostnames>
  6761. <hostname name="ec2-3-80-164-184.compute-1.amazonaws.com" type="PTR"/>
  6762. </hostnames>
  6763. <ports><extraports state="filtered" count="998">
  6764. <extrareasons reason="no-responses" count="998"/>
  6765. </extraports>
  6766. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6767. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6768. </ports>
  6769. <times srtt="135144" rttvar="1018" to="139216"/>
  6770. </host>
  6771. <host starttime="1606158577" endtime="1606179342"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6772. <address addr="5.34.180.165" addrtype="ipv4"/>
  6773. <hostnames>
  6774. <hostname name="vds-624485.hosted-by-itldc.com" type="PTR"/>
  6775. </hostnames>
  6776. <ports><extraports state="closed" count="992">
  6777. <extrareasons reason="conn-refused" count="992"/>
  6778. </extraports>
  6779. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6780. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6781. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.34.180.165,/updates.rss&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALCJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.34.180.165,/cm&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6782. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6783. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6784. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6785. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6786. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.34.180.165,/cm&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; ; NCLIENT50_AAPCDA5841E333)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_Hostname: http://10.227.200.27:9090&#xa;Proxy_AccessType: 0 (Unknown)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 5.34.180.165,/j.ad&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Win64; x64; Trident/6.0; MAARJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_Hostname: http://10.227.200.27:9090&#xa;Proxy_AccessType: 0 (Unknown)&#xa;&#xa;"/></port>
  6787. </ports>
  6788. <times srtt="221349" rttvar="1627" to="227857"/>
  6789. </host>
  6790. <host starttime="1606158576" endtime="1606179327"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6791. <address addr="8.131.67.68" addrtype="ipv4"/>
  6792. <hostnames>
  6793. </hostnames>
  6794. <ports><extraports state="filtered" count="825">
  6795. <extrareasons reason="no-responses" count="825"/>
  6796. </extraports>
  6797. <extraports state="closed" count="168">
  6798. <extrareasons reason="conn-refused" count="168"/>
  6799. </extraports>
  6800. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6801. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6802. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6803. <port protocol="tcp" portid="9080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="glrpc" method="table" conf="3"/></port>
  6804. <port protocol="tcp" portid="9081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cisco-aqos" method="table" conf="3"/></port>
  6805. <port protocol="tcp" portid="10000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="snet-sensor-mgmt" method="table" conf="3"/></port>
  6806. <port protocol="tcp" portid="10001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="scp-config" method="table" conf="3"/></port>
  6807. </ports>
  6808. <times srtt="366246" rttvar="6342" to="391614"/>
  6809. </host>
  6810. <host starttime="1606158576" endtime="1606179322"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6811. <address addr="3.137.139.119" addrtype="ipv4"/>
  6812. <hostnames>
  6813. <hostname name="ec2-3-137-139-119.us-east-2.compute.amazonaws.com" type="PTR"/>
  6814. </hostnames>
  6815. <ports><extraports state="filtered" count="997">
  6816. <extrareasons reason="no-responses" count="997"/>
  6817. </extraports>
  6818. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6819. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  6820. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6821. </ports>
  6822. <times srtt="150609" rttvar="888" to="154161"/>
  6823. </host>
  6824. <host starttime="1606158577" endtime="1606179348"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6825. <address addr="8.210.149.96" addrtype="ipv4"/>
  6826. <hostnames>
  6827. </hostnames>
  6828. <ports><extraports state="filtered" count="993">
  6829. <extrareasons reason="no-responses" count="993"/>
  6830. </extraports>
  6831. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6832. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6833. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  6834. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 8.210.149.96,/fwlink&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; MALC)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6835. <port protocol="tcp" portid="8000"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/></port>
  6836. <port protocol="tcp" portid="8001"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="vcom-tunnel" method="table" conf="3"/></port>
  6837. <port protocol="tcp" portid="8002"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="teradataordbms" method="table" conf="3"/></port>
  6838. </ports>
  6839. <times srtt="369680" rttvar="3449" to="383476"/>
  6840. </host>
  6841. <host starttime="1606158576" endtime="1606183144"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6842. <address addr="5.2.73.137" addrtype="ipv4"/>
  6843. <hostnames>
  6844. </hostnames>
  6845. <ports><extraports state="closed" count="993">
  6846. <extrareasons reason="conn-refused" count="993"/>
  6847. </extraports>
  6848. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6849. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6850. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 15000&#xa;Jitter: 15&#xa;Maxdns: 255&#xa;C2 Server: 5.2.73.137,/news_indexedimages_autrzd/&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)&#xa;HTTP Method Path 2: /current_storiesand_news_fin_tms/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 15000&#xa;Jitter: 15&#xa;Maxdns: 255&#xa;C2 Server: 5.2.73.137,/news_indexedimages_autrzd/&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/5.0)&#xa;HTTP Method Path 2: /current_storiesand_news_fin_tms/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6851. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6852. <port protocol="tcp" portid="7201"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="dlip" method="table" conf="3"/></port>
  6853. <port protocol="tcp" portid="7435"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6854. <port protocol="tcp" portid="8081"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  6855. </ports>
  6856. <times srtt="221707" rttvar="801" to="224911"/>
  6857. </host>
  6858. <host starttime="1606158577" endtime="1606183077"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6859. <address addr="51.79.161.171" addrtype="ipv4"/>
  6860. <hostnames>
  6861. <hostname name="vps-35f6595b.vps.ovh.ca" type="PTR"/>
  6862. </hostnames>
  6863. <ports><extraports state="closed" count="998">
  6864. <extrareasons reason="conn-refused" count="998"/>
  6865. </extraports>
  6866. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6867. <port protocol="tcp" portid="31337"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="Elite" method="table" conf="3"/></port>
  6868. </ports>
  6869. <times srtt="380996" rttvar="5475" to="402896"/>
  6870. </host>
  6871. <host starttime="1606158576" endtime="1606183128"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6872. <address addr="175.24.81.217" addrtype="ipv4"/>
  6873. <hostnames>
  6874. </hostnames>
  6875. <ports><extraports state="closed" count="977">
  6876. <extrareasons reason="conn-refused" count="977"/>
  6877. </extraports>
  6878. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6879. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  6880. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6881. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6882. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  6883. <port protocol="tcp" portid="83"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mit-ml-dev" method="table" conf="3"/></port>
  6884. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  6885. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6886. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6887. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  6888. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  6889. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  6890. <port protocol="tcp" portid="1089"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ff-annunc" method="table" conf="3"/></port>
  6891. <port protocol="tcp" portid="1234"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hotline" method="table" conf="3"/></port>
  6892. <port protocol="tcp" portid="1433"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-sql-s" method="table" conf="3"/></port>
  6893. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  6894. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  6895. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  6896. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  6897. <port protocol="tcp" portid="4002"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="mlchat-proxy" method="table" conf="3"/></port>
  6898. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  6899. <port protocol="tcp" portid="5087"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="biotic" method="table" conf="3"/></port>
  6900. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6901. </ports>
  6902. <times srtt="349065" rttvar="8267" to="382133"/>
  6903. </host>
  6904. <host starttime="1606158576" endtime="1606183142"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6905. <address addr="159.203.16.149" addrtype="ipv4"/>
  6906. <hostnames>
  6907. </hostnames>
  6908. <ports><extraports state="closed" count="995">
  6909. <extrareasons reason="conn-refused" count="995"/>
  6910. </extraports>
  6911. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6912. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6913. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 30000&#xa;Jitter: 20&#xa;Maxdns: 235&#xa;C2 Server: update.localhost-microsoft.net,/owa/,office365Enterprise.azureedge.net,/owa/&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)&#xa;HTTP Method Path 2: /OWA/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 30000&#xa;Jitter: 20&#xa;Maxdns: 235&#xa;C2 Server: update.localhost-microsoft.net,/owa/,office365Enterprise.azureedge.net,/owa/&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko)&#xa;HTTP Method Path 2: /OWA/&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x08\x08\x08\x08&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: GET&#xa;Spawnto_x86: %windir%\syswow64\gpupdate.exe&#xa;Spawnto_x64: %windir%\sysnative\gpupdate.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6914. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  6915. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  6916. </ports>
  6917. <times srtt="149209" rttvar="614" to="151665"/>
  6918. </host>
  6919. <host starttime="1606158576" endtime="1606183139"><status state="up" reason="conn-refused" reason_ttl="0"/>
  6920. <address addr="144.202.13.108" addrtype="ipv4"/>
  6921. <hostnames>
  6922. <hostname name="144.202.13.108.vultr.com" type="PTR"/>
  6923. </hostnames>
  6924. <ports><extraports state="closed" count="992">
  6925. <extrareasons reason="conn-refused" count="992"/>
  6926. </extraports>
  6927. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6928. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6929. <port protocol="tcp" portid="80"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  6930. <port protocol="tcp" portid="1521"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="oracle" method="table" conf="3"/></port>
  6931. <port protocol="tcp" portid="2013"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="raid-am" method="table" conf="3"/></port>
  6932. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  6933. <port protocol="tcp" portid="4443"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pharos" method="table" conf="3"/></port>
  6934. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6935. </ports>
  6936. <times srtt="141370" rttvar="1678" to="148082"/>
  6937. </host>
  6938. <host starttime="1606158578" endtime="1606183091"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6939. <address addr="141.164.55.159" addrtype="ipv4"/>
