Edit tour

Windows Analysis Report
scan_0219025_pdf.exe

Overview

General Information

Sample name:	scan_0219025_pdf.exe
Analysis ID:	1618748
MD5:	9de6d171c82d55eb9f49aacdaa307e21
SHA1:	b36ac1151a8b22c4f7df4e0beb9c17efaf2b4937
SHA256:	2e3186f47d0728d966d80bd60d76e604104ac11a170e835c0896775762e33996
Tags:	exeuser-threatcat_ch
Infos:

Detection

Lokibot

Score:	100
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Lokibot

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Joe Sandbox ML detected suspicious sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

scan_0219025_pdf.exe (PID: 6460 cmdline: "C:\Users\user\Desktop\scan_0219025_pdf.exe" MD5: 9DE6D171C82D55EB9F49AACDAA307E21)

svchost.exe (PID: 3192 cmdline: "C:\Users\user\Desktop\scan_0219025_pdf.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loki Password Stealer (PWS), LokiBot	"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMeLoki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.Loki-Bot accepts a single argument/switch of -u that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: B7E1C2CC98066B250DDB2123.Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: %APPDATA%\ C98066\.There can be four files within the hidden %APPDATA% directory at any given time: .exe, .lck, .hdb and .kdb. They will be named after characters 13 thru 18 of the Mutex. For example: 6B250D. Below is the explanation of their purpose:FILE EXTENSIONFILE DESCRIPTION.exeA copy of the malware that will execute every time the user account is logged into.lckA lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts.hdbA database of hashes for data that has already been exfiltrated to the C2 server.kdbA database of keylogger data that has yet to be sent to the C2 serverIf the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.The first packet transmitted by Loki-Bot contains application data.The second packet transmitted by Loki-Bot contains decrypted Windows credentials.The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.The first WORD of the HTTP Payload represents the Loki-Bot version.The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:BYTEPAYLOAD TYPE0x26Stolen Cryptocurrency Wallet0x27Stolen Application Data0x28Get C2 Commands from C2 Server0x29Stolen File0x2APOS (Point of Sale?)0x2BKeylogger Data0x2CScreenshotThe 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically ckav.ru. If you come across a Binary ID that is different from this, take note!Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bots C2 infrastructure.Loki-Bot can accept the following instructions from the C2 Server:BYTEINSTRUCTION DESCRIPTION0x00Download EXE & Execute0x01Download DLL & Load #10x02Download DLL & Load #20x08Delete HDB File0x09Start Keylogger0x0AMine & Steal Data0x0EExit Loki-Bot0x0FUpgrade Loki-Bot0x10Change C2 Polling Frequency0x11Delete Executables & ExitSuricata SignaturesRULE SIDRULE NAME2024311ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected2024312ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M12024313ET TROJAN Loki Bot Request for C2 Commands Detected M12024314ET TROJAN Loki Bot File Exfiltration Detected2024315ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M12024316ET TROJAN Loki Bot Screenshot Exfiltration Detected2024317ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M22024318ET TROJAN Loki Bot Request for C2 Commands Detected M22024319ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2	SWEED The Gorgon Group Cobalt	http://blog.reversing.xyz/reversing/2021/06/08/lokibot.html http://reversing.fun/posts/2021/06/08/lokibot.html http://reversing.fun/reversing/2021/06/08/lokibot.html http://www.malware-traffic-analysis.net/2017/06/12/index.html https://0xmrmagnezi.github.io/malware%20analysis/LokiBot/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lokipws

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.3301923635.0000000003212000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
Process Memory Space: scan_0219025_pdf.exe PID: 6460	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: scan_0219025_pdf.exe PID: 6460	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: scan_0219025_pdf.exe PID: 6460	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x12ea79:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Process Memory Space: svchost.exe PID: 3192	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: svchost.exe PID: 3192	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: svchost.exe PID: 3192	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
Process Memory Space: svchost.exe PID: 3192	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x20c3d:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
2.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
2.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.svchost.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x187f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
2.2.svchost.exe.400000.0.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x53bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
2.2.svchost.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
2.2.svchost.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
2.2.svchost.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x17936:$f1: FileZilla\recentservers.xml 0x17976:$f2: FileZilla\sitemanager.xml 0x15be6:$b2: Mozilla\Firefox\Profiles 0x15950:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x15afa:$s4: logins.json 0x169a4:$s6: wand.dat 0x15424:$a1: username_value 0x15414:$a2: password_value 0x15a5f:$a3: encryptedUsername 0x15acc:$a3: encryptedUsername 0x15a72:$a4: encryptedPassword 0x15ae0:$a4: encryptedPassword
0.2.scan_0219025_pdf.exe.bf0000.1.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.scan_0219025_pdf.exe.bf0000.1.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x15ff0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.scan_0219025_pdf.exe.bf0000.1.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x3bbb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.scan_0219025_pdf.exe.bf0000.1.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.scan_0219025_pdf.exe.bf0000.1.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
2.2.svchost.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
2.2.svchost.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
2.2.svchost.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.svchost.exe.400000.0.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
2.2.svchost.exe.400000.0.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
2.2.svchost.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
2.2.svchost.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
2.2.svchost.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack	Windows_Trojan_Lokibot_1f885282	unknown	unknown	0x173f0:$a1: MAC=%02X%02X%02XINSTALL=%08X%08Xk
0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack	Windows_Trojan_Lokibot_0f421617	unknown	unknown	0x47bb:$a: 08 8B CE 0F B6 14 38 D3 E2 83 C1 08 03 F2 48 79 F2 5F 8B C6
0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x16536:$f1: FileZilla\recentservers.xml 0x16576:$f2: FileZilla\sitemanager.xml 0x147e6:$b2: Mozilla\Firefox\Profiles 0x14550:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x146fa:$s4: logins.json 0x155a4:$s6: wand.dat 0x14024:$a1: username_value 0x14014:$a2: password_value 0x1465f:$a3: encryptedUsername 0x146cc:$a3: encryptedUsername 0x14672:$a4: encryptedPassword 0x146e0:$a4: encryptedPassword
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\scan_0219025_pdf.exe", CommandLine: "C:\Users\user\Desktop\scan_0219025_pdf.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\scan_0219025_pdf.exe", ParentImage: C:\Users\user\Desktop\scan_0219025_pdf.exe, ParentProcessId: 6460, ParentProcessName: scan_0219025_pdf.exe, ProcessCommandLine: "C:\Users\user\Desktop\scan_0219025_pdf.exe", ProcessId: 3192, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\scan_0219025_pdf.exe", CommandLine: "C:\Users\user\Desktop\scan_0219025_pdf.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\scan_0219025_pdf.exe", ParentImage: C:\Users\user\Desktop\scan_0219025_pdf.exe, ParentProcessId: 6460, ParentProcessName: scan_0219025_pdf.exe, ProcessCommandLine: "C:\Users\user\Desktop\scan_0219025_pdf.exe", ProcessId: 3192, ProcessName: svchost.exe

Suricata Signatures

ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T05:53:12.192099+0100	2024312	1	A Network Trojan was detected	192.168.2.5	49704	104.21.112.1	80	TCP
2025-02-19T05:53:14.097636+0100	2024312	1	A Network Trojan was detected	192.168.2.5	49705	104.21.112.1	80	TCP

