tricon916

Well hot damn, that was easy enough. Never knew you could go that route. Thanks!

Here’s my IIS 8.5 logs (removed identifying info)

#Software: Microsoft Internet Information Services 8.5
#Version: 1.0
#Date: 2016-07-14 17:35:22
#Fields: date time s-sitename s-computername s-ip cs-method cs-uri-stem cs-uri-query s-port cs-username c-ip cs-version cs(User-Agent) cs(Cookie) cs(Referer) cs-host sc-status sc-substatus sc-win32-status sc-bytes cs-bytes time-taken
2016-07-14 17:35:22 W3SVC655 A2NWVPWEB112 GET /wordpress/wp-admin/themes.php page=tgmpa-install-plugins&plugin_status=install 80 – HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/51.0.2704.103+Safari/537.36 wordpress_aeef90fcaddcc13c77e1843011f5e58c=%7C1469652660%7C29tl9JKMt3q3ehWKdlZVwz2S0jdavRBVcMxZoKkSKPR%7Ca27040d6f8a62e4af1a621aa7f44758e424b466cd2b3bb7a20a92549fc9203fb;+wordpress_logged_in_aeef90fcaddcc13c77e1843011f5e58c=%7C1469652660%7C29tl9JKMt3q3ehWKdlZVwz2S0jdavRBVcMxZoKkSKPR%7Cbb970b4d732b4b37c78b357eae65d59c75f01c8c977a225bdda134cafc6e44e4;+wp-settings-2=libraryContent%3Dbrowse;+wp-settings-time-2=1468451508 http://xxx.com/wordpress/wp-admin/update.php?action=install-plugin&plugin=jetpack&_wpnonce=fda91949ff xxx.com 200 0 0 24834 1035 10047
2016-07-14 17:35:23 W3SVC655 A2NWVPWEB112 GET /wordpress/wp-admin/load-scripts.php c=0&load%5B%5D=hoverIntent,common,admin-bar,svg-painter,heartbeat,wp-auth-check,underscore,shortcode,backbone,wp-util,wp-backbone,media-models,&load%5B%5D=wp-plupload,jquery-ui-core,jquery-ui-widget,jquery-ui-mouse,jquery-ui-sortable,mediaelement,wp-mediaelement,media-views,media-ed&load%5B%5D=itor,media-audiovideo,mce-view,imgareaselect,image-edit,jquery-ui-draggable,jquery-ui-slider,jquery-touch-punch,iris,wp-color-pi&load%5B%5D=cker,thickbox,jquery-ui-position,wp-pointer&ver=4.5.3 80 – HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/51.0.2704.103+Safari/537.36 wordpress_aeef90fcaddcc13c77e1843011f5e58c=%7C1469652660%7C29tl9JKMt3q3ehWKdlZVwz2S0jdavRBVcMxZoKkSKPR%7Ca27040d6f8a62e4af1a621aa7f44758e424b466cd2b3bb7a20a92549fc9203fb;+wordpress_logged_in_aeef90fcaddcc13c77e1843011f5e58c=%7C1469652660%7C29tl9JKMt3q3ehWKdlZVwz2S0jdavRBVcMxZoKkSKPR%7Cbb970b4d732b4b37c78b357eae65d59c75f01c8c977a225bdda134cafc6e44e4;+wp-settings-2=libraryContent%3Dbrowse;+wp-settings-time-2=1468451508 http://xxx.com/wordpress/wp-admin/themes.php?page=tgmpa-install-plugins&plugin_status=install xxx.com 200 0 0 165047 1372 1125
2016-07-14 17:36:24 W3SVC655 A2NWVPWEB112 GET /wordpress/wp-admin/themes.php page=tgmpa-install-plugins&plugin=jetpack&tgmpa-install=install-plugin&tgmpa-nonce=2d0aef27e7 80 – HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/51.0.2704.103+Safari/537.36 wordpress_aeef90fcaddcc13c77e1843011f5e58c=%7C1469652660%7C29tl9JKMt3q3ehWKdlZVwz2S0jdavRBVcMxZoKkSKPR%7Ca27040d6f8a62e4af1a621aa7f44758e424b466cd2b3bb7a20a92549fc9203fb;+wordpress_logged_in_aeef90fcaddcc13c77e1843011f5e58c=%7C1469652660%7C29tl9JKMt3q3ehWKdlZVwz2S0jdavRBVcMxZoKkSKPR%7Cbb970b4d732b4b37c78b357eae65d59c75f01c8c977a225bdda134cafc6e44e4;+wp-settings-2=libraryContent%3Dbrowse;+wp-settings-time-2=1468451508 http://xxx.com/wordpress/wp-admin/themes.php?page=tgmpa-install-plugins&plugin_status=install xxx.com 200 0 0 8792 1072 60643
2016-07-14 17:36:32 W3SVC655 A2NWVPWEB112 POST /wordpress/wp-admin/admin-ajax.php – 80 – HTTP/1.1 Mozilla/5.0+(Windows+NT+10.0;+Win64;+x64)+AppleWebKit/537.36+(KHTML,+like+Gecko)+Chrome/51.0.2704.103+Safari/537.36 wordpress_aeef90fcaddcc13c77e1843011f5e58c=%7C1469652660%7C29tl9JKMt3q3ehWKdlZVwz2S0jdavRBVcMxZoKkSKPR%7Ca27040d6f8a62e4af1a621aa7f44758e424b466cd2b3bb7a20a92549fc9203fb;+wordpress_logged_in_aeef90fcaddcc13c77e1843011f5e58c=%7C1469652660%7C29tl9JKMt3q3ehWKdlZVwz2S0jdavRBVcMxZoKkSKPR%7Cbb970b4d732b4b37c78b357eae65d59c75f01c8c977a225bdda134cafc6e44e4;+wp-settings-2=libraryContent%3Dbrowse;+wp-settings-time-2=1468451508 http://xxx.com/wordpress/wp-admin/themes.php?page=tgmpa-install-plugins&plugin_status=install xxx.com 200 0 0 544 1185 8859