  6940. <hostnames>
  6941. <hostname name="141.164.55.159.vultr.com" type="PTR"/>
  6942. </hostnames>
  6943. <ports><extraports state="closed" count="994">
  6944. <extrareasons reason="conn-refused" count="994"/>
  6945. </extraports>
  6946. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6947. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6948. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6949. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  6950. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  6951. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  6952. </ports>
  6953. <times srtt="333839" rttvar="1603" to="340251"/>
  6954. </host>
  6955. <host starttime="1606158577" endtime="1606183099"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6956. <address addr="106.12.132.186" addrtype="ipv4"/>
  6957. <hostnames>
  6958. </hostnames>
  6959. <ports><extraports state="filtered" count="978">
  6960. <extrareasons reason="host-unreaches" count="968"/>
  6961. <extrareasons reason="no-responses" count="10"/>
  6962. </extraports>
  6963. <port protocol="tcp" portid="20"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ftp-data" method="table" conf="3"/></port>
  6964. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  6965. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6966. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  6967. <port protocol="tcp" portid="888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  6968. <port protocol="tcp" portid="1521"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="oracle" method="table" conf="3"/></port>
  6969. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  6970. <port protocol="tcp" portid="5003"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="filemaker" method="table" conf="3"/></port>
  6971. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  6972. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  6973. <port protocol="tcp" portid="9080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="glrpc" method="table" conf="3"/></port>
  6974. <port protocol="tcp" portid="10000"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="snet-sensor-mgmt" method="table" conf="3"/></port>
  6975. <port protocol="tcp" portid="10001"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="scp-config" method="table" conf="3"/></port>
  6976. <port protocol="tcp" portid="10002"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="documentum" method="table" conf="3"/></port>
  6977. <port protocol="tcp" portid="10003"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="documentum_s" method="table" conf="3"/></port>
  6978. <port protocol="tcp" portid="10004"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="emcrmirccd" method="table" conf="3"/></port>
  6979. <port protocol="tcp" portid="10009"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="swdtp-sv" method="table" conf="3"/></port>
  6980. <port protocol="tcp" portid="10010"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="rxapi" method="table" conf="3"/></port>
  6981. <port protocol="tcp" portid="10012"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6982. <port protocol="tcp" portid="10024"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6983. <port protocol="tcp" portid="10025"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  6984. <port protocol="tcp" portid="10082"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="amandaidx" method="table" conf="3"/></port>
  6985. </ports>
  6986. <times srtt="361749" rttvar="1230" to="366669"/>
  6987. </host>
  6988. <host starttime="1606158577" endtime="1606183119"><status state="up" reason="syn-ack" reason_ttl="0"/>
  6989. <address addr="87.120.254.113" addrtype="ipv4"/>
  6990. <hostnames>
  6991. </hostnames>
  6992. <ports><extraports state="closed" count="992">
  6993. <extrareasons reason="conn-refused" count="992"/>
  6994. </extraports>
  6995. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  6996. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  6997. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: h22.club,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: h22.club,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  6998. <port protocol="tcp" portid="389"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldap" method="table" conf="3"/></port>
  6999. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: h22.club,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7000. <port protocol="tcp" portid="777"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="multiling-http" method="table" conf="3"/></port>
  7001. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7002. <port protocol="tcp" portid="3800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pwgpsi" method="table" conf="3"/></port>
  7003. </ports>
  7004. <times srtt="252176" rttvar="2619" to="262652"/>
  7005. </host>
  7006. <host starttime="1606158576" endtime="1606183101"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7007. <address addr="82.194.164.37" addrtype="ipv4"/>
  7008. <hostnames>
  7009. <hostname name="host-82-194-164-37.hosts.vtc.ru" type="PTR"/>
  7010. </hostnames>
  7011. <ports><extraports state="closed" count="995">
  7012. <extrareasons reason="conn-refused" count="995"/>
  7013. </extraports>
  7014. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7015. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7016. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 20&#xa;Maxdns: 235&#xa;C2 Server: sec.kasperskys.net,/owa/auth/Logon.aspx&#xa;User Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0&#xa;HTTP Method Path 2: /OWA/auth/logon.aspx&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: R\xC2\xA4%&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 20&#xa;Maxdns: 235&#xa;C2 Server: sec.kasperskys.net,/owa/auth/Logon.aspx&#xa;User Agent: User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:50.0) Gecko/20100101 Firefox/50.0&#xa;HTTP Method Path 2: /OWA/auth/logon.aspx&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: R\xC2\xA4%&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7017. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7018. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7019. </ports>
  7020. <times srtt="405220" rttvar="3710" to="420060"/>
  7021. </host>
  7022. <host starttime="1606158576" endtime="1606183134"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7023. <address addr="47.52.113.152" addrtype="ipv4"/>
  7024. <hostnames>
  7025. </hostnames>
  7026. <ports><extraports state="filtered" count="981">
  7027. <extrareasons reason="no-responses" count="981"/>
  7028. </extraports>
  7029. <port protocol="tcp" portid="20"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ftp-data" method="table" conf="3"/></port>
  7030. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  7031. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7032. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7033. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7034. <port protocol="tcp" portid="888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  7035. <port protocol="tcp" portid="1099"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="rmiregistry" method="table" conf="3"/></port>
  7036. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7037. <port protocol="tcp" portid="4444"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  7038. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7039. <port protocol="tcp" portid="8001"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="vcom-tunnel" method="table" conf="3"/></port>
  7040. <port protocol="tcp" portid="8002"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="teradataordbms" method="table" conf="3"/></port>
  7041. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7042. <port protocol="tcp" portid="8088"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="radan-http" method="table" conf="3"/></port>
  7043. <port protocol="tcp" portid="8099"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7044. <port protocol="tcp" portid="8180"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8180&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.52.113.152,/load&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8180&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.52.113.152,/ca&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7045. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  7046. <port protocol="tcp" portid="9999"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="abyss" method="table" conf="3"/></port>
  7047. <port protocol="tcp" portid="31337"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="Elite" method="table" conf="3"/></port>
  7048. </ports>
  7049. <times srtt="372059" rttvar="3309" to="385295"/>
  7050. </host>
  7051. <host starttime="1606158575" endtime="1606183146"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7052. <address addr="45.76.99.2" addrtype="ipv4"/>
  7053. <hostnames>
  7054. <hostname name="45.76.99.2.vultr.com" type="PTR"/>
  7055. </hostnames>
  7056. <ports><extraports state="closed" count="988">
  7057. <extrareasons reason="conn-refused" count="988"/>
  7058. </extraports>
  7059. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7060. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7061. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7062. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7063. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 443&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.76.99.2,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 443&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.76.99.2,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7064. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7065. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7066. <port protocol="tcp" portid="8082"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="blackice-alerts" method="table" conf="3"/></port>
  7067. <port protocol="tcp" portid="8086"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="d-s-n" method="table" conf="3"/></port>
  7068. <port protocol="tcp" portid="9000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cslistener" method="table" conf="3"/></port>
  7069. <port protocol="tcp" portid="10082"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="amandaidx" method="table" conf="3"/></port>
  7070. <port protocol="tcp" portid="11111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vce" method="table" conf="3"/></port>
  7071. </ports>
  7072. <times srtt="304997" rttvar="816" to="308261"/>
  7073. </host>
  7074. <host starttime="1606158576" endtime="1606183099"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7075. <address addr="23.236.69.96" addrtype="ipv4"/>
  7076. <hostnames>
  7077. </hostnames>
  7078. <ports><extraports state="closed" count="991">
  7079. <extrareasons reason="conn-refused" count="991"/>
  7080. </extraports>
  7081. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7082. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7083. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7084. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7085. <port protocol="tcp" portid="500"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="isakmp" method="table" conf="3"/></port>
  7086. <port protocol="tcp" portid="1723"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="pptp" method="table" conf="3"/></port>
  7087. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7088. <port protocol="tcp" portid="16001"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="fmsascon" method="table" conf="3"/></port>
  7089. <port protocol="tcp" portid="55555"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7090. </ports>
  7091. <times srtt="208709" rttvar="506" to="210733"/>
  7092. </host>
  7093. <host starttime="1606158577" endtime="1606183126"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7094. <address addr="5.180.76.245" addrtype="ipv4"/>
  7095. <hostnames>
  7096. <hostname name="no-rdns.kddi.peering.digital-vm.com" type="PTR"/>
  7097. </hostnames>
  7098. <ports><extraports state="closed" count="986">
  7099. <extrareasons reason="conn-refused" count="986"/>
  7100. </extraports>