ET MALWARE LokiBot Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T05:53:11.446397+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49704	104.21.112.1	80	TCP
2025-02-19T05:53:13.322541+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49705	104.21.112.1	80	TCP
2025-02-19T05:53:14.176124+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49706	104.21.112.1	80	TCP
2025-02-19T05:53:16.123350+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49707	104.21.112.1	80	TCP
2025-02-19T05:53:18.071941+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49708	104.21.112.1	80	TCP
2025-02-19T05:53:20.025113+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49709	104.21.112.1	80	TCP
2025-02-19T05:53:21.941810+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49710	104.21.112.1	80	TCP
2025-02-19T05:53:23.921132+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49711	104.21.112.1	80	TCP
2025-02-19T05:53:25.909907+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49717	104.21.112.1	80	TCP
2025-02-19T05:53:27.925028+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49725	104.21.112.1	80	TCP
2025-02-19T05:53:29.732239+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49741	104.21.112.1	80	TCP
2025-02-19T05:53:31.628627+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49752	104.21.112.1	80	TCP
2025-02-19T05:53:33.602003+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49768	104.21.112.1	80	TCP
2025-02-19T05:53:35.535974+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49779	104.21.112.1	80	TCP
2025-02-19T05:53:37.435195+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49789	104.21.112.1	80	TCP
2025-02-19T05:53:39.350788+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49802	104.21.112.1	80	TCP
2025-02-19T05:53:41.248842+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49813	104.21.112.1	80	TCP
2025-02-19T05:53:43.185502+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49828	104.21.112.1	80	TCP
2025-02-19T05:53:45.093110+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49837	104.21.112.1	80	TCP
2025-02-19T05:53:47.007557+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49851	104.21.112.1	80	TCP
2025-02-19T05:53:48.915913+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49862	104.21.112.1	80	TCP
2025-02-19T05:53:50.837137+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49878	104.21.112.1	80	TCP
2025-02-19T05:53:52.807724+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49889	104.21.112.1	80	TCP
2025-02-19T05:53:54.708993+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49904	104.21.112.1	80	TCP
2025-02-19T05:53:56.684029+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49916	104.21.112.1	80	TCP
2025-02-19T05:53:58.557276+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49931	104.21.112.1	80	TCP
2025-02-19T05:54:00.554404+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49943	104.21.112.1	80	TCP
2025-02-19T05:54:02.704735+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49955	104.21.112.1	80	TCP
2025-02-19T05:54:04.606006+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49967	104.21.112.1	80	TCP
2025-02-19T05:54:06.568738+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49978	104.21.112.1	80	TCP
2025-02-19T05:54:08.459584+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	49991	104.21.112.1	80	TCP
2025-02-19T05:54:10.271771+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50002	104.21.112.1	80	TCP
2025-02-19T05:54:12.163081+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50008	104.21.112.1	80	TCP
2025-02-19T05:54:14.069543+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50009	104.21.112.1	80	TCP
2025-02-19T05:54:16.008277+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50010	104.21.112.1	80	TCP
2025-02-19T05:54:17.949694+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50011	104.21.112.1	80	TCP
2025-02-19T05:54:20.028067+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50012	104.21.112.1	80	TCP
2025-02-19T05:54:22.553811+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50013	104.21.112.1	80	TCP
2025-02-19T05:54:24.357556+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50014	104.21.112.1	80	TCP
2025-02-19T05:54:26.257109+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50015	104.21.112.1	80	TCP
2025-02-19T05:54:28.195006+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50016	104.21.112.1	80	TCP
2025-02-19T05:54:30.146298+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50017	104.21.112.1	80	TCP
2025-02-19T05:54:32.155810+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50018	104.21.112.1	80	TCP
2025-02-19T05:54:34.061105+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50019	104.21.112.1	80	TCP
2025-02-19T05:54:35.954072+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50020	104.21.112.1	80	TCP
2025-02-19T05:54:37.937162+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50021	104.21.112.1	80	TCP
2025-02-19T05:54:40.036556+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50022	104.21.112.1	80	TCP
2025-02-19T05:54:41.874928+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50023	104.21.112.1	80	TCP
2025-02-19T05:54:43.765152+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50024	104.21.112.1	80	TCP
2025-02-19T05:54:45.718163+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50025	104.21.112.1	80	TCP
2025-02-19T05:54:47.671560+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50026	104.21.112.1	80	TCP
2025-02-19T05:54:49.591779+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50027	104.21.112.1	80	TCP
2025-02-19T05:54:51.591721+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50028	104.21.112.1	80	TCP
2025-02-19T05:54:53.553307+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50029	104.21.112.1	80	TCP
2025-02-19T05:54:55.345675+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50030	104.21.112.1	80	TCP
2025-02-19T05:54:57.288982+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50031	104.21.112.1	80	TCP
2025-02-19T05:54:59.142922+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50032	104.21.112.1	80	TCP
2025-02-19T05:55:01.065413+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50033	104.21.112.1	80	TCP
2025-02-19T05:55:02.948199+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50034	104.21.112.1	80	TCP
2025-02-19T05:55:04.913805+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50035	104.21.112.1	80	TCP
2025-02-19T05:55:06.992572+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50036	104.21.112.1	80	TCP
2025-02-19T05:55:08.944394+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50037	104.21.112.1	80	TCP
2025-02-19T05:55:10.953059+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50038	104.21.112.1	80	TCP
2025-02-19T05:55:12.825910+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50039	104.21.112.1	80	TCP
2025-02-19T05:55:14.753754+0100	2025381	1	Malware Command and Control Activity Detected	192.168.2.5	50040	104.21.112.1	80	TCP

ET MALWARE LokiBot Fake 404 Response

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T05:53:14.970405+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49706	TCP
2025-02-19T05:53:16.909113+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49707	TCP
2025-02-19T05:53:18.858774+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49708	TCP
2025-02-19T05:53:20.806474+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49709	TCP
2025-02-19T05:53:22.755680+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49710	TCP
2025-02-19T05:53:24.697542+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49711	TCP
2025-02-19T05:53:26.716892+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49717	TCP
2025-02-19T05:53:28.565328+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49725	TCP
2025-02-19T05:53:32.443719+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49752	TCP
2025-02-19T05:53:38.198107+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49789	TCP
2025-02-19T05:53:42.023875+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49813	TCP
2025-02-19T05:53:43.939724+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49828	TCP
2025-02-19T05:53:51.644783+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49878	TCP
2025-02-19T05:53:53.421361+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49889	TCP
2025-02-19T05:53:55.473720+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49904	TCP
2025-02-19T05:53:59.330976+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49931	TCP
2025-02-19T05:54:01.319521+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49943	TCP
2025-02-19T05:54:05.421489+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49967	TCP
2025-02-19T05:54:09.131499+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	49991	TCP
2025-02-19T05:54:12.923373+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50008	TCP
2025-02-19T05:54:16.776371+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50010	TCP
2025-02-19T05:54:18.757404+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50011	TCP
2025-02-19T05:54:21.415040+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50012	TCP
2025-02-19T05:54:23.199595+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50013	TCP
2025-02-19T05:54:27.035836+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50015	TCP
2025-02-19T05:54:28.964543+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50016	TCP
2025-02-19T05:54:30.924041+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50017	TCP
2025-02-19T05:54:36.758280+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50020	TCP
2025-02-19T05:54:38.728015+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50021	TCP
2025-02-19T05:54:40.718568+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50022	TCP
2025-02-19T05:54:44.546530+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50024	TCP
2025-02-19T05:54:46.509403+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50025	TCP
2025-02-19T05:54:48.442348+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50026	TCP
2025-02-19T05:54:50.416319+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50027	TCP
2025-02-19T05:54:52.367059+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50028	TCP
2025-02-19T05:54:54.190064+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50029	TCP
2025-02-19T05:54:57.942997+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50031	TCP
2025-02-19T05:55:03.764766+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50034	TCP
2025-02-19T05:55:05.850807+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50035	TCP
2025-02-19T05:55:07.766520+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50036	TCP
2025-02-19T05:55:09.733047+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50037	TCP
2025-02-19T05:55:13.587268+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50039	TCP
2025-02-19T05:55:15.396459+0100	2025483	1	A Network Trojan was detected	104.21.112.1	80	192.168.2.5	50040	TCP

