| btpmh.com/images/index/svchost.exe | 160.202.99.48 | | 146 B |
URL User Request GET btpmh.com/images/index/svchost.exe IP160.202.99.48:0
File typeHTML document text\012- HTML document text\012- HTML document, ASCII text, with CRLF line terminators Hash8eec510e57f5f732fd2cce73df7b73ef 3c0af39ecb3753c5fee3b53d063c7286019eac3b 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0
NIDS | Severity | Alert | suricata | medium | ET HUNTING Suspicious svchost.exe in URI - Possible Process Dump/Trojan Download |
GET /images/index/svchost.exe HTTP/1.1
Host: btpmh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 404 Not Found
Server: nginx
Date: Sun, 04 Jun 2023 02:19:09 GMT
Content-Type: text/html
Content-Length: 146
Connection: keep-alive
|
IP160.202.99.48:80
Requested byhttp://btpmh.com/images/index/svchost.exe
File typeMS Windows icon resource - 1 icon, 64x64, 32 bits/pixel\012- data Hash3442ae63a92197380e0c5a2eb2fd00a4 8054c8178cffa0865708f731d25c4f81ec067cf5 ada1cb1589b20e7a9c9f26cfc646b67804c4f38c0182953289dd8e728f7919e9
GET /favicon.ico HTTP/1.1
Host: btpmh.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/111.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Referer: http://btpmh.com/images/index/svchost.exe
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 04 Jun 2023 02:19:10 GMT
Content-Type: image/x-icon
Content-Length: 16958
Last-Modified: Wed, 24 May 2023 00:29:11 GMT
Connection: keep-alive
ETag: "646d5a57-423e"
Accept-Ranges: bytes
|