  7101. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7102. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7103. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7104. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7105. <port protocol="tcp" portid="888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  7106. <port protocol="tcp" portid="1433"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-sql-s" method="table" conf="3"/></port>
  7107. <port protocol="tcp" portid="3000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ppp" method="table" conf="3"/></port>
  7108. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7109. <port protocol="tcp" portid="5222"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="xmpp-client" method="table" conf="3"/></port>
  7110. <port protocol="tcp" portid="5269"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="xmpp-server" method="table" conf="3"/></port>
  7111. <port protocol="tcp" portid="5280"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="xmpp-bosh" method="table" conf="3"/></port>
  7112. <port protocol="tcp" portid="6001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="X11:1" method="table" conf="3"/></port>
  7113. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  7114. <port protocol="tcp" portid="9090"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="zeus-admin" method="table" conf="3"/></port>
  7115. </ports>
  7116. <times srtt="311097" rttvar="868" to="314569"/>
  7117. </host>
  7118. <host starttime="1606158577" endtime="1606183091"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7119. <address addr="206.189.223.152" addrtype="ipv4"/>
  7120. <hostnames>
  7121. </hostnames>
  7122. <ports><extraports state="filtered" count="997">
  7123. <extrareasons reason="no-responses" count="997"/>
  7124. </extraports>
  7125. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  7126. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7127. <port protocol="tcp" portid="8443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/></port>
  7128. </ports>
  7129. <times srtt="210936" rttvar="2388" to="220488"/>
  7130. </host>
  7131. <host starttime="1606158576" endtime="1606183107"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7132. <address addr="206.166.251.75" addrtype="ipv4"/>
  7133. <hostnames>
  7134. </hostnames>
  7135. <ports><extraports state="filtered" count="998">
  7136. <extrareasons reason="no-responses" count="998"/>
  7137. </extraports>
  7138. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7139. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7140. </ports>
  7141. <times srtt="218344" rttvar="5315" to="239604"/>
  7142. </host>
  7143. <host starttime="1606158577" endtime="1606183077"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7144. <address addr="185.158.251.113" addrtype="ipv4"/>
  7145. <hostnames>
  7146. <hostname name="vm12393.ru" type="PTR"/>
  7147. </hostnames>
  7148. <ports><extraports state="closed" count="994">
  7149. <extrareasons reason="conn-refused" count="994"/>
  7150. </extraports>
  7151. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7152. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7153. <port protocol="tcp" portid="111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="rpcbind" method="table" conf="3"/></port>
  7154. <port protocol="tcp" portid="1050"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="java-or-OTGfileshare" method="table" conf="3"/></port>
  7155. <port protocol="tcp" portid="5560"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="isqlplus" method="table" conf="3"/></port>
  7156. <port protocol="tcp" portid="9500"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ismserver" method="table" conf="3"/></port>
  7157. </ports>
  7158. <times srtt="226003" rttvar="722" to="228891"/>
  7159. </host>
  7160. <host starttime="1606158576" endtime="1606183077"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7161. <address addr="204.44.88.34" addrtype="ipv4"/>
  7162. <hostnames>
  7163. <hostname name="204.44.88.34.static.quadranet.com" type="PTR"/>
  7164. </hostnames>
  7165. <ports><extraports state="closed" count="997">
  7166. <extrareasons reason="conn-refused" count="997"/>
  7167. </extraports>
  7168. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7169. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7170. <port protocol="tcp" portid="8093"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7171. </ports>
  7172. <times srtt="202843" rttvar="2365" to="212303"/>
  7173. </host>
  7174. <host starttime="1606158577" endtime="1606183139"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7175. <address addr="193.34.166.124" addrtype="ipv4"/>
  7176. <hostnames>
  7177. <hostname name="cb3.tms.rv" type="PTR"/>
  7178. </hostnames>
  7179. <ports><extraports state="filtered" count="996">
  7180. <extrareasons reason="no-responses" count="996"/>
  7181. </extraports>
  7182. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7183. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7184. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7185. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7186. </ports>
  7187. <times srtt="214047" rttvar="835" to="217387"/>
  7188. </host>
  7189. <host starttime="1606158576" endtime="1606183117"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7190. <address addr="192.144.234.207" addrtype="ipv4"/>
  7191. <hostnames>
  7192. </hostnames>
  7193. <ports><extraports state="closed" count="982">
  7194. <extrareasons reason="conn-refused" count="982"/>
  7195. </extraports>
  7196. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7197. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.144.234.207,/visit.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/6.0; MALNJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.144.234.207,/g.pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; Trident/5.0; BOIE9;ENUSMSNIP)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7198. <port protocol="tcp" portid="135"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  7199. <port protocol="tcp" portid="139"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7200. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7201. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7202. <port protocol="tcp" portid="1082"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="amt-esd-prot" method="table" conf="3"/></port>
  7203. <port protocol="tcp" portid="1085"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="webobjects" method="table" conf="3"/></port>
  7204. <port protocol="tcp" portid="1433"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-sql-s" method="table" conf="3"/></port>
  7205. <port protocol="tcp" portid="3011"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="trusted-web" method="table" conf="3"/></port>
  7206. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7207. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  7208. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  7209. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  7210. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7211. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7212. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7213. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7214. </ports>
  7215. <times srtt="374173" rttvar="2366" to="383637"/>
  7216. </host>
  7217. <host starttime="1606158577" endtime="1606183093"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7218. <address addr="193.34.167.80" addrtype="ipv4"/>
  7219. <hostnames>
  7220. <hostname name="cb2.tm.srv" type="PTR"/>
  7221. </hostnames>
  7222. <ports><extraports state="filtered" count="988">
  7223. <extrareasons reason="no-responses" count="988"/>
  7224. </extraports>
  7225. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7226. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7227. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: wustatwindows.com,/dpixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7228. <port protocol="tcp" portid="1000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cadlock" method="table" conf="3"/></port>
  7229. <port protocol="tcp" portid="1001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="webpush" method="table" conf="3"/></port>
  7230. <port protocol="tcp" portid="2000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cisco-sccp" method="table" conf="3"/></port>
  7231. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7232. <port protocol="tcp" portid="10000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="snet-sensor-mgmt" method="table" conf="3"/></port>
  7233. <port protocol="tcp" portid="10001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="scp-config" method="table" conf="3"/></port>
  7234. <port protocol="tcp" portid="10002"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="documentum" method="table" conf="3"/></port>
  7235. <port protocol="tcp" portid="11111"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vce" method="table" conf="3"/></port>
  7236. <port protocol="tcp" portid="12345"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="netbus" method="table" conf="3"/></port>
  7237. </ports>
  7238. <times srtt="213802" rttvar="709" to="216638"/>
  7239. </host>
  7240. <host starttime="1606158575" endtime="1606183109"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7241. <address addr="34.212.57.1" addrtype="ipv4"/>
  7242. <hostnames>
  7243. <hostname name="ec2-34-212-57-1.us-west-2.compute.amazonaws.com" type="PTR"/>
  7244. </hostnames>
  7245. <ports><extraports state="filtered" count="998">
  7246. <extrareasons reason="no-responses" count="998"/>
  7247. </extraports>
  7248. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 34.212.57.1,/push&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 34.212.57.1,/cm&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7249. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7250. </ports>
  7251. <times srtt="225584" rttvar="8201" to="258388"/>
  7252. </host>
  7253. <host starttime="1606158576" endtime="1606183079"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7254. <address addr="165.227.85.160" addrtype="ipv4"/>
  7255. <hostnames>
  7256. </hostnames>
  7257. <ports><extraports state="closed" count="991">
  7258. <extrareasons reason="conn-refused" count="991"/>
  7259. </extraports>
  7260. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7261. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7262. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7263. <port protocol="tcp" portid="1075"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rdrmshc" method="table" conf="3"/></port>
  7264. <port protocol="tcp" portid="2006"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="invokator" method="table" conf="3"/></port>
  7265. <port protocol="tcp" portid="8600"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="asterix" method="table" conf="3"/></port>
  7266. <port protocol="tcp" portid="10009"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="swdtp-sv" method="table" conf="3"/></port>
  7267. <port protocol="tcp" portid="20031"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7268. <port protocol="tcp" portid="35500"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7269. </ports>
  7270. <times srtt="142657" rttvar="1491" to="148621"/>
  7271. </host>
  7272. <host starttime="1606158576" endtime="1606183079"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7273. <address addr="3.16.1.87" addrtype="ipv4"/>
  7274. <hostnames>
  7275. <hostname name="ec2-3-16-1-87.us-east-2.compute.amazonaws.com" type="PTR"/>
  7276. </hostnames>
  7277. <ports><extraports state="filtered" count="996">
  7278. <extrareasons reason="no-responses" count="996"/>
  7279. </extraports>
  7280. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  7281. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7282. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  7283. <port protocol="tcp" portid="8090"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="opsmessaging" method="table" conf="3"/></port>
  7284. </ports>
  7285. <times srtt="152548" rttvar="1478" to="158460"/>
  7286. </host>
  7287. <host starttime="1606158577" endtime="1606183107"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7288. <address addr="95.217.197.78" addrtype="ipv4"/>
  7289. <hostnames>
  7290. <hostname name="static.78.197.217.95.clients.your-server.de" type="PTR"/>
  7291. </hostnames>
  7292. <ports><extraports state="closed" count="993">
  7293. <extrareasons reason="conn-refused" count="993"/>
  7294. </extraports>