ET MALWARE LokiBot Request for C2 Commands Detected M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T05:53:14.962823+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49706	104.21.112.1	80	TCP
2025-02-19T05:53:16.901206+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49707	104.21.112.1	80	TCP
2025-02-19T05:53:18.853669+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49708	104.21.112.1	80	TCP
2025-02-19T05:53:20.801015+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49709	104.21.112.1	80	TCP
2025-02-19T05:53:22.750205+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49710	104.21.112.1	80	TCP
2025-02-19T05:53:24.690505+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49711	104.21.112.1	80	TCP
2025-02-19T05:53:26.711743+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49717	104.21.112.1	80	TCP
2025-02-19T05:53:28.560170+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49725	104.21.112.1	80	TCP
2025-02-19T05:53:30.481453+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49741	104.21.112.1	80	TCP
2025-02-19T05:53:32.438654+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49752	104.21.112.1	80	TCP
2025-02-19T05:53:34.363722+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49768	104.21.112.1	80	TCP
2025-02-19T05:53:36.282804+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49779	104.21.112.1	80	TCP
2025-02-19T05:53:38.192990+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49789	104.21.112.1	80	TCP
2025-02-19T05:53:40.081658+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49802	104.21.112.1	80	TCP
2025-02-19T05:53:42.018453+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49813	104.21.112.1	80	TCP
2025-02-19T05:53:43.934275+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49828	104.21.112.1	80	TCP
2025-02-19T05:53:45.846048+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49837	104.21.112.1	80	TCP
2025-02-19T05:53:47.764924+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49851	104.21.112.1	80	TCP
2025-02-19T05:53:49.658237+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49862	104.21.112.1	80	TCP
2025-02-19T05:53:51.639694+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49878	104.21.112.1	80	TCP
2025-02-19T05:53:53.416280+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49889	104.21.112.1	80	TCP
2025-02-19T05:53:55.468507+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49904	104.21.112.1	80	TCP
2025-02-19T05:53:57.401400+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49916	104.21.112.1	80	TCP
2025-02-19T05:53:59.325889+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49931	104.21.112.1	80	TCP
2025-02-19T05:54:01.314375+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49943	104.21.112.1	80	TCP
2025-02-19T05:54:03.432747+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49955	104.21.112.1	80	TCP
2025-02-19T05:54:05.416442+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49967	104.21.112.1	80	TCP
2025-02-19T05:54:07.301632+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49978	104.21.112.1	80	TCP
2025-02-19T05:54:09.126422+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	49991	104.21.112.1	80	TCP
2025-02-19T05:54:11.001496+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50002	104.21.112.1	80	TCP
2025-02-19T05:54:12.915900+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50008	104.21.112.1	80	TCP
2025-02-19T05:54:14.853309+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50009	104.21.112.1	80	TCP
2025-02-19T05:54:16.771335+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50010	104.21.112.1	80	TCP
2025-02-19T05:54:18.752393+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50011	104.21.112.1	80	TCP
2025-02-19T05:54:21.404784+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50012	104.21.112.1	80	TCP
2025-02-19T05:54:23.193046+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50013	104.21.112.1	80	TCP
2025-02-19T05:54:25.093302+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50014	104.21.112.1	80	TCP
2025-02-19T05:54:27.030753+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50015	104.21.112.1	80	TCP
2025-02-19T05:54:28.959007+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50016	104.21.112.1	80	TCP
2025-02-19T05:54:30.919057+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50017	104.21.112.1	80	TCP
2025-02-19T05:54:32.903421+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50018	104.21.112.1	80	TCP
2025-02-19T05:54:34.785517+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50019	104.21.112.1	80	TCP
2025-02-19T05:54:36.753269+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50020	104.21.112.1	80	TCP
2025-02-19T05:54:38.722895+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50021	104.21.112.1	80	TCP
2025-02-19T05:54:40.713455+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50022	104.21.112.1	80	TCP
2025-02-19T05:54:42.607425+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50023	104.21.112.1	80	TCP
2025-02-19T05:54:44.541375+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50024	104.21.112.1	80	TCP
2025-02-19T05:54:46.504308+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50025	104.21.112.1	80	TCP
2025-02-19T05:54:48.437291+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50026	104.21.112.1	80	TCP
2025-02-19T05:54:50.411241+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50027	104.21.112.1	80	TCP
2025-02-19T05:54:52.361883+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50028	104.21.112.1	80	TCP
2025-02-19T05:54:54.182442+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50029	104.21.112.1	80	TCP
2025-02-19T05:54:56.075874+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50030	104.21.112.1	80	TCP
2025-02-19T05:54:57.927904+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50031	104.21.112.1	80	TCP
2025-02-19T05:54:59.894614+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50032	104.21.112.1	80	TCP
2025-02-19T05:55:01.784447+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50033	104.21.112.1	80	TCP
2025-02-19T05:55:03.759645+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50034	104.21.112.1	80	TCP
2025-02-19T05:55:05.845515+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50035	104.21.112.1	80	TCP
2025-02-19T05:55:07.761071+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50036	104.21.112.1	80	TCP
2025-02-19T05:55:09.727634+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50037	104.21.112.1	80	TCP
2025-02-19T05:55:11.656093+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50038	104.21.112.1	80	TCP
2025-02-19T05:55:13.582054+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50039	104.21.112.1	80	TCP
2025-02-19T05:55:15.391162+0100	2024313	1	Malware Command and Control Activity Detected	192.168.2.5	50040	104.21.112.1	80	TCP

ET MALWARE LokiBot User-Agent (Charon/Inferno)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T05:53:11.446397+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49704	104.21.112.1	80	TCP
2025-02-19T05:53:13.322541+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49705	104.21.112.1	80	TCP
2025-02-19T05:53:14.176124+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49706	104.21.112.1	80	TCP
2025-02-19T05:53:16.123350+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49707	104.21.112.1	80	TCP
2025-02-19T05:53:18.071941+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49708	104.21.112.1	80	TCP
2025-02-19T05:53:20.025113+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49709	104.21.112.1	80	TCP
2025-02-19T05:53:21.941810+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49710	104.21.112.1	80	TCP
2025-02-19T05:53:23.921132+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49711	104.21.112.1	80	TCP
2025-02-19T05:53:25.909907+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49717	104.21.112.1	80	TCP
2025-02-19T05:53:27.925028+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49725	104.21.112.1	80	TCP
2025-02-19T05:53:29.732239+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49741	104.21.112.1	80	TCP
2025-02-19T05:53:31.628627+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49752	104.21.112.1	80	TCP
2025-02-19T05:53:33.602003+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49768	104.21.112.1	80	TCP
2025-02-19T05:53:35.535974+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49779	104.21.112.1	80	TCP
2025-02-19T05:53:37.435195+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49789	104.21.112.1	80	TCP
2025-02-19T05:53:39.350788+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49802	104.21.112.1	80	TCP
2025-02-19T05:53:41.248842+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49813	104.21.112.1	80	TCP
2025-02-19T05:53:43.185502+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49828	104.21.112.1	80	TCP
2025-02-19T05:53:45.093110+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49837	104.21.112.1	80	TCP
2025-02-19T05:53:47.007557+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49851	104.21.112.1	80	TCP
2025-02-19T05:53:48.915913+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49862	104.21.112.1	80	TCP
2025-02-19T05:53:50.837137+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49878	104.21.112.1	80	TCP
2025-02-19T05:53:52.807724+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49889	104.21.112.1	80	TCP
2025-02-19T05:53:54.708993+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49904	104.21.112.1	80	TCP
2025-02-19T05:53:56.684029+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49916	104.21.112.1	80	TCP
2025-02-19T05:53:58.557276+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49931	104.21.112.1	80	TCP
2025-02-19T05:54:00.554404+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49943	104.21.112.1	80	TCP
2025-02-19T05:54:02.704735+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49955	104.21.112.1	80	TCP
2025-02-19T05:54:04.606006+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49967	104.21.112.1	80	TCP
2025-02-19T05:54:06.568738+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49978	104.21.112.1	80	TCP
2025-02-19T05:54:08.459584+0100	2021641	1	A Network Trojan was detected	192.168.2.5	49991	104.21.112.1	80	TCP
2025-02-19T05:54:10.271771+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50002	104.21.112.1	80	TCP
2025-02-19T05:54:12.163081+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50008	104.21.112.1	80	TCP
2025-02-19T05:54:14.069543+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50009	104.21.112.1	80	TCP
2025-02-19T05:54:16.008277+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50010	104.21.112.1	80	TCP
2025-02-19T05:54:17.949694+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50011	104.21.112.1	80	TCP
2025-02-19T05:54:20.028067+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50012	104.21.112.1	80	TCP
2025-02-19T05:54:22.553811+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50013	104.21.112.1	80	TCP
2025-02-19T05:54:24.357556+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50014	104.21.112.1	80	TCP
2025-02-19T05:54:26.257109+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50015	104.21.112.1	80	TCP
2025-02-19T05:54:28.195006+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50016	104.21.112.1	80	TCP
2025-02-19T05:54:30.146298+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50017	104.21.112.1	80	TCP
2025-02-19T05:54:32.155810+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50018	104.21.112.1	80	TCP
2025-02-19T05:54:34.061105+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50019	104.21.112.1	80	TCP
2025-02-19T05:54:35.954072+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50020	104.21.112.1	80	TCP
2025-02-19T05:54:37.937162+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50021	104.21.112.1	80	TCP
2025-02-19T05:54:40.036556+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50022	104.21.112.1	80	TCP
2025-02-19T05:54:41.874928+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50023	104.21.112.1	80	TCP
2025-02-19T05:54:43.765152+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50024	104.21.112.1	80	TCP
2025-02-19T05:54:45.718163+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50025	104.21.112.1	80	TCP
2025-02-19T05:54:47.671560+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50026	104.21.112.1	80	TCP
2025-02-19T05:54:49.591779+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50027	104.21.112.1	80	TCP
2025-02-19T05:54:51.591721+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50028	104.21.112.1	80	TCP
2025-02-19T05:54:53.553307+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50029	104.21.112.1	80	TCP
2025-02-19T05:54:55.345675+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50030	104.21.112.1	80	TCP
2025-02-19T05:54:57.288982+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50031	104.21.112.1	80	TCP
2025-02-19T05:54:59.142922+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50032	104.21.112.1	80	TCP
2025-02-19T05:55:01.065413+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50033	104.21.112.1	80	TCP
2025-02-19T05:55:02.948199+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50034	104.21.112.1	80	TCP
2025-02-19T05:55:04.913805+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50035	104.21.112.1	80	TCP
2025-02-19T05:55:06.992572+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50036	104.21.112.1	80	TCP
2025-02-19T05:55:08.944394+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50037	104.21.112.1	80	TCP
2025-02-19T05:55:10.953059+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50038	104.21.112.1	80	TCP
2025-02-19T05:55:12.825910+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50039	104.21.112.1	80	TCP
2025-02-19T05:55:14.753754+0100	2021641	1	A Network Trojan was detected	192.168.2.5	50040	104.21.112.1	80	TCP

ETPRO MALWARE LokiBot Checkin M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-02-19T05:53:11.446397+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49704	104.21.112.1	80	TCP
2025-02-19T05:53:13.322541+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49705	104.21.112.1	80	TCP
2025-02-19T05:53:14.176124+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49706	104.21.112.1	80	TCP
2025-02-19T05:53:16.123350+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49707	104.21.112.1	80	TCP
2025-02-19T05:53:18.071941+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49708	104.21.112.1	80	TCP
2025-02-19T05:53:20.025113+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49709	104.21.112.1	80	TCP
2025-02-19T05:53:21.941810+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49710	104.21.112.1	80	TCP
2025-02-19T05:53:23.921132+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49711	104.21.112.1	80	TCP
2025-02-19T05:53:25.909907+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49717	104.21.112.1	80	TCP
2025-02-19T05:53:27.925028+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49725	104.21.112.1	80	TCP
2025-02-19T05:53:29.732239+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49741	104.21.112.1	80	TCP
2025-02-19T05:53:31.628627+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49752	104.21.112.1	80	TCP
2025-02-19T05:53:33.602003+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49768	104.21.112.1	80	TCP
2025-02-19T05:53:35.535974+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49779	104.21.112.1	80	TCP
2025-02-19T05:53:37.435195+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49789	104.21.112.1	80	TCP
2025-02-19T05:53:39.350788+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49802	104.21.112.1	80	TCP
2025-02-19T05:53:41.248842+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49813	104.21.112.1	80	TCP
2025-02-19T05:53:43.185502+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49828	104.21.112.1	80	TCP
2025-02-19T05:53:45.093110+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49837	104.21.112.1	80	TCP
2025-02-19T05:53:47.007557+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49851	104.21.112.1	80	TCP
2025-02-19T05:53:48.915913+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49862	104.21.112.1	80	TCP
2025-02-19T05:53:50.837137+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49878	104.21.112.1	80	TCP
2025-02-19T05:53:52.807724+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49889	104.21.112.1	80	TCP
2025-02-19T05:53:54.708993+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49904	104.21.112.1	80	TCP
2025-02-19T05:53:56.684029+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49916	104.21.112.1	80	TCP
2025-02-19T05:53:58.557276+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49931	104.21.112.1	80	TCP
2025-02-19T05:54:00.554404+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49943	104.21.112.1	80	TCP
2025-02-19T05:54:02.704735+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49955	104.21.112.1	80	TCP
2025-02-19T05:54:04.606006+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49967	104.21.112.1	80	TCP
2025-02-19T05:54:06.568738+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49978	104.21.112.1	80	TCP
2025-02-19T05:54:08.459584+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	49991	104.21.112.1	80	TCP
2025-02-19T05:54:10.271771+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50002	104.21.112.1	80	TCP
2025-02-19T05:54:12.163081+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50008	104.21.112.1	80	TCP
2025-02-19T05:54:14.069543+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50009	104.21.112.1	80	TCP
2025-02-19T05:54:16.008277+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50010	104.21.112.1	80	TCP
2025-02-19T05:54:17.949694+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50011	104.21.112.1	80	TCP
2025-02-19T05:54:20.028067+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50012	104.21.112.1	80	TCP
2025-02-19T05:54:22.553811+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50013	104.21.112.1	80	TCP
2025-02-19T05:54:24.357556+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50014	104.21.112.1	80	TCP
2025-02-19T05:54:26.257109+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50015	104.21.112.1	80	TCP
2025-02-19T05:54:28.195006+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50016	104.21.112.1	80	TCP
2025-02-19T05:54:30.146298+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50017	104.21.112.1	80	TCP
2025-02-19T05:54:32.155810+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50018	104.21.112.1	80	TCP
2025-02-19T05:54:34.061105+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50019	104.21.112.1	80	TCP
2025-02-19T05:54:35.954072+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50020	104.21.112.1	80	TCP
2025-02-19T05:54:37.937162+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50021	104.21.112.1	80	TCP
2025-02-19T05:54:40.036556+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50022	104.21.112.1	80	TCP
2025-02-19T05:54:41.874928+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50023	104.21.112.1	80	TCP
2025-02-19T05:54:43.765152+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50024	104.21.112.1	80	TCP
2025-02-19T05:54:45.718163+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50025	104.21.112.1	80	TCP
2025-02-19T05:54:47.671560+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50026	104.21.112.1	80	TCP
2025-02-19T05:54:49.591779+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50027	104.21.112.1	80	TCP
2025-02-19T05:54:51.591721+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50028	104.21.112.1	80	TCP
2025-02-19T05:54:53.553307+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50029	104.21.112.1	80	TCP
2025-02-19T05:54:55.345675+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50030	104.21.112.1	80	TCP
2025-02-19T05:54:57.288982+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50031	104.21.112.1	80	TCP
2025-02-19T05:54:59.142922+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50032	104.21.112.1	80	TCP
2025-02-19T05:55:01.065413+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50033	104.21.112.1	80	TCP
2025-02-19T05:55:02.948199+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50034	104.21.112.1	80	TCP
2025-02-19T05:55:04.913805+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50035	104.21.112.1	80	TCP
2025-02-19T05:55:06.992572+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50036	104.21.112.1	80	TCP
2025-02-19T05:55:08.944394+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50037	104.21.112.1	80	TCP
2025-02-19T05:55:10.953059+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50038	104.21.112.1	80	TCP
2025-02-19T05:55:12.825910+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50039	104.21.112.1	80	TCP
2025-02-19T05:55:14.753754+0100	2825766	1	Malware Command and Control Activity Detected	192.168.2.5	50040	104.21.112.1	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://touxzw.ir/sccc/five/fre.php

Avira URL Cloud: Label: malware

Found malware configuration

Source: 2.2.svchost.exe.400000.0.unpack

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php"]}

Multi AV Scanner detection for submitted file

Source: scan_0219025_pdf.exe

ReversingLabs: Detection: 18%

Joe Sandbox ML detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: scan_0219025_pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: scan_0219025_pdf.exe, 00000000.00000003.2045830713.0000000003600000.00000004.00001000.00020000.00000000.sdmp, scan_0219025_pdf.exe, 00000000.00000003.2048703038.00000000037A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: scan_0219025_pdf.exe, 00000000.00000003.2045830713.0000000003600000.00000004.00001000.00020000.00000000.sdmp, scan_0219025_pdf.exe, 00000000.00000003.2048703038.00000000037A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: svchost.exe, svchost.exe, 00000002.00000002.3301674856.00000000009E1000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: svchost.pdbUGP source: svchost.exe, 00000002.00000002.3301674856.00000000009E1000.00000020.00000001.01000000.00000005.sdmp

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AF445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00AF445A
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFC6D1 FindFirstFileW,FindClose,	0_2_00AFC6D1
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00AFC75C
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00AFEF95
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00AFF0F2
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00AFF3F3
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AF37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00AF37EF
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AF3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00AF3B12
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00AFBCBC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,	2_2_00403D74

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49708 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49779 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49708 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49779 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49708 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49741 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49709 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49709 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49706 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49779 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49709 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49741 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49705 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49706 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49741 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49706 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49711 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49705 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49717 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49711 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49717 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49709 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49779 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49704 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49705 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49704 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49717 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49704 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49708 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49707 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49707 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49707 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49710 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49706 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49741 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49711 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49710 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49710 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49768 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49768 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49768 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49707 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49768 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49813 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49813 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49813 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.5:49705 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49711 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49717 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49710 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49813 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2024312 - Severity 1 - ET MALWARE LokiBot Application/Credential Data Exfiltration Detected M1 : 192.168.2.5:49704 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49709
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49789 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49789 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49789 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49789 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49813
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49706
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49708
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49789
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49878 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49878 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49878 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49851 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49717
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49851 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49889 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49878 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49802 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49711
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49752 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49889 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49752 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49851 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49851 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49828 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49828 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49828 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49904 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49889 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49904 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49752 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49802 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49802 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49904 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49752 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49802 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49828 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49889 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49916 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49710
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49904 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49916 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49916 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49931 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49931 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49916 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49931 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49878
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49943 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49943 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49943 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49862 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49862 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49862 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49752
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49943 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49862 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49931 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49967 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49978 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49978 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49978 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49828
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49967 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49967 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49978 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49967 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49904
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49725 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49725 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49725 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49955 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50002 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50002 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50002 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50015 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50015 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50015 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50008 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50027 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50027 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50027 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50008 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49955 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49725 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50038 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49955 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50010 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50014 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50002 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50014 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50008 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50018 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49837 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50038 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49837 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50020 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49837 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50030 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50010 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50020 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50027 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49889
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50018 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50008 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50038 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50018 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50015 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49837 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49955 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49943
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50018 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50020 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50032 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50014 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49967
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50038 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50010 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50032 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50032 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50020 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50029 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50014 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50032 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50016 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50019 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50019 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50029 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50019 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50029 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50022 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50022 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50022 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50019 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50029 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50030 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50022 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50030 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50016 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50010 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50030 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50027
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:49991 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50016 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50012 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:49991 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50012 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:49991 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50016 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50012 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49725
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50015
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50012 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:49991 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50033 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50033 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50020
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50033 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50021 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50021 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50021 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50026 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50008
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50026 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50034 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50033 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50010
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50028 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50026 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50034 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50029
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50035 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50026 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50028 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50011 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50028 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50023 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50023 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50034 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50035 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50021 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50011 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50028 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50035 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50034 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49931
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50022
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50023 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50011 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50012
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50035 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50016
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50011 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50023 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50025 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50025 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50025 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:49991
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50025 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50026
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50011
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50021
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50009 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50009 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50009 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50036 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50036 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50028
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50034
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50036 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50031 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50031 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50031 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50035
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50036 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50009 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50031 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50037 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50037 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50037 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50025
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50037 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50039 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50039 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50039 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50036
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50039 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50037
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50031
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50040 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50040 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50040 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50040 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50040
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50017 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50017 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50017 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50017 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50039
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50017
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50024 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50024 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50024 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50024 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50024
Source: Network traffic	Suricata IDS: 2021641 - Severity 1 - ET MALWARE LokiBot User-Agent (Charon/Inferno) : 192.168.2.5:50013 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025381 - Severity 1 - ET MALWARE LokiBot Checkin : 192.168.2.5:50013 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2825766 - Severity 1 - ETPRO MALWARE LokiBot Checkin M2 : 192.168.2.5:50013 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2024313 - Severity 1 - ET MALWARE LokiBot Request for C2 Commands Detected M1 : 192.168.2.5:50013 -> 104.21.112.1:80
Source: Network traffic	Suricata IDS: 2025483 - Severity 1 - ET MALWARE LokiBot Fake 404 Response : 104.21.112.1:80 -> 192.168.2.5:50013