  7295. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7296. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7297. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7298. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7299. <port protocol="tcp" portid="500"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="isakmp" method="table" conf="3"/></port>
  7300. <port protocol="tcp" portid="1034"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="zincite-a" method="table" conf="3"/></port>
  7301. <port protocol="tcp" portid="12000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cce4x" method="table" conf="3"/></port>
  7302. </ports>
  7303. <times srtt="240286" rttvar="4427" to="257994"/>
  7304. </host>
  7305. <host starttime="1606158577" endtime="1606183114"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7306. <address addr="47.74.39.152" addrtype="ipv4"/>
  7307. <hostnames>
  7308. </hostnames>
  7309. <ports><extraports state="filtered" count="985">
  7310. <extrareasons reason="no-responses" count="985"/>
  7311. </extraports>
  7312. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7313. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7314. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 104.31.93.225,/dot.gif,104.31.92.225,/__utm.gif,172.67.154.117,/dot.gif,172.64.87.181,/push&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.0; WOW64; Trident/5.0; msn OptimizedIE8;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 104.31.93.225,/ga.js,104.31.92.225,/pixel,172.67.154.117,/en_US/all.js,172.64.87.181,/updates.rss&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7315. <port protocol="tcp" portid="81"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  7316. <port protocol="tcp" portid="389"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ldap" method="table" conf="3"/></port>
  7317. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7318. <port protocol="tcp" portid="1080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="socks" method="table" conf="3"/></port>
  7319. <port protocol="tcp" portid="1099"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="rmiregistry" method="table" conf="3"/></port>
  7320. <port protocol="tcp" portid="3000"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ppp" method="table" conf="3"/></port>
  7321. <port protocol="tcp" portid="3389"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7322. <port protocol="tcp" portid="4444"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  7323. <port protocol="tcp" portid="7777"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="cbt" method="table" conf="3"/></port>
  7324. <port protocol="tcp" portid="8000"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/></port>
  7325. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  7326. <port protocol="tcp" portid="8443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/></port>
  7327. </ports>
  7328. <times srtt="307010" rttvar="4997" to="326998"/>
  7329. </host>
  7330. <host starttime="1606158577" endtime="1606183139"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7331. <address addr="34.203.235.59" addrtype="ipv4"/>
  7332. <hostnames>
  7333. <hostname name="ec2-34-203-235-59.compute-1.amazonaws.com" type="PTR"/>
  7334. </hostnames>
  7335. <ports><extraports state="filtered" count="997">
  7336. <extrareasons reason="no-responses" count="997"/>
  7337. </extraports>
  7338. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7339. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 20000&#xa;Jitter: 20&#xa;C2 Server: sitehealthcheck.org,/oscp/&#xa;HTTP Method Path 2: /oscp/a/&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7340. <port protocol="tcp" portid="3000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ppp" method="table" conf="3"/></port>
  7341. </ports>
  7342. <times srtt="136774" rttvar="555" to="138994"/>
  7343. </host>
  7344. <host starttime="1606158577" endtime="1606183126"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7345. <address addr="34.211.110.219" addrtype="ipv4"/>
  7346. <hostnames>
  7347. <hostname name="ec2-34-211-110-219.us-west-2.compute.amazonaws.com" type="PTR"/>
  7348. </hostnames>
  7349. <ports><extraports state="filtered" count="998">
  7350. <extrareasons reason="no-responses" count="998"/>
  7351. </extraports>
  7352. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7353. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: nelnetbanks.com,/fwlink&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2; InfoPath.3)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7354. </ports>
  7355. <times srtt="225050" rttvar="8073" to="257342"/>
  7356. </host>
  7357. <host starttime="1606158576" endtime="1606183089"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7358. <address addr="34.238.192.43" addrtype="ipv4"/>
  7359. <hostnames>
  7360. <hostname name="ec2-34-238-192-43.compute-1.amazonaws.com" type="PTR"/>
  7361. </hostnames>
  7362. <ports><extraports state="filtered" count="991">
  7363. <extrareasons reason="no-responses" count="991"/>
  7364. </extraports>
  7365. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7366. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  7367. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7368. <port protocol="tcp" portid="900"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="omginitialrefs" method="table" conf="3"/></port>
  7369. <port protocol="tcp" portid="901"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="samba-swat" method="table" conf="3"/></port>
  7370. <port protocol="tcp" portid="902"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="iss-realsecure" method="table" conf="3"/></port>
  7371. <port protocol="tcp" portid="903"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="iss-console-mgr" method="table" conf="3"/></port>
  7372. <port protocol="tcp" portid="911"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="xact-backup" method="table" conf="3"/></port>
  7373. <port protocol="tcp" portid="912"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="apex-mesh" method="table" conf="3"/></port>
  7374. </ports>
  7375. <times srtt="136399" rttvar="792" to="139567"/>
  7376. </host>
  7377. <host starttime="1606158577" endtime="1606183107"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7378. <address addr="95.217.197.67" addrtype="ipv4"/>
  7379. <hostnames>
  7380. <hostname name="static.67.197.217.95.clients.your-server.de" type="PTR"/>
  7381. </hostnames>
  7382. <ports><extraports state="closed" count="992">
  7383. <extrareasons reason="conn-refused" count="992"/>
  7384. </extraports>
  7385. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7386. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7387. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7388. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7389. <port protocol="tcp" portid="500"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="isakmp" method="table" conf="3"/></port>
  7390. <port protocol="tcp" portid="7201"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="dlip" method="table" conf="3"/></port>
  7391. <port protocol="tcp" portid="12000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cce4x" method="table" conf="3"/></port>
  7392. <port protocol="tcp" portid="27355"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7393. </ports>
  7394. <times srtt="241416" rttvar="4380" to="258936"/>
  7395. </host>
  7396. <host starttime="1606158576" endtime="1606183107"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7397. <address addr="95.217.197.85" addrtype="ipv4"/>
  7398. <hostnames>
  7399. <hostname name="static.85.197.217.95.clients.your-server.de" type="PTR"/>
  7400. </hostnames>
  7401. <ports><extraports state="closed" count="991">
  7402. <extrareasons reason="conn-refused" count="991"/>
  7403. </extraports>
  7404. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7405. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7406. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7407. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7408. <port protocol="tcp" portid="500"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="isakmp" method="table" conf="3"/></port>
  7409. <port protocol="tcp" portid="544"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="kshell" method="table" conf="3"/></port>
  7410. <port protocol="tcp" portid="12000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cce4x" method="table" conf="3"/></port>
  7411. <port protocol="tcp" portid="15004"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7412. <port protocol="tcp" portid="32780"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sometimes-rpc23" method="table" conf="3"/></port>
  7413. </ports>
  7414. <times srtt="240528" rttvar="3788" to="255680"/>
  7415. </host>
  7416. <host starttime="1606158577" endtime="1606183101"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7417. <address addr="44.234.72.246" addrtype="ipv4"/>
  7418. <hostnames>
  7419. <hostname name="ec2-44-234-72-246.us-west-2.compute.amazonaws.com" type="PTR"/>
  7420. </hostnames>
  7421. <ports><extraports state="filtered" count="998">
  7422. <extrareasons reason="no-responses" count="998"/>
  7423. </extraports>
  7424. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7425. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7426. </ports>
  7427. <times srtt="221781" rttvar="7292" to="250949"/>
  7428. </host>
  7429. <host starttime="1606158578" endtime="1606183120"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7430. <address addr="83.97.20.191" addrtype="ipv4"/>
  7431. <hostnames>
  7432. <hostname name="191.20.97.83.ro.ovo.sc" type="PTR"/>
  7433. </hostnames>
  7434. <ports><extraports state="closed" count="993">
  7435. <extrareasons reason="conn-refused" count="993"/>
  7436. </extraports>
  7437. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7438. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7439. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7440. <port protocol="tcp" portid="720"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7441. <port protocol="tcp" portid="1199"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="dmidi" method="table" conf="3"/></port>
  7442. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7443. <port protocol="tcp" portid="16018"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7444. </ports>
  7445. <times srtt="256014" rttvar="1056" to="260238"/>
  7446. </host>
  7447. <host starttime="1606158576" endtime="1606183149"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7448. <address addr="47.103.53.54" addrtype="ipv4"/>
  7449. <hostnames>
  7450. </hostnames>
  7451. <ports><extraports state="closed" count="984">
  7452. <extrareasons reason="conn-refused" count="984"/>
  7453. </extraports>
  7454. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7455. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  7456. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7457. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.103.53.54,/IE9CompatViewList.xml&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; BOIE9;ENXA)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.103.53.54,/match&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; NP06)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7458. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  7459. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7460. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7461. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7462. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  7463. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  7464. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  7465. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  7466. <port protocol="tcp" portid="1972"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="intersys-cache" method="table" conf="3"/></port>
  7467. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  7468. <port protocol="tcp" portid="3546"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7469. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  7470. </ports>
  7471. <times srtt="421774" rttvar="40138" to="582326"/>
  7472. </host>
  7473. <host starttime="1606158576" endtime="1606183101"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7474. <address addr="47.98.123.167" addrtype="ipv4"/>
  7475. <hostnames>
  7476. </hostnames>
  7477. <ports><extraports state="closed" count="995">