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 104.21.112.1 80

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php

Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1
Source: Joe Sandbox View	IP Address: 104.21.112.1 104.21.112.1

Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 180Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 180Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close
Source: global traffic	HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 153Connection: close

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00B022EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00B022EE

Source: global traffic

DNS traffic detected: DNS query: touxzw.ir

Source: unknown

HTTP traffic detected: POST /sccc/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: touxzw.irAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: D509030Content-Length: 180Connection: close

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U7wbxoEyTaICNBgMRu8kXVx6u3OMbA3AgOpYROd1DIsol0pYD%2FmK4PsQOf%2B6W60i1%2FRjNHvhN6QsGuI4yIDZbRrePBYTWIWshvuFlQzEymvxE12QSdC0Q5mY1B0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a6dcff7b4349-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1602&min_rtt=1602&rtt_var=801&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=418&delivery_rate=0&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DgzFxo0GODeHpTmcDrCesQPUVjK5wcnvzUpVZp6xcsS%2BhJVXSEf8rLpDQgtDCh14ZqFT8ramN13mnK%2BCUkq9Ekv64Zvb1HOnq8YNpJDy3Y3HSGS6Euv1%2FAsS4Ks%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a6e8cbfe4205-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1641&min_rtt=1641&rtt_var=820&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=418&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:14 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jE3F5GEb2mTinChbc5PhnfV8TAxK9RSz7zv0X7UIUK0im2I1mL6KwmaG83%2FHLfc3TECRcg8hr6rmHPqZ6uB5D%2BUR%2FuQUMqxSvBCudEWrwyOnNAtRdFt0gpy5dsU%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a6ee194b41ed-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1614&min_rtt=1614&rtt_var=807&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RlsCtwWDooojDPIJ9uUTppZ9lQ1O%2FWPObOiTE1EYMq8hNbAGrqbsgsqngUgEI%2FFDsN9m7FxObL%2B5AlyQQsoV9dWxivuOX0WuUzHpkKPzBduVa6kuRg0c1CBcIic%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a6fa4f1a42be-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1558&min_rtt=1558&rtt_var=779&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WURBDUPTGXLxLqEwW4PtXWTYRAwpNVlcwzU6ro1jYobRhMUs4Uqe2kkNYFg5DTTMQroq7GNC1MxcEruqIdM88ab7G%2F%2FXl5tNRWhl1RGUSL%2BmC%2Fp%2B6QwY%2FwYBhcs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a7068c6b4331-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1609&min_rtt=1609&rtt_var=804&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=239&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r%2BxDci6LAE6beENlZAoV7zg1%2Fd%2FVfvLbgB3w7YXmX6SdCmLSvNmJwC9lfsHqsPPO%2Bc7pgQeJWEJ9b3rmJscfy6E2G%2Bw8X095dby2%2Fbf5u0httnEGMnk4Hgy0QZ0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a712ad5a0f69-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1629&min_rtt=1629&rtt_var=814&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=248&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:22 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UBg77ta0YF22tjOBluGyZ%2F4QPNFj9Aw0m1M0QnS%2B1iu%2BgHuLI28YxXYpHO2uvN%2BsEfhlAzlOOK8Z6WWUikPv3NO9Pb3IgRmDaX0ecrzwLvJ%2BLvcR9cbeXvo2VCM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a71ebb021849-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1692&min_rtt=1692&rtt_var=846&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=179&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:24 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hm7ZG6iw6FAz73S7EiCt5sjDgzqRtgU5dcbHV%2FaMgFWESxy8Ebm0eRHrICnz7Rt2o8lYKCfosKGou%2F%2FIgAjJDT67orSk2ianbxvsfRGReJUv0Ans7nxdgXxRDbw%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a72af9fd41e0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1562&min_rtt=1562&rtt_var=781&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=226&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sB3tQBvieRH%2FfTE53CDyYT6ch0QVvLQWHmMHhhPMdgSwGX6%2BZNdvPsLzI%2F8J36NiwoIQnaP3fVqs4DxTEAV1fYGXyCX%2Bwfj5ChXnAU5KaLC5PJx0DASndU%2BE24Q%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a737ab6641d2-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1546&min_rtt=1546&rtt_var=773&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mcvvFx3LkNFVsjbRqR0xEqfrm5ssJH7AkrDj8djWHGV74jfx8u7asXfv1IUP2o19kPxosnqs7QsplpIUytDuTjiAl8TgAvf9cdMaHHnDG1iRU0eL8OuLRIN9UG0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a744199a421d-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1581&min_rtt=1581&rtt_var=790&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=189&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:32 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L4jKExnQZLMJ8tJP1pVfHoVij9q9L48MK6%2FOxoDRCigZe5BTj%2BeFjll%2BZxe7TH82hJ%2BOmEPEGHA6Is1bJh9jkQtyCfGYt7uODgQahPwB%2BD0%2B6MMYk54PcfTB7Ss%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a75b3c2741f3-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1553&min_rtt=1553&rtt_var=776&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=S3%2B%2FEYQ7AM%2FoGobiilxTZTGlwYbk5Y2jRxB8F5j8k2I9Wlt30Tu6FOe3gLctHJ7DKmhqgm%2FHaYpizTxjurDhGeIl%2ByMjAOfWpaYGaoBvXBdAh%2BLw1ZWDNe9I3RQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a77f6fa58c96-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2262&min_rtt=2262&rtt_var=1131&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=187&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:41 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2dV%2BfJUpE%2Bv0k1U7xicIn2J%2FmpkoSF8gPHoMs8%2Fc3XjPhA6b90rH9CL2D%2FK0KWi12Y1D9i3pUIWmQje5g7kCz%2FTC7KIy7x1sP0xkTFg%2B5X9OoQ%2FqQX0qyZj8m0A%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a7976c4a43b7-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1584&min_rtt=1584&rtt_var=792&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:43 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=julG%2B7VBIHm6Rwskqia68N%2Beh0WY7MesTJT7mguYeWGeTcMekkyodc9EJrEPD15VA0ah97M8wedoBHlev0K5m4WNHuztvTgaUlgrH45f0fziMjNcWx4WNYzKPAs%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a7a36b5d8c30-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2310&min_rtt=2310&rtt_var=1155&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:51 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BWc0f91ICp3jA8pYo8xng%2BBLzb%2B5vvHceGRlIW6Cn3MqW48C2vRxL%2BNefRd4U%2FmKZqhvu9cSFbF1Cb6WdpL%2F8Uhtwlq7UKedlHAgg2W8LvRnI0m%2FmFfB3zU0gKo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a7d34ee741d8-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1539&min_rtt=1539&rtt_var=769&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:53 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Vzsflxq4G1MUWpI5li%2Ffyj%2BVMUaXzRJ9cH7S1qzu5VWXwirOlRDeyozAwk5Bm35yuY5%2BxaOCWCecCxHk3lO87N7Ba49RwkNc3GgLS5BPcU20vSy8ROsTPx5X84g%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a7df8c2f4271-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1572&rtt_var=786&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:55 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MEVP7zS%2BH5F4hiDYXhd2FRKBkFpV9IFw5OJEIQfHOYGCzDowPhWceFL1oFj52XXsDQZTva8hUw4IXr%2FAUteqMHV7pDxDEFbr2zmmpPi2INueBikVx2w2T%2Bo7Lkk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a7eb6c1417ad-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1661&min_rtt=1661&rtt_var=830&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=178&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:53:59 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xYpcsWejDJr%2F5l6RmlfwsmubcXXv6fsiWFhQG7uP6VR7sh1evtzdH25mXMHUiU0KugBel8IcXmTIo5PIe4tJSSjqQkhCEtOmxIA3%2BflmMb%2FIuBR77Al8YC8Ovo4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a803999e8c24-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2066&min_rtt=2066&rtt_var=1033&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=139&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:01 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7pgju1CfVse0u7HWtE65b31TE49wgaJx5yFHCnhdoc5kP1iI1IP99wPl13QhFlI9ZK9PgjB7PzghAOhli%2B7qnAze%2F56k6BBAUDnJdS79RLfFNWoQosQ4DezW0ls%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a80ff954f797-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1547&min_rtt=1547&rtt_var=773&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=198&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4IT%2Fsb4b5aIhbWLsFGv6FqAjfZtAUP5MsqhKV9MxaUJdZaAhYWrOE3i3kohylWFE4EsQHfOz1nXFulKHplKcBiMgMx80r4TjRRnE2dKz88NefDEvt8dEwDdKFO4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a8294944c3ff-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1714&min_rtt=1714&rtt_var=857&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=244&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AoEGmQUIemPXNXdwmx1rbxNx8Q8vsMeVTUUFMA4RAPfr6a4XRz9Cob1lthFvExNGTpezFD%2FZonZWF3uklLSLy0Is88ICLm0DAJ2dOdB4%2BWAjNavadrjHbbzrbj0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a8419b0142d0-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1558&min_rtt=1558&rtt_var=779&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=210&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:12 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fVuGLeST2D5f62LVbD7dYETEbv%2B5hvmigUM0854JrfykklVJ829QdlDxm%2Fhoqz0iScIvB4GBJ5%2BJqjG9i4yvgJfLp8JVAG6hg3UQSOWnvo56kurwNGnIS9x9vb4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a8588b100f84-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1685&min_rtt=1685&rtt_var=842&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vLL%2BPcYYMvJG6lnnTx5x%2FEQQKKiAQANA0C3Q6iaKkHswebczDBjR6PgcTJpEL%2B7G1HzCDxT9DT%2Fh9dG9f3kcOYxCU3DXrNiRH7atAj2%2BnKf03PjCtlsR8lY2yek%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a8709e81f5f7-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1483&min_rtt=1483&rtt_var=741&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=227&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:18 