  7478. <extrareasons reason="conn-refused" count="995"/>
  7479. </extraports>
  7480. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7481. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7482. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7483. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7484. <port protocol="tcp" portid="9090"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="zeus-admin" method="table" conf="3"/></port>
  7485. </ports>
  7486. <times srtt="352711" rttvar="8643" to="387283"/>
  7487. </host>
  7488. <host starttime="1606158578" endtime="1606183080"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7489. <address addr="18.216.51.155" addrtype="ipv4"/>
  7490. <hostnames>
  7491. <hostname name="ec2-18-216-51-155.us-east-2.compute.amazonaws.com" type="PTR"/>
  7492. </hostnames>
  7493. <ports><extraports state="filtered" count="998">
  7494. <extrareasons reason="no-responses" count="998"/>
  7495. </extraports>
  7496. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  7497. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7498. </ports>
  7499. <times srtt="153019" rttvar="576" to="155323"/>
  7500. </host>
  7501. <host starttime="1606158576" endtime="1606183139"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7502. <address addr="3.95.159.27" addrtype="ipv4"/>
  7503. <hostnames>
  7504. <hostname name="ec2-3-95-159-27.compute-1.amazonaws.com" type="PTR"/>
  7505. </hostnames>
  7506. <ports><extraports state="filtered" count="997">
  7507. <extrareasons reason="no-responses" count="997"/>
  7508. </extraports>
  7509. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7510. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  7511. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 32051&#xa;Jitter: 57&#xa;Maxdns: 255&#xa;C2 Server: sharkfishinguk.com,/jquery-1.12.1.min.js&#xa;User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/537.36 Edg/80.0.361.62&#xa;HTTP Method Path 2: /jquery-1.12.2.min.js&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\svchost.exe&#xa;Spawnto_x64: %windir%\sysnative\spoolsv.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7512. </ports>
  7513. <times srtt="136352" rttvar="626" to="138856"/>
  7514. </host>
  7515. <host starttime="1606158577" endtime="1606183101"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7516. <address addr="104.248.29.178" addrtype="ipv4"/>
  7517. <hostnames>
  7518. </hostnames>
  7519. <ports><extraports state="closed" count="993">
  7520. <extrareasons reason="conn-refused" count="993"/>
  7521. </extraports>
  7522. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7523. <port protocol="tcp" portid="32"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7524. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7525. <port protocol="tcp" portid="80"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  7526. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7527. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7528. <port protocol="tcp" portid="8008"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  7529. </ports>
  7530. <times srtt="225630" rttvar="2283" to="234762"/>
  7531. </host>
  7532. <host starttime="1606158576" endtime="1606183077"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7533. <address addr="104.248.88.66" addrtype="ipv4"/>
  7534. <hostnames>
  7535. </hostnames>
  7536. <ports><extraports state="closed" count="995">
  7537. <extrareasons reason="conn-refused" count="995"/>
  7538. </extraports>
  7539. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7540. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7541. <port protocol="tcp" portid="2006"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="invokator" method="table" conf="3"/></port>
  7542. <port protocol="tcp" portid="3006"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="deslogind" method="table" conf="3"/></port>
  7543. <port protocol="tcp" portid="3703"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="adobeserver-3" method="table" conf="3"/></port>
  7544. </ports>
  7545. <times srtt="226856" rttvar="792" to="230024"/>
  7546. </host>
  7547. <host starttime="1606158577" endtime="1606183090"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7548. <address addr="34.80.10.27" addrtype="ipv4"/>
  7549. <hostnames>
  7550. <hostname name="27.10.80.34.bc.googleusercontent.com" type="PTR"/>
  7551. </hostnames>
  7552. <ports><extraports state="filtered" count="995">
  7553. <extrareasons reason="no-responses" count="995"/>
  7554. </extraports>
  7555. <port protocol="tcp" portid="22"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7556. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7557. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7558. <port protocol="tcp" portid="3389"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7559. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  7560. </ports>
  7561. <times srtt="352409" rttvar="21282" to="437537"/>
  7562. </host>
  7563. <host starttime="1606158578" endtime="1606183100"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7564. <address addr="114.215.201.42" addrtype="ipv4"/>
  7565. <hostnames>
  7566. </hostnames>
  7567. <ports><extraports state="closed" count="978">
  7568. <extrareasons reason="conn-refused" count="978"/>
  7569. </extraports>
  7570. <port protocol="tcp" portid="42"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nameserver" method="table" conf="3"/></port>
  7571. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7572. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7573. <port protocol="tcp" portid="88"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="kerberos-sec" method="table" conf="3"/></port>
  7574. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  7575. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7576. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7577. <port protocol="tcp" portid="593"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="http-rpc-epmap" method="table" conf="3"/></port>
  7578. <port protocol="tcp" portid="1025"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="NFS-or-IIS" method="table" conf="3"/></port>
  7579. <port protocol="tcp" portid="1068"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="instl_bootc" method="table" conf="3"/></port>
  7580. <port protocol="tcp" portid="1433"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-sql-s" method="table" conf="3"/></port>
  7581. <port protocol="tcp" portid="1434"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ms-sql-m" method="table" conf="3"/></port>
  7582. <port protocol="tcp" portid="2383"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-olap4" method="table" conf="3"/></port>
  7583. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  7584. <port protocol="tcp" portid="3389"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ms-wbt-server" method="table" conf="3"/></port>
  7585. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  7586. <port protocol="tcp" portid="8007"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ajp12" method="table" conf="3"/></port>
  7587. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  7588. <port protocol="tcp" portid="15000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hydap" method="table" conf="3"/></port>
  7589. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7590. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7591. <port protocol="tcp" portid="49154"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7592. </ports>
  7593. <times srtt="350116" rttvar="3268" to="363188"/>
  7594. </host>
  7595. <host starttime="1606158577" endtime="1606183126"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7596. <address addr="45.147.229.59" addrtype="ipv4"/>
  7597. <hostnames>
  7598. </hostnames>
  7599. <ports><extraports state="filtered" count="996">
  7600. <extrareasons reason="no-responses" count="996"/>
  7601. </extraports>
  7602. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7603. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.147.229.59,/g.pixel&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 45.147.229.59,/ga.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7604. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  7605. <port protocol="tcp" portid="443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https" method="table" conf="3"/></port>
  7606. </ports>
  7607. <times srtt="221427" rttvar="1888" to="228979"/>
  7608. </host>
  7609. <host starttime="1606158577" endtime="1606183080"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7610. <address addr="34.72.48.115" addrtype="ipv4"/>
  7611. <hostnames>
  7612. <hostname name="115.48.72.34.bc.googleusercontent.com" type="PTR"/>
  7613. </hostnames>
  7614. <ports><extraports state="filtered" count="995">
  7615. <extrareasons reason="no-responses" count="995"/>
  7616. </extraports>
  7617. <port protocol="tcp" portid="80"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http" method="table" conf="3"/></port>
  7618. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7619. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  7620. <port protocol="tcp" portid="8081"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  7621. <port protocol="tcp" portid="8443"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/></port>
  7622. </ports>
  7623. <times srtt="163962" rttvar="633" to="166494"/>
  7624. </host>
  7625. <host starttime="1606158577" endtime="1606183082"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7626. <address addr="5.180.99.65" addrtype="ipv4"/>
  7627. <hostnames>
  7628. </hostnames>
  7629. <ports><extraports state="closed" count="992">
  7630. <extrareasons reason="conn-refused" count="992"/>
  7631. </extraports>
  7632. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7633. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7634. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  7635. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7636. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7637. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7638. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  7639. <port protocol="tcp" portid="58080"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7640. </ports>
  7641. <times srtt="325018" rttvar="2941" to="336782"/>
  7642. </host>
  7643. <host starttime="1606158576" endtime="1606183082"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7644. <address addr="193.29.15.177" addrtype="ipv4"/>
  7645. <hostnames>
  7646. </hostnames>
  7647. <ports><extraports state="closed" count="998">
  7648. <extrareasons reason="conn-refused" count="998"/>
  7649. </extraports>
  7650. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7651. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7652. </ports>
  7653. <times srtt="269311" rttvar="2727" to="280219"/>
  7654. </host>
  7655. <host starttime="1606158578" endtime="1606183122"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7656. <address addr="192.51.188.134" addrtype="ipv4"/>
  7657. <hostnames>
  7658. </hostnames>
  7659. <ports><extraports state="closed" count="988">
  7660. <extrareasons reason="conn-refused" count="988"/>
  7661. </extraports>
  7662. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7663. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7664. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7665. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7666. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 443&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.51.188.134,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 443&#xa;Polling: 5000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 192.51.188.134,/s/ref=nb_sb_noss_1/167-3294888-0262949/field-keywords=books&#xa;User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko&#xa;HTTP Method Path 2: /N4215/adj/amzn.us.sr.aps&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7667. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7668. <port protocol="tcp" portid="8082"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-alerts" method="table" conf="3"/></port>
  7669. <port protocol="tcp" portid="8085"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7670. <port protocol="tcp" portid="8088"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="radan-http" method="table" conf="3"/></port>
  7671. <port protocol="tcp" portid="8089"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7672. <port protocol="tcp" portid="8099"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7673. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7674. </ports>
  7675. <times srtt="318505" rttvar="1354" to="323921"/>
  7676. </host>
  7677. <host starttime="1606158576" endtime="1606183099"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7678. <address addr="194.156.228.12" addrtype="ipv4"/>
  7679. <hostnames>
  7680. </hostnames>
  7681. <ports><extraports state="closed" count="992">
  7682. <extrareasons reason="conn-refused" count="992"/>
  7683. </extraports>
  7684. <port protocol="tcp" portid="25"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="smtp" method="table" conf="3"/></port>
  7685. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7686. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7687. <port protocol="tcp" portid="135"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="msrpc" method="table" conf="3"/></port>
  7688. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7689. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7690. <port protocol="tcp" portid="8011"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7691. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7692. </ports>
  7693. <times srtt="142503" rttvar="1197" to="147291"/>
  7694. </host>
  7695. <host starttime="1606158576" endtime="1606183126"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7696. <address addr="198.13.39.67" addrtype="ipv4"/>
  7697. <hostnames>
  7698. <hostname name="198.13.39.67.vultr.com" type="PTR"/>
  7699. </hostnames>
  7700. <ports><extraports state="closed" count="990">
  7701. <extrareasons reason="conn-refused" count="990"/>
  7702. </extraports>
  7703. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7704. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7705. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7706. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7707. <port protocol="tcp" portid="1088"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cplscrambler-al" method="table" conf="3"/></port>
  7708. <port protocol="tcp" portid="7443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="oracleas-https" method="table" conf="3"/></port>
  7709. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7710. <port protocol="tcp" portid="8088"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="radan-http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7711. <port protocol="tcp" portid="8181"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="intermapper" method="table" conf="3"/></port>
  7712. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7713. </ports>
  7714. <times srtt="305005" rttvar="944" to="308781"/>
  7715. </host>
  7716. <host starttime="1606158577" endtime="1606183122"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7717. <address addr="185.243.41.224" addrtype="ipv4"/>
  7718. <hostnames>
  7719. </hostnames>
  7720. <ports><extraports state="closed" count="994">
  7721. <extrareasons reason="conn-refused" count="994"/>
  7722. </extraports>
  7723. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7724. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7725. <port protocol="tcp" portid="3011"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="trusted-web" method="table" conf="3"/></port>
  7726. <port protocol="tcp" portid="7778"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="interwise" method="table" conf="3"/></port>
  7727. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7728. <port protocol="tcp" portid="9100"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="jetdirect" method="table" conf="3"/></port>
  7729. </ports>
  7730. <times srtt="315460" rttvar="3776" to="330564"/>
  7731. </host>
  7732. <host starttime="1606158576" endtime="1606183139"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7733. <address addr="146.185.132.43" addrtype="ipv4"/>
  7734. <hostnames>
  7735. </hostnames>
  7736. <ports><extraports state="closed" count="993">
  7737. <extrareasons reason="conn-refused" count="993"/>
  7738. </extraports>
  7739. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7740. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7741. <port protocol="tcp" portid="902"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="iss-realsecure" method="table" conf="3"/></port>
  7742. <port protocol="tcp" portid="1075"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="rdrmshc" method="table" conf="3"/></port>
  7743. <port protocol="tcp" portid="1185"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="catchpole" method="table" conf="3"/></port>
  7744. <port protocol="tcp" portid="1719"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="h323gatestat" method="table" conf="3"/></port>
  7745. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7746. </ports>
  7747. <times srtt="227113" rttvar="2158" to="235745"/>
  7748. </host>
  7749. <host starttime="1606158577" endtime="1606183137"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7750. <address addr="167.179.78.159" addrtype="ipv4"/>
  7751. <hostnames>
  7752. <hostname name="167.179.78.159.vultr.com" type="PTR"/>
  7753. </hostnames>
  7754. <ports><extraports state="closed" count="991">
  7755. <extrareasons reason="conn-refused" count="991"/>
  7756. </extraports>
  7757. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7758. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7759. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7760. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7761. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 167.179.78.159,/cm&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 167.179.78.159,/push&#xa;User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; BTRS125526)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7762. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7763. <port protocol="tcp" portid="3322"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="active-net" method="table" conf="3"/></port>
  7764. <port protocol="tcp" portid="8088"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="radan-http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7765. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7766. </ports>
  7767. <times srtt="304470" rttvar="587" to="306818"/>
  7768. </host>
  7769. <host starttime="1606158577" endtime="1606183095"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7770. <address addr="159.69.211.104" addrtype="ipv4"/>
  7771. <hostnames>
  7772. <hostname name="static.104.211.69.159.clients.your-server.de" type="PTR"/>
  7773. </hostnames>
  7774. <ports><extraports state="closed" count="997">
  7775. <extrareasons reason="conn-refused" count="997"/>
  7776. </extraports>
  7777. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7778. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 159.69.211.104,/cm&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 8080&#xa;Polling: 60000&#xa;Jitter: 0&#xa;C2 Server: 159.69.211.104,/IE9CompatViewList.xml&#xa;HTTP Method Path 2: /submit.php&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7779. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7780. </ports>
  7781. <times srtt="229799" rttvar="2259" to="238835"/>
  7782. </host>
  7783. <host starttime="1606158577" endtime="1606183106"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7784. <address addr="141.164.59.234" addrtype="ipv4"/>
  7785. <hostnames>
  7786. <hostname name="141.164.59.234.vultr.com" type="PTR"/>
  7787. </hostnames>
  7788. <ports><extraports state="closed" count="985">
  7789. <extrareasons reason="conn-refused" count="985"/>
  7790. </extraports>
  7791. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7792. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7793. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7794. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  7795. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7796. <port protocol="tcp" portid="306"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7797. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7798. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7799. <port protocol="tcp" portid="1812"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="radius" method="table" conf="3"/></port>
  7800. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  7801. <port protocol="tcp" portid="3828"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="neteh" method="table" conf="3"/></port>
  7802. <port protocol="tcp" portid="4000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="remoteanything" method="table" conf="3"/></port>
  7803. <port protocol="tcp" portid="5555"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="freeciv" method="table" conf="3"/></port>
  7804. <port protocol="tcp" portid="8010"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="xmpp" method="table" conf="3"/></port>
  7805. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7806. </ports>
  7807. <times srtt="339533" rttvar="1050" to="343733"/>
  7808. </host>
  7809. <host starttime="1606158577" endtime="1606183109"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7810. <address addr="119.45.236.153" addrtype="ipv4"/>
  7811. <hostnames>
  7812. </hostnames>
  7813. <ports><extraports state="closed" count="983">
  7814. <extrareasons reason="conn-refused" count="983"/>
  7815. </extraports>
  7816. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7817. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7818. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7819. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7820. <port protocol="tcp" portid="1192"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="caids-sensor" method="table" conf="3"/></port>
  7821. <port protocol="tcp" portid="3000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ppp" method="table" conf="3"/></port>
  7822. <port protocol="tcp" portid="3006"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="deslogind" method="table" conf="3"/></port>
  7823. <port protocol="tcp" portid="3703"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="adobeserver-3" method="table" conf="3"/></port>
  7824. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  7825. <port protocol="tcp" portid="5000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="upnp" method="table" conf="3"/></port>
  7826. <port protocol="tcp" portid="5003"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="filemaker" method="table" conf="3"/></port>
  7827. <port protocol="tcp" portid="6565"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7828. <port protocol="tcp" portid="8011"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7829. <port protocol="tcp" portid="8022"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="oa-system" method="table" conf="3"/></port>
  7830. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7831. <port protocol="tcp" portid="8600"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="asterix" method="table" conf="3"/></port>
  7832. <port protocol="tcp" portid="10009"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="swdtp-sv" method="table" conf="3"/></port>
  7833. </ports>
  7834. <times srtt="337755" rttvar="754" to="340771"/>
  7835. </host>
  7836. <host starttime="1606158577" endtime="1606183100"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7837. <address addr="119.29.196.179" addrtype="ipv4"/>
  7838. <hostnames>
  7839. </hostnames>
  7840. <ports><extraports state="closed" count="996">
  7841. <extrareasons reason="conn-refused" count="996"/>
  7842. </extraports>
  7843. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7844. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7845. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  7846. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7847. </ports>
  7848. <times srtt="375629" rttvar="8617" to="410097"/>
  7849. </host>
  7850. <host starttime="1606158577" endtime="1606183107"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7851. <address addr="106.12.39.243" addrtype="ipv4"/>
  7852. <hostnames>
  7853. </hostnames>
  7854. <ports><extraports state="closed" count="991">
  7855. <extrareasons reason="conn-refused" count="991"/>
  7856. </extraports>
  7857. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7858. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7859. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7860. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7861. <port protocol="tcp" portid="800"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mdbs_daemon" method="table" conf="3"/></port>