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B4jC6VYlWqDsTbCiT1LLlS0J1UZJWYa6XBlulHM9xgv5YaijWrkKPc8o6JeavaPDRn%2BlmkZvdHKZIt6WZujT%2F1GMuk4K2dzqPyGZfS43neg%2BKZsnvpKMJJnFl2Y%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a87ccbb68c63-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2224&min_rtt=2224&rtt_var=1112&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WpeKo3Mwy0Rlmh3tY3EkTJVXZpU%2FUijbZZfwJ5%2FWIJBfX6bzyFhF0cDIMjbLVWWmLyOSBaw6detclHUOmYglsOZAwgz5t1VPsVU5JekW5BU7HNkk2kidunvEWto%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a889ac48438e-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1576&rtt_var=788&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:20 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WpeKo3Mwy0Rlmh3tY3EkTJVXZpU%2FUijbZZfwJ5%2FWIJBfX6bzyFhF0cDIMjbLVWWmLyOSBaw6detclHUOmYglsOZAwgz5t1VPsVU5JekW5BU7HNkk2kidunvEWto%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a889ac48438e-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1576&rtt_var=788&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=213&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:23 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AqbDTgaNWaa1VseqadWwq6La6zqmDaPZPoarYC30YIhVQmufPwFZRG0GqmX4Gr4b72S6o8MjceKmuZ95rHSKl0VnrEwgb%2F5DpchwIw3CXStQ6H3T7qDAAA%2F9e68%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a8997b8d443e-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1624&min_rtt=1624&rtt_var=812&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=198&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:26 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bLH5BjakKuNZNlrIfAXCOJY%2FbDA3bUr8BJxQEzuyEDBm8u1nu8D5ebIkJcF4KT%2FcRZQcl41DaqZNfGOjcHNkLHQZ78ciCBDRbGK7CBZQjoCC2IX%2FU%2FkdwYSjoAM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a8b0aed5f797-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1618&min_rtt=1618&rtt_var=809&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=198&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:28 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jWc65TCOSyJlU1ClMX3V6Lbjm5Iq3YRdZ3Pua7pO%2FhrSs1KL9RNx5H74mZJMke2YfSxFFIw7UBgUzy94BXzW0vOe3VhQWDidf%2B8iaqfhyP0DSyWG8VnzvwP4ui8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a8bd8fc742c1-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=82878&min_rtt=82878&rtt_var=41439&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=243&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:30 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JOjiJ9KSXdZOknfTIagMAhFdiedID9dGcUpGKH0PxzaW44vvVweSlw5NM7aMf1LbCQcK1rQSqT%2BFiVcXnMlBkldICOZOP%2F33UWPRVGhGeEnkrsyC1vei1aN4Guk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a8c8ec210f4d-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1529&min_rtt=1529&rtt_var=764&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:36 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kU2cS%2F8O%2Fbh1EOsX%2BHbVSJGPnjR7limMAVVM2PQvg8EqlUMjJ%2B4GCmE2eI%2BYoY6cT2xbdNEsDylfCZB3VojGXseV9qfiQ%2Fzn5AhVZBck1MqEa3q0fiUKguar0LE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a8ed3ea84264-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1529&min_rtt=1529&rtt_var=764&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=221&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:38 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YIxr7XCSZEjIINZymXh9IvvIj2rYoldzf084%2BkVTSQJyIU85hyZnPsez17oTxJ9gZ3xIn1y5Uw2kqDI5VTUMFNoZiRaopEPNfBt3Q8Ra4Tc0SMqBXbf0r4RyJSg%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a8f9af25c420-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1684&min_rtt=1684&rtt_var=842&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:40 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y%2Fs5cYGD6q5Q0xTS0jmaglMJqU3Lo96o630HGjlRhVzrE6qatp3d8bXAA1rfquLaRknhggQVR3NfhSJ34eQBonbMbzv8CULLbF%2FlI4J4Ioy4uzikMlPFnb69HHI%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a906beb65e82-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1585&min_rtt=1585&rtt_var=792&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=201&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:44 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=V7buGRNF4g9xe0lTaGh%2FAVJfBs2FoC6AIQMjauePwf9LimUymSEIUT20Krygp8FPtgPQt8%2BB3PykybnTf0QM2xgRz78x1DNIUaVzgzG0VrvLQkC%2BouDkwWpcgvM%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a91e0b3e4231-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1572&rtt_var=786&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=138&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:46 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QvWYbTiJCvODUxkcOUIiESJd%2BnJQdWwOwnOajNQEoLADqH6NoLPAam921eeSRI7TdFQWpLmXEA3jmnXZ123BwrPjQCeRnTJocuJOkNvihBF1OlByBHbxefhv3ig%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a92a4ac5f797-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1608&min_rtt=1608&rtt_var=804&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=198&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:48 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2VhGERaWtAIxGI8PXEJiKooqfHbyoEpp4i%2FBszRg6LwTj46C%2BpeYFvtfUxo3XmCmcsCGiYNRZ6eAQp40qmNZ3xjJa7csN7wJziwccG%2BPd8kwxEGcWIUKZR30ibA%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a9367b494339-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1579&min_rtt=1579&rtt_var=789&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:50 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0hduY35KQPHtz5BZ55iyXc5X0tFcosJR95vJeRLS4wwLGnymqa6Ngu4hUUG3irCeYg0c4xCb%2B8mLKqScpRVmo19a2V4HfXUbfN9ftxZHLv3kWBOnrDCo3jywT7I%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a9426c4715d7-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1496&min_rtt=1496&rtt_var=748&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=223&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:52 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=509a%2FRDskCokcvyLZkDg1VvDhBvFc9MWP3Fz8FqtFiAsykArz5e8b6542zuv6sy0%2B37CiPF1VRLaIHJ%2BYTeKoJE8BuiWui7BwMhG%2BEgOFG9GKMq%2BI%2FaO%2Bqe4fdE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a94eef254276-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1612&min_rtt=1612&rtt_var=806&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=229&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:54 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=O4TydVvX3aEcarMo8GQG%2BGMdIB3IBY9pVMwbhN34zWLbp64%2FQl%2B%2B5YENPuLJ%2B431ByO3XJzpweMMenrWquLvHwJVgpIcpNjUrALc8Vdr4IYMsq1rX4jiZEQ5SLE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a95b2cfd1885-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1634&min_rtt=1634&rtt_var=817&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=197&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:54:57 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UQlrkgSgJdfeTcTNDDB1XLjUuX3lRp643AcVKYmy132XzqbeDCZq3Y1iPu8UfpjFWoPm%2F9KOT81Iu7a5Tgo%2BQaU6ksjGBbPgEp6NxbZyA2vCoA1NipxKlY78%2FM8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a9729ec34334-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1570&min_rtt=1570&rtt_var=785&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=225&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:55:03 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=57CkZqC6TcOp0598%2FqLxWdLKKBsceI0tMd6VMs59n4FaalhYJGgimV6aSteAy7q2ARXoEutnl8g41ehbwAQ4NDvt37Cxg%2F4DsHSbAscTrwXhv5teBeHPNS0btpo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a9960bfa4291-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1622&min_rtt=1622&rtt_var=811&sent=2&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=209&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:55:05 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vtmZLlQV9Q2gEkhqPgQAYrSMjMqgmnX%2BVe7rNNJCKkY%2BBh1Kyv7ugaC6SVnuGL%2B%2F%2FnsSVGUxBeXIKUaV6AvuqWWtqQyzIMjEpBEKdlNOGjSHgkIvX2cjRkqcPt8%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a9a24bf10f49-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1516&min_rtt=1516&rtt_var=758&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:55:07 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PbdQZVHJiBTgTMFgHEaE8E9Jszxt9XqhBg5Rw7jR5Egj2%2BV0zjAwuEVJzBYD%2BZgN26mQTbGcyCyEDNOG1WjnOrbxZIf8gnluhk2GBRNkAQJ4%2F6gfAcM4ufWgRnQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a9af3f3b41e9-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1549&min_rtt=1549&rtt_var=774&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=247&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:55:09 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EQ%2F8f244nJBVycoNGCRTRJr96379679FdT3AwYNx75VgzKWpZoZdfVVbnu9Cyk4cNmD9MS1VrOipSF6sDQgA40tUpJJrGqnhkttWvlHil%2BH%2F3hXJ0Pylux3E3UE%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a9bb6e5e4313-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1633&min_rtt=1633&rtt_var=816&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:55:13 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kHCjsPck3I1tLLs%2FHkw4XkLSr2GhEtm52wBrqAAWTSte5ztCBR4%2F5AMhRm7hDIXIiXq6RQ4o5iRB9%2BRPGD5FGiySQvCL5z29X7Q5egpLLyPkGYVe9IjA9QiXZ1A%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a9d3ae5f4393-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1628&min_rtt=1628&rtt_var=814&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=216&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 19 Feb 2025 04:55:15 GMTContent-Type: text/html; charset=UTF-8Connection: closeX-Powered-By: PHP/5.4.16Status: 404 Not Foundcf-cache-status: DYNAMICvary: accept-encodingReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uGRpAJHM5Uv3X1Odo%2FNVPYfQDimwCVzZav2UIFMHU7E3SEnN3CmgW%2Fw%2BeeKrrrpTg9kNTZ6Hb8d6cDvACerFcShiBWr%2BbmvH%2Bn8DkMNQxknQQBhB0Gvk13TkF28%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 9143a9dfbf23c344-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1460&min_rtt=1460&rtt_var=730&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=391&delivery_rate=0&cwnd=220&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: svchost.exe, svchost.exe, 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp

String found in binary or memory: http://www.ibsensoftware.com/

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00B04164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B04164

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00B04164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00B04164

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00B03F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00B03F66

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AF001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00AF001C

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00B1CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00B1CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 Author: unknown
Source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: Process Memory Space: scan_0219025_pdf.exe PID: 6460, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown
Source: Process Memory Space: svchost.exe PID: 3192, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00A93B3A
Source: scan_0219025_pdf.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: scan_0219025_pdf.exe, 00000000.00000002.2049575720.0000000000B44000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_cc431b1b-8
Source: scan_0219025_pdf.exe, 00000000.00000002.2049575720.0000000000B44000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_6f96e689-2
Source: scan_0219025_pdf.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b302020f-f
Source: scan_0219025_pdf.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_2154bee7-4

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: scan_0219025_pdf.exe

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E3540 RtlImageNtHeader,RpcMgmtSetServerStackSize,I_RpcServerDisableExceptionFilter,RtlSetProcessIsCritical,SetProcessMitigationPolicy,SetProcessMitigationPolicy,SetProcessMitigationPolicy,SetProtectedPolicy,HeapSetInformation,NtSetInformationProcess,	2_2_009E3540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E33C0 NtSetInformationProcess,SetUnhandledExceptionFilter,SetErrorMode,GetProcessHeap,InitializeSRWLock,InitializeSRWLock,RegDisablePredefinedCacheEx,EtwEventRegister,GetCommandLineW,memset,GetCurrentProcess,NtSetInformationProcess,HeapFree,HeapFree,ExitProcess,GetCurrentProcess,SetProcessAffinityUpdateMode,	2_2_009E33C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E2720 RegOpenKeyExW,RegOpenKeyExW,RegOpenKeyExW,RegCloseKey,RegCloseKey,HeapAlloc,RegQueryValueExW,ExpandEnvironmentStringsW,LCMapStringW,RegQueryValueExW,HeapFree,AcquireSRWLockShared,ReleaseSRWLockShared,HeapAlloc,memcpy,memcpy,AcquireSRWLockExclusive,ReleaseSRWLockExclusive,RegGetValueW,ActivateActCtx,LoadLibraryExW,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,ActivateActCtx,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,ActivateActCtx,MultiByteToWideChar,RtlRunOnceExecuteOnce,NtQuerySystemInformation,GetProcAddress,DeactivateActCtx,RegCloseKey,HeapAlloc,RegGetValueW,WideCharToMultiByte,HeapAlloc,WideCharToMultiByte,HeapFree,ExpandEnvironmentStringsW,HeapFree,CreateActCtxW,GetLastError,HeapFree,HeapFree,GetLastError,CreateActCtxW,GetLastError,ReleaseActCtx,GetLastError,GetLastError,RtlNtStatusToDosError,GetLastError,LoadLibraryExW,RtlNtStatusToDosError,LoadLibraryExW,RtlNtStatusToDosError,HeapFree,ReleaseActCtx,	2_2_009E2720

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AFA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00AFA1EF

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AE8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00AE8310

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AF51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00AF51BD

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00A9E6A0	0_2_00A9E6A0
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00ABD975	0_2_00ABD975
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AB21C5	0_2_00AB21C5
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AC62D2	0_2_00AC62D2
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00B103DA	0_2_00B103DA
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AC242E	0_2_00AC242E
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AB25FA	0_2_00AB25FA
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AA66E1	0_2_00AA66E1
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AEE616	0_2_00AEE616
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AC878F	0_2_00AC878F
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AF8889	0_2_00AF8889
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AA8808	0_2_00AA8808
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00B10857	0_2_00B10857
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AC6844	0_2_00AC6844
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00ABCB21	0_2_00ABCB21
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AC6DB6	0_2_00AC6DB6
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AA6F9E	0_2_00AA6F9E
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AA3030	0_2_00AA3030
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AB3187	0_2_00AB3187
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00ABF1D9	0_2_00ABF1D9
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00A91287	0_2_00A91287
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AB1484	0_2_00AB1484
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AA5520	0_2_00AA5520
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AB7696	0_2_00AB7696
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AA5760	0_2_00AA5760
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AB1978	0_2_00AB1978
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AC9AB5	0_2_00AC9AB5
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00A9FCE0	0_2_00A9FCE0
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00ABBDA6	0_2_00ABBDA6
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AB1D90	0_2_00AB1D90
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00B17DDB	0_2_00B17DDB
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AA3FE0	0_2_00AA3FE0
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00A9DF00	0_2_00A9DF00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040549C	2_2_0040549C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004029D4	2_2_004029D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E2720	2_2_009E2720

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: String function: 00AB0AE3 appears 70 times
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: String function: 00AB8900 appears 42 times
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: String function: 00A97DE1 appears 36 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 00405B6F appears 42 times

Source: scan_0219025_pdf.exe, 00000000.00000003.2044244710.000000000381D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs scan_0219025_pdf.exe
Source: scan_0219025_pdf.exe, 00000000.00000003.2045830713.0000000003723000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs scan_0219025_pdf.exe

Source: scan_0219025_pdf.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Lokibot_0f421617 reference_sample = de6200b184832e7d3bfe00c193034192774e3cfca96120dc97ad6fed1e472080, os = windows, severity = x86, creation_date = 2021-07-20, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = 9ff5d594428e4a5de84f0142dfa9f54cb75489192461deb978c70f1bdc88acda, id = 0f421617-df2b-4cb5-9d10-d984f6553012, last_modified = 2021-08-23
Source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: Process Memory Space: scan_0219025_pdf.exe PID: 6460, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23
Source: Process Memory Space: svchost.exe PID: 3192, type: MEMORYSTR	Matched rule: Windows_Trojan_Lokibot_1f885282 reference_sample = 916eded682d11cbdf4bc872a8c1bcaae4d4e038ac0f869f59cc0a83867076409, os = windows, severity = x86, creation_date = 2021-06-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Lokibot, fingerprint = a7519bb0751a6c928af7548eaed2459e0ed26128350262d1278f74f2ad91331b, id = 1f885282-b60e-491e-ae1b-d26825e5aadb, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/6@1/1

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AFA06A GetLastError,FormatMessageW,

0_2_00AFA06A

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AE81CB AdjustTokenPrivileges,CloseHandle,	0_2_00AE81CB
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AE87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_00AE87E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,	2_2_0040650A

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AFB3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00AFB3FB

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00B0EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00B0EE0D

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00B083BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00B083BB

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00A94E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00A94E89

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_009E3360 I_RegisterSvchostNotificationCallback,StartServiceCtrlDispatcherW,ExitProcess,

2_2_009E3360

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_009E3360 I_RegisterSvchostNotificationCallback,StartServiceCtrlDispatcherW,ExitProcess,

2_2_009E3360

Source: C:\Windows\SysWOW64\svchost.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2246122658-3693405117-2476756634-1003\89dad5d484a9f889a3a8dfca823edc3e_9e146be9-c76a-4720-bcdb-53011b87bd06

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Mutant created: \Sessions\1\BaseNamedObjects\FDD42EE188E931437F4FBE2C

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

File created: C:\Users\user\AppData\Local\Temp\aut4D2F.tmp

Jump to behavior

Source: scan_0219025_pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: svchost.exe, 00000002.00000003.2048892256.0000000002FE5000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: scan_0219025_pdf.exe

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Users\user\Desktop\scan_0219025_pdf.exe "C:\Users\user\Desktop\scan_0219025_pdf.exe"
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\scan_0219025_pdf.exe"
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\scan_0219025_pdf.exe"	Jump to behavior

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: scan_0219025_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: scan_0219025_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: scan_0219025_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: scan_0219025_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: scan_0219025_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: scan_0219025_pdf.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: scan_0219025_pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: scan_0219025_pdf.exe, 00000000.00000003.2045830713.0000000003600000.00000004.00001000.00020000.00000000.sdmp, scan_0219025_pdf.exe, 00000000.00000003.2048703038.00000000037A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: scan_0219025_pdf.exe, 00000000.00000003.2045830713.0000000003600000.00000004.00001000.00020000.00000000.sdmp, scan_0219025_pdf.exe, 00000000.00000003.2048703038.00000000037A0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: svchost.exe, svchost.exe, 00000002.00000002.3301674856.00000000009E1000.00000020.00000001.01000000.00000005.sdmp
Source:	Binary string: svchost.pdbUGP source: svchost.exe, 00000002.00000002.3301674856.00000000009E1000.00000020.00000001.01000000.00000005.sdmp

Source: scan_0219025_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: scan_0219025_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: scan_0219025_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: scan_0219025_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: scan_0219025_pdf.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Yara detected aPLib compressed binary

Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.scan_0219025_pdf.exe.bf0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: scan_0219025_pdf.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3192, type: MEMORYSTR

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00A94B37 LoadLibraryA,GetProcAddress,

0_2_00A94B37

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AB8945 push ecx; ret	0_2_00AB8958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402AC0 push eax; ret	2_2_00402AD4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402AC0 push eax; ret	2_2_00402AFC

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_009E3360 I_RegisterSvchostNotificationCallback,StartServiceCtrlDispatcherW,ExitProcess,

2_2_009E3360

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00A948D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00A948D7
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00B15376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00B15376

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AB3187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00AB3187

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

API/Special instruction interceptor: Address: BE3234

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

API coverage: 4.0 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 1196

Thread sleep time: -300000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AF445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00AF445A
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFC6D1 FindFirstFileW,FindClose,	0_2_00AFC6D1
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00AFC75C
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00AFEF95
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00AFF0F2
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00AFF3F3
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AF37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00AF37EF
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AF3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00AF3B12
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00AFBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00AFBCBC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,	2_2_00403D74

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00A949A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00A949A0

Source: C:\Windows\SysWOW64\svchost.exe

Thread delayed: delay time: 60000

Jump to behavior

Source: svchost.exe, 00000002.00000002.3301903844.0000000003200000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00B03F09 BlockInput,

0_2_00B03F09

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00A93B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00A93B3A

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AC5A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00AC5A7C

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00A94B37 LoadLibraryA,GetProcAddress,

0_2_00A94B37

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040317B mov eax, dword ptr fs:[00000030h]	2_2_0040317B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E4410 mov eax, dword ptr fs:[00000030h]	2_2_009E4410
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E4410 mov eax, dword ptr fs:[00000030h]	2_2_009E4410
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E3060 mov eax, dword ptr fs:[00000030h]	2_2_009E3060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E3060 mov eax, dword ptr fs:[00000030h]	2_2_009E3060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E3060 mov eax, dword ptr fs:[00000030h]	2_2_009E3060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E3060 mov eax, dword ptr fs:[00000030h]	2_2_009E3060
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E3540 mov eax, dword ptr fs:[00000030h]	2_2_009E3540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E3540 mov eax, dword ptr fs:[00000030h]	2_2_009E3540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E3540 mov eax, dword ptr fs:[00000030h]	2_2_009E3540
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E56A0 mov eax, dword ptr fs:[00000030h]	2_2_009E56A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E56A0 mov ecx, dword ptr fs:[00000030h]	2_2_009E56A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E4610 mov eax, dword ptr fs:[00000030h]	2_2_009E4610
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E4610 mov eax, dword ptr fs:[00000030h]	2_2_009E4610
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E4610 mov eax, dword ptr fs:[00000030h]	2_2_009E4610
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E4610 mov eax, dword ptr fs:[00000030h]	2_2_009E4610

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AE80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_00AE80A9

Source: C:\Windows\SysWOW64\svchost.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00ABA124 SetUnhandledExceptionFilter,	0_2_00ABA124
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00ABA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00ABA155
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E5848 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_009E5848
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E33C0 NtSetInformationProcess,SetUnhandledExceptionFilter,SetErrorMode,GetProcessHeap,InitializeSRWLock,InitializeSRWLock,RegDisablePredefinedCacheEx,EtwEventRegister,GetCommandLineW,memset,GetCurrentProcess,NtSetInformationProcess,HeapFree,HeapFree,ExitProcess,GetCurrentProcess,SetProcessAffinityUpdateMode,	2_2_009E33C0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\svchost.exe

Network Connect: 104.21.112.1 80

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AE87B1 LogonUserW,

0_2_00AE87B1

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00A93B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00A93B3A

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00A948D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00A948D7

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AF4C27 mouse_event,

0_2_00AF4C27

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\scan_0219025_pdf.exe"

Jump to behavior

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AE7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00AE7CAF

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AE874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00AE874B

Source: scan_0219025_pdf.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: scan_0219025_pdf.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AB862B cpuid

0_2_00AB862B

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AC4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00AC4E87

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AD1E06 GetUserNameW,

0_2_00AD1E06

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00AC3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00AC3F3A

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe

Code function: 0_2_00A949A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00A949A0

Source: C:\Windows\SysWOW64\svchost.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Lokibot

Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: scan_0219025_pdf.exe PID: 6460, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost.exe PID: 3192, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000002.00000002.3301923635.0000000003212000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\SysWOW64\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\svchost.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\SysWOW64\svchost.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Source: C:\Windows\SysWOW64\svchost.exe	Code function: PopPassword		2_2_0040D069
Source: C:\Windows\SysWOW64\svchost.exe	Code function: SmtpPassword		2_2_0040D069

Source: scan_0219025_pdf.exe	Binary or memory string: WIN_81
Source: scan_0219025_pdf.exe	Binary or memory string: WIN_XP
Source: scan_0219025_pdf.exe	Binary or memory string: WIN_XPe
Source: scan_0219025_pdf.exe	Binary or memory string: WIN_VISTA
Source: scan_0219025_pdf.exe	Binary or memory string: WIN_7
Source: scan_0219025_pdf.exe	Binary or memory string: WIN_8
Source: scan_0219025_pdf.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.scan_0219025_pdf.exe.bf0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2050516573.0000000000BF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3301589688.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00B06283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_00B06283
Source: C:\Users\user\Desktop\scan_0219025_pdf.exe	Code function: 0_2_00B06747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00B06747
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E6AF0 EnterCriticalSection,RpcServerListen,LeaveCriticalSection,I_RpcMapWin32Status,	2_2_009E6AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E6BB0 RpcServerUnregisterIfEx,EnterCriticalSection,RpcMgmtStopServerListening,RpcMgmtWaitServerListen,LeaveCriticalSection,I_RpcMapWin32Status,	2_2_009E6BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_009E6B60 RpcServerUnregisterIf,EnterCriticalSection,RpcMgmtStopServerListening,RpcMgmtWaitServerListen,LeaveCriticalSection,I_RpcMapWin32Status,	2_2_009E6B60

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Service Execution	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	3 Windows Service	2 Valid Accounts	2 Obfuscated Files or Information	2 Credentials in Registry	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	117 System Information Discovery	Distributed Component Object Model	21 Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	3 Windows Service	1 Masquerading	LSA Secrets	131 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	212 Process Injection	2 Valid Accounts	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report scan_0219025_pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Lokibot

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
scan_0219025_pdf.exe