  7862. <port protocol="tcp" portid="801"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="device" method="table" conf="3"/></port>
  7863. <port protocol="tcp" portid="1234"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hotline" method="table" conf="3"/></port>
  7864. <port protocol="tcp" portid="4444"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  7865. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7866. </ports>
  7867. <times srtt="405891" rttvar="49601" to="604295"/>
  7868. </host>
  7869. <host starttime="1606158577" endtime="1606183100"><status state="up" reason="conn-refused" reason_ttl="0"/>
  7870. <address addr="45.63.15.251" addrtype="ipv4"/>
  7871. <hostnames>
  7872. <hostname name="45.63.15.251.vultr.com" type="PTR"/>
  7873. </hostnames>
  7874. <ports><extraports state="closed" count="993">
  7875. <extrareasons reason="conn-refused" count="993"/>
  7876. </extraports>
  7877. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7878. <port protocol="tcp" portid="139"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netbios-ssn" method="table" conf="3"/></port>
  7879. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7880. <port protocol="tcp" portid="544"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="kshell" method="table" conf="3"/></port>
  7881. <port protocol="tcp" portid="1688"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nsjtp-data" method="table" conf="3"/></port>
  7882. <port protocol="tcp" portid="8045"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7883. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7884. </ports>
  7885. <times srtt="142881" rttvar="2143" to="151453"/>
  7886. </host>
  7887. <host starttime="1606158576" endtime="1606183100"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7888. <address addr="85.194.241.41" addrtype="ipv4"/>
  7889. <hostnames>
  7890. <hostname name="ip-41.85-194-241-0.net.eco.atman.pl" type="PTR"/>
  7891. </hostnames>
  7892. <ports><extraports state="closed" count="995">
  7893. <extrareasons reason="conn-refused" count="995"/>
  7894. </extraports>
  7895. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7896. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7897. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7898. <port protocol="tcp" portid="1658"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="sixnetudr" method="table" conf="3"/></port>
  7899. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7900. </ports>
  7901. <times srtt="244441" rttvar="2893" to="256013"/>
  7902. </host>
  7903. <host starttime="1606158577" endtime="1606183113"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7904. <address addr="47.92.242.153" addrtype="ipv4"/>
  7905. <hostnames>
  7906. </hostnames>
  7907. <ports><extraports state="closed" count="989">
  7908. <extrareasons reason="conn-refused" count="989"/>
  7909. </extraports>
  7910. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7911. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7912. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.92.242.153,/pixel.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; BOIE9;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 47.92.242.153,/activity&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; Avant Browser)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  7913. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7914. <port protocol="tcp" portid="801"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="device" method="table" conf="3"/></port>
  7915. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  7916. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  7917. <port protocol="tcp" portid="6101"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="backupexec" method="table" conf="3"/></port>
  7918. <port protocol="tcp" portid="7000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  7919. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7920. <port protocol="tcp" portid="9081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cisco-aqos" method="table" conf="3"/></port>
  7921. </ports>
  7922. <times srtt="379303" rttvar="5574" to="401599"/>
  7923. </host>
  7924. <host starttime="1606158577" endtime="1606183122"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7925. <address addr="49.232.230.69" addrtype="ipv4"/>
  7926. <hostnames>
  7927. </hostnames>
  7928. <ports><extraports state="closed" count="990">
  7929. <extrareasons reason="conn-refused" count="990"/>
  7930. </extraports>
  7931. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7932. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7933. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7934. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7935. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  7936. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  7937. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  7938. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7939. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7940. <port protocol="tcp" portid="25735"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7941. </ports>
  7942. <times srtt="375535" rttvar="8602" to="409943"/>
  7943. </host>
  7944. <host starttime="1606158577" endtime="1606183122"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7945. <address addr="47.91.237.42" addrtype="ipv4"/>
  7946. <hostnames>
  7947. </hostnames>
  7948. <ports><extraports state="filtered" count="984">
  7949. <extrareasons reason="no-responses" count="984"/>
  7950. </extraports>
  7951. <port protocol="tcp" portid="20"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="ftp-data" method="table" conf="3"/></port>
  7952. <port protocol="tcp" portid="21"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ftp" method="table" conf="3"/></port>
  7953. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7954. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7955. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7956. <port protocol="tcp" portid="888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="accessbuilder" method="table" conf="3"/></port>
  7957. <port protocol="tcp" portid="1099"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="rmiregistry" method="table" conf="3"/></port>
  7958. <port protocol="tcp" portid="4444"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="krb524" method="table" conf="3"/></port>
  7959. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7960. <port protocol="tcp" portid="8001"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="vcom-tunnel" method="table" conf="3"/></port>
  7961. <port protocol="tcp" portid="8002"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="teradataordbms" method="table" conf="3"/></port>
  7962. <port protocol="tcp" portid="8080"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/></port>
  7963. <port protocol="tcp" portid="8099"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7964. <port protocol="tcp" portid="8180"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  7965. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7966. <port protocol="tcp" portid="8888"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="sun-answerbook" method="table" conf="3"/></port>
  7967. </ports>
  7968. <times srtt="366739" rttvar="3908" to="382371"/>
  7969. </host>
  7970. <host starttime="1606158577" endtime="1606183132"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7971. <address addr="47.75.55.181" addrtype="ipv4"/>
  7972. <hostnames>
  7973. </hostnames>
  7974. <ports><extraports state="closed" count="995">
  7975. <extrareasons reason="conn-refused" count="995"/>
  7976. </extraports>
  7977. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7978. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7979. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7980. <port protocol="tcp" portid="3001"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="nessus" method="table" conf="3"/></port>
  7981. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7982. </ports>
  7983. <times srtt="366164" rttvar="3561" to="380408"/>
  7984. </host>
  7985. <host starttime="1606158577" endtime="1606183122"><status state="up" reason="syn-ack" reason_ttl="0"/>
  7986. <address addr="34.80.203.249" addrtype="ipv4"/>
  7987. <hostnames>
  7988. <hostname name="249.203.80.34.bc.googleusercontent.com" type="PTR"/>
  7989. </hostnames>
  7990. <ports><extraports state="closed" count="996">
  7991. <extrareasons reason="conn-refused" count="996"/>
  7992. </extraports>
  7993. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  7994. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  7995. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7996. <port protocol="tcp" portid="8443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  7997. </ports>
  7998. <times srtt="344250" rttvar="4552" to="362458"/>
  7999. </host>
  8000. <host starttime="1606158577" endtime="1606183109"><status state="up" reason="syn-ack" reason_ttl="0"/>
  8001. <address addr="182.163.74.90" addrtype="ipv4"/>
  8002. <hostnames>
  8003. <hostname name="hypnolab.site" type="PTR"/>
  8004. </hostnames>
  8005. <ports><extraports state="closed" count="972">
  8006. <extrareasons reason="conn-refused" count="972"/>
  8007. </extraports>
  8008. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  8009. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8010. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8011. <port protocol="tcp" portid="711"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cisco-tdp" method="table" conf="3"/></port>
  8012. <port protocol="tcp" portid="1000"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="cadlock" method="table" conf="3"/></port>
  8013. <port protocol="tcp" portid="1050"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="java-or-OTGfileshare" method="table" conf="3"/></port>
  8014. <port protocol="tcp" portid="1117"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ardus-mtrns" method="table" conf="3"/></port>
  8015. <port protocol="tcp" portid="1521"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="oracle" method="table" conf="3"/></port>
  8016. <port protocol="tcp" portid="1840"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="netopia-vo2" method="table" conf="3"/></port>
  8017. <port protocol="tcp" portid="2005"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="deslogin" method="table" conf="3"/></port>
  8018. <port protocol="tcp" portid="2260"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="apc-2260" method="table" conf="3"/></port>
  8019. <port protocol="tcp" portid="2399"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="fmpro-fdal" method="table" conf="3"/></port>
  8020. <port protocol="tcp" portid="3128"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="squid-http" method="table" conf="3"/></port>
  8021. <port protocol="tcp" portid="3306"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="mysql" method="table" conf="3"/></port>
  8022. <port protocol="tcp" portid="3404"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  8023. <port protocol="tcp" portid="3920"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="exasoftport1" method="table" conf="3"/></port>
  8024. <port protocol="tcp" portid="4848"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="appserv-http" method="table" conf="3"/></port>
  8025. <port protocol="tcp" portid="5033"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="jtnetd-server" method="table" conf="3"/></port>
  8026. <port protocol="tcp" portid="5915"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  8027. <port protocol="tcp" portid="6100"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="synchronet-db" method="table" conf="3"/></port>
  8028. <port protocol="tcp" portid="7676"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="imqbrokerd" method="table" conf="3"/></port>
  8029. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8030. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  8031. <port protocol="tcp" portid="8181"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="intermapper" method="table" conf="3"/></port>
  8032. <port protocol="tcp" portid="9090"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="zeus-admin" method="table" conf="3"/></port>
  8033. <port protocol="tcp" portid="10000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="snet-sensor-mgmt" method="table" conf="3"/></port>
  8034. <port protocol="tcp" portid="35500"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  8035. <port protocol="tcp" portid="49175"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  8036. </ports>
  8037. <times srtt="308841" rttvar="4199" to="325637"/>
  8038. </host>
  8039. <host starttime="1606158577" endtime="1606183137"><status state="up" reason="syn-ack" reason_ttl="0"/>
  8040. <address addr="193.218.39.208" addrtype="ipv4"/>
  8041. <hostnames>
  8042. </hostnames>
  8043. <ports><extraports state="filtered" count="993">
  8044. <extrareasons reason="no-responses" count="993"/>
  8045. </extraports>
  8046. <port protocol="tcp" portid="53"><state state="closed" reason="conn-refused" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  8047. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8048. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 193.218.39.208,/ptj&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MDDRJS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 443&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 193.218.39.208,/__utm.gif&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; FunWebProducts; IE0006_ver1;EN_GB)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  8049. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  8050. <port protocol="tcp" portid="49152"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  8051. <port protocol="tcp" portid="49153"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  8052. <port protocol="tcp" portid="49155"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="unknown" method="table" conf="3"/></port>
  8053. </ports>
  8054. <times srtt="362516" rttvar="3700" to="377316"/>
  8055. </host>
  8056. <host starttime="1606158576" endtime="1606184208"><status state="up" reason="conn-refused" reason_ttl="0"/>
  8057. <address addr="124.70.1.140" addrtype="ipv4"/>
  8058. <hostnames>
  8059. <hostname name="ecs-124-70-1-140.compute.hwclouds-dns.com" type="PTR"/>
  8060. </hostnames>
  8061. <ports><extraports state="closed" count="992">
  8062. <extrareasons reason="conn-refused" count="992"/>
  8063. </extraports>
  8064. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  8065. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  8066. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  8067. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  8068. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  8069. <port protocol="tcp" portid="7000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  8070. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  8071. <port protocol="tcp" portid="8082"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-alerts" method="table" conf="3"/></port>
  8072. </ports>
  8073. <times srtt="356602" rttvar="2991" to="368566"/>
  8074. </host>
  8075. <host starttime="1606158577" endtime="1606184209"><status state="up" reason="conn-refused" reason_ttl="0"/>
  8076. <address addr="39.96.9.238" addrtype="ipv4"/>
  8077. <hostnames>
  8078. </hostnames>
  8079. <ports><extraports state="closed" count="992">
  8080. <extrareasons reason="conn-refused" count="992"/>
  8081. </extraports>
  8082. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  8083. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  8084. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  8085. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  8086. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  8087. <port protocol="tcp" portid="7000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="afs3-fileserver" method="table" conf="3"/></port>
  8088. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8089. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  8090. </ports>
  8091. <times srtt="459163" rttvar="63422" to="712851"/>
  8092. </host>
  8093. <host starttime="1606158577" endtime="1606184218"><status state="up" reason="syn-ack" reason_ttl="0"/>
  8094. <address addr="49.12.104.241" addrtype="ipv4"/>
  8095. <hostnames>
  8096. <hostname name="static.241.104.12.49.clients.your-server.de" type="PTR"/>
  8097. </hostnames>
  8098. <ports><extraports state="closed" count="991">
  8099. <extrareasons reason="conn-refused" count="991"/>
  8100. </extraports>
  8101. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  8102. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  8103. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x86 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 49.12.104.241,/ga.js&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;&#xa;x64 URI Response: &#xa;BeaconType: 0 (HTTP)&#xa;Port: 80&#xa;Polling: 60000&#xa;Jitter: 0&#xa;Maxdns: 255&#xa;C2 Server: 49.12.104.241,/push&#xa;User Agent: Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 5.1; Trident/5.0)&#xa;HTTP Method Path 2: /submit.php&#xa;Header1: &#xa;Header2: &#xa;PipeName: &#xa;DNS Idle: \x00\x00\x00\x00&#xa;DNS Sleep: 0&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  8104. <port protocol="tcp" portid="81"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="hosts2-ns" method="table" conf="3"/></port>
  8105. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8106. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8107. <port protocol="tcp" portid="8081"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-icecap" method="table" conf="3"/></port>
  8108. <port protocol="tcp" portid="8082"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="blackice-alerts" method="table" conf="3"/></port>
  8109. <port protocol="tcp" portid="8083"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="us-srv" method="table" conf="3"/></port>
  8110. </ports>
  8111. <times srtt="228654" rttvar="2794" to="239830"/>
  8112. </host>
  8113. <host starttime="1606158577" endtime="1606184212"><status state="up" reason="syn-ack" reason_ttl="0"/>
  8114. <address addr="13.59.54.32" addrtype="ipv4"/>
  8115. <hostnames>
  8116. <hostname name="ec2-13-59-54-32.us-east-2.compute.amazonaws.com" type="PTR"/>
  8117. </hostnames>
  8118. <ports><extraports state="filtered" count="995">
  8119. <extrareasons reason="no-responses" count="995"/>
  8120. </extraports>
  8121. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8122. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 7900&#xa;Jitter: 10&#xa;C2 Server: supplyfactory.net,/s/ref=nb_sb_noss_1/889-10926038-0942569/field-keywords=fact&#xa;HTTP Method Path 2: /N5954/adj/amzn.us.sr.aps&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  8123. <port protocol="tcp" portid="7777"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="cbt" method="table" conf="3"/></port>
  8124. <port protocol="tcp" portid="8080"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-proxy" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8125. <port protocol="tcp" portid="9200"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="wap-wsp" method="table" conf="3"/></port>
  8126. </ports>
  8127. <times srtt="153566" rttvar="2018" to="161638"/>
  8128. </host>
  8129. <host starttime="1606158577" endtime="1606184214"><status state="up" reason="syn-ack" reason_ttl="0"/>
  8130. <address addr="3.129.218.157" addrtype="ipv4"/>
  8131. <hostnames>
  8132. <hostname name="ec2-3-129-218-157.us-east-2.compute.amazonaws.com" type="PTR"/>
  8133. </hostnames>
  8134. <ports><extraports state="filtered" count="997">
  8135. <extrareasons reason="no-responses" count="997"/>
  8136. </extraports>
  8137. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8138. <port protocol="tcp" portid="443"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="https" method="table" conf="3"/><script id="grab_beacon_config" output="&#xa;x64 URI Response: &#xa;BeaconType: 8 (HTTPS)&#xa;Port: 443&#xa;Polling: 4400&#xa;Jitter: 17&#xa;C2 Server: detectverify.com,/s/ref=nb_sb_noss_1/724-63904088-6912275/field-keywords=group&#xa;HTTP Method Path 2: /N9304/adj/amzn.us.sr.aps&#xa;Method1: GET&#xa;Method2: POST&#xa;Spawnto_x86: %windir%\syswow64\rundll32.exe&#xa;Spawnto_x64: %windir%\sysnative\rundll32.exe&#xa;Proxy_AccessType: 2 (Use IE settings)&#xa;&#xa;"/></port>
  8139. <port protocol="tcp" portid="9200"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="wap-wsp" method="table" conf="3"/></port>
  8140. </ports>
  8141. <times srtt="153165" rttvar="1305" to="158385"/>
  8142. </host>
  8143. <host starttime="1606158577" endtime="1606184210"><status state="up" reason="syn-ack" reason_ttl="0"/>
  8144. <address addr="47.113.103.131" addrtype="ipv4"/>
  8145. <hostnames>
  8146. </hostnames>
  8147. <ports><extraports state="filtered" count="939">
  8148. <extrareasons reason="no-responses" count="939"/>
  8149. </extraports>
  8150. <extraports state="closed" count="55">
  8151. <extrareasons reason="conn-refused" count="55"/>
  8152. </extraports>
  8153. <port protocol="tcp" portid="80"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8154. <port protocol="tcp" portid="8000"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="http-alt" method="table" conf="3"/><script id="grab_beacon_config"/></port>
  8155. <port protocol="tcp" portid="8001"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="vcom-tunnel" method="table" conf="3"/></port>
  8156. <port protocol="tcp" portid="8100"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="xprint-server" method="table" conf="3"/></port>
  8157. <port protocol="tcp" portid="8200"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="trivnet1" method="table" conf="3"/></port>
  8158. <port protocol="tcp" portid="9090"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="zeus-admin" method="table" conf="3"/></port>
  8159. </ports>
  8160. <times srtt="411519" rttvar="30496" to="533503"/>
  8161. </host>
  8162. <host starttime="1606158576" endtime="1606184208"><status state="up" reason="conn-refused" reason_ttl="0"/>
  8163. <address addr="211.159.180.120" addrtype="ipv4"/>
  8164. <hostnames>
  8165. </hostnames>
  8166. <ports><extraports state="closed" count="994">
  8167. <extrareasons reason="conn-refused" count="994"/>
  8168. </extraports>
  8169. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  8170. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  8171. <port protocol="tcp" portid="445"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="microsoft-ds" method="table" conf="3"/></port>
  8172. <port protocol="tcp" portid="5800"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc-http" method="table" conf="3"/></port>
  8173. <port protocol="tcp" portid="5900"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="vnc" method="table" conf="3"/></port>
  8174. <port protocol="tcp" portid="8181"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="intermapper" method="table" conf="3"/></port>
  8175. </ports>
  8176. <times srtt="355328" rttvar="3710" to="370168"/>
  8177. </host>
  8178. <host starttime="1606158577" endtime="1606184208"><status state="up" reason="conn-refused" reason_ttl="0"/>
  8179. <address addr="150.109.4.202" addrtype="ipv4"/>
  8180. <hostnames>
  8181. </hostnames>
  8182. <ports><extraports state="closed" count="994">
  8183. <extrareasons reason="conn-refused" count="994"/>
  8184. </extraports>
  8185. <port protocol="tcp" portid="22"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="ssh" method="table" conf="3"/></port>
  8186. <port protocol="tcp" portid="53"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="domain" method="table" conf="3"/></port>
  8187. <port protocol="tcp" portid="646"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="ldp" method="table" conf="3"/></port>
  8188. <port protocol="tcp" portid="3828"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="neteh" method="table" conf="3"/></port>
  8189. <port protocol="tcp" portid="8181"><state state="open" reason="syn-ack" reason_ttl="0"/><service name="intermapper" method="table" conf="3"/></port>
  8190. <port protocol="tcp" portid="16080"><state state="filtered" reason="no-response" reason_ttl="0"/><service name="osxwebadmin" method="table" conf="3"/></port>
  8191. </ports>
  8192. <times srtt="375022" rttvar="9545" to="413202"/>
  8193. </host>
  8194. <runstats><finished time="1606184218" timestr="Mon Nov 23 21:16:58 2020" elapsed="25643.10" summary="Nmap done at Mon Nov 23 21:16:58 2020; 477 IP addresses (456 hosts up) scanned in 25643.10 seconds" exit="success"/><hosts up="456" down="21" total="477"/>
  8195. </runstats>
  8196. </nmaprun>
  8197.  
  8198.